9 ms·

Facebook Is Shutting Down Its API for Giving Your Friends’ Data to Apps

149 points by FabianBeiner 11y ago

untog 11y ago
What the post doesn't seem to mention is that you can still read the data of your friends who also use the app if you store it yourself. So sites like JobFusion could continue to use the API, but won't be able to use the data of users who haven't opted into their service. Honestly, their shutdown post[1] is pretty laughable, given what they're complaining about. [1] http://jobfusion.co/blog/no-more-referrals-fb-friends-api-shutting-down-april-30 http://jobfusion.co/blog/no-more-referrals-fb-friends-api-sh...
- cratermoon 11y ago
  It should also be noted that Facebook is going to app-specific IDs, which means that App A from company A can't share data with App B from company B, and the app-specific ID isn't your primary Facebook identifier. There is a Business Mapping API that lets different Facebook apps from the same company share data, and theoretically Company A and Company B could collaborate on that.
EScott11 11y ago
Stating the obvious here: It's pretty interesting to think about the tradeoffs here. As a user I understand the obvious privacy benefits of this move. As a developer, I found having access to that data quite useful sometimes.
nostromo 11y ago
While this is probably the right move for users, Facebook OAuth is less and less relevant. We see a trend across our customer deployments: more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year. Customer preference used to be: 1) Email & Password 2) Facebook. Now it's: 1) Email & Password 2) Google and/or Facebook (tied for 2nd). Other companies in our space (Janrain in particular) have confirmed this. I bet Facebook knows this and is trying to regain trust. The problem with what they are doing now is that more and more publishers and apps will probably just skip Facebook altogether. The primary reason Facebook was pushed so hard by so many for so long was because of the data provided. Take that away and people may move off the platform entirely.
- krschultz 11y ago
  I wonder if this is related to Android or Google Apps for Business more than any particular customer (dis)-satisfaction with Facebook. I know that I have been leaning on the Google+ login a lot more now than before, because it integrates so well with my Android phone.
  - mblevin 11y ago
    My sample-size-of-a-few take is that it's a combination of factors: 1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial 2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers 3) The demographic shift in Facebook usage to older users 4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information
    - guelo 11y ago
      Seeing a friend post embarrassing spam or porn is a horror inducing visceral experience. It wakes people up to the fact that Facebook's business is fundamentally unseemly.
      - mblevin 11y ago
        Exactly - given an average of 500+ friends and years of being active daily or weekly for a large chunk of that time, the probability that you've at least witnessed an embarrassing incident is many orders of magnitude greater than just having done it yourself. I really believe there's a high level of wariness among the general FB user population that no amount of marketing or changes in authorization policy can fix. It's a level of trust that's irretrievable.
  - amyjess 11y ago
    For me, I see Facebook as an application. It's a social network, just one thing of many I use. Google, on the other hand, is a platform. It's Gmail and YouTube and Maps and G+ and the Play Store and Drive and a whole bunch of other things. Not just a single app, but a family of apps that share a common identity. I don't see my Google account as just credentials for an app; I see it as a common login for a whole ton of different apps. In particular, I'm used to the paradigm of "use my Google account to pull my identity and my data down to my Android device", and I don't see any problem in extending that paradigm to apps that aren't made by Google.
sehugg 11y ago
This was a PITA for us, since we had been using App Requests as an invite channel, not snarfing the entire user graph like other sketchy apps do. Then Facebook changed the rules so that you had to be in the Games category to use App Requests -- kind of a strange policy unless you are trying to shut out competitors. Now there are App Invites which seem open to all apps, but I'm tired of the churn. Already our messaging app is shut out of certain platform features like Audience Network because we are deemed to "duplicate core functionality" (despite having this feature 3 years before they did). I may as well assume the ratchet will tighten even further and diversify, putting minimum effort into Facebook support.
- cordite 11y ago
  Sounds similar to what happens when apple adds functionality an app used to provide. At least you are not in the situation where they took an MIT licensed project of yours, brought in a few functions, and because you made the project and your app uses it--but it is now considered internal API, your next app submissions are declined.
  - r00fus 11y ago
    What app and API is this?
    - cordite 11y ago
      I cannot recall, but I do remember it being on HN as a submission or a link in comments somewhere
    - shakethemonkey 11y ago
      Might be referring to the Mogenerator case[1]. [1] http://rentzsch.tumblr.com/post/82453434093/apple-claims-mogenerators-methods http://rentzsch.tumblr.com/post/82453434093/apple-claims-mog...
      - cordite 11y ago
        This looks to be what I vaguely remember, and the update at the bottom is good news.
deleted 11y ago
[deleted]
joshstrange 11y ago
This is great news. Quick story: A few years ago I was tasked with working on a voter management platform (used by campagins to track people, how they are voting, and calls made to them. A CRM for voters if you will). The part I was in charge of the Facebook data. The company we were working for would have parties where they got people to sign in with FB and give ALL their friends info up which we would then fetch and import into our backend. The idea here was to grab their political affiliation, interests, jobs, education (pretty much everything FB offered up) and then use that to match them to their voter records (you can get these records from the state I guess). They could then target people based on interests and the like. Overall it was a neat project and my first foray into auto-scaling on AWS, event queues, and creating AMI's (ready to go images that when launched would start consuming the queue). However after working on this for a few weeks I took a look at FB's ToS and realized that by storing that data, planning on keeping it forever, and not giving users a way to delete the data (let alone any sort of private policy outlining what we were doing with the data) we were in violation. I brought this all to my bosses attention who more or less told me to "don't worry about it" and then shortly after I was moved off the project. That project (and the company that paid us to write it) no longer exists AFAIK (which is for the better) but this would have been the nail in the coffin for them. I'm really glad FB is taking this step b/c that project opened my eyes to something this article touches on which I don't think a large number of users have considered: when you "Friend" someone on FB you also give them a blank check for all of the data you share with them that they can sign over to any/everyone. It's good that FB is reigning this back in and not letting people give up access to their friends data.
- dmix 11y ago
  Has Facebook ever pursued companies who violated their ToS regarding storing this data? I highly doubt it. I'd imagine there are tons of similar companies who store this data. Pretty much every contract gig of mine that involved adding support for FB auth only decided to use Facebook because they wanted the metadata that comes with the FB oauth API. Otherwise they tend to prefer their our email/login systems. So I don't see what the voting company did as particularly unusual. FB is pretty much unable to control the data it releases to private companies after a user auths on their website and the data gets put in a private database. The only way for FB to practically protect that data is to not release it, as they've done today.
EGreg 11y ago
Another example of why a centralized platform can bite people in the butt. Whether it's massive changes to privacy settings for users, or massive changes for developers, there is always a one-size-fits-all policy, which will alienate many people. Many of whom have invested a lot on the platform. It would be much better to have a decentralized social platform: http://www.faqs.org/patents/app/20120110469#b http://www.faqs.org/patents/app/20120110469#b Similar problems exist on other centralized platforms. Even "net neutrality" is a result of lack of decentralization in internet service providers. It's a side effect. The most we can do is choose a one-size-fits-all solution.
UUMMUU 11y ago
I've been hoping they would do this for a while. A couple years ago my friend sent me 2 screenshots she'd grabbed from Lulu app of my "profile" basically a girl I'd dated had signed up and it pulled all the info from guys she was friends with and allowed girls with the app to rate them on everything from how polite they were to what they did for a living to how they were in bed. This was pretty insulting as the only way to delete your "profile" was to sign up for the app and log in with facebook. Sorry for the long story but I'm personally glad Facebook is doing this.
- jgrowl 11y ago
  That's pretty messed up!
idoh 11y ago
This is a pretty big deal for the app I work on, Birthday Cards. The app allows users to send cards to their friends on their birthday. Now it is a lot harder to know when the user's friend's birthdays are. With FB cutting off viral channels, and cutting off social graph info, there are not many reasons to develop apps on their platform. It's their platform, they can do what they want with it, but I am not sure what the use case for it is anymore.
- barce 11y ago
  Sorry about your app. It does definitely creates an opportunity for a birthday API free of Facebook.
- IkmoIkmo 11y ago
  Yep, same experience here (birthday cards as part of a larger app, which contains a viral component in it). The added value of a FB login etc just dropped tremendously. And it's made devs wary of building on FB as you may get a notice that a year later your API permissions are getting revoked. Did you ever find a solution to that by the way? I've had some ideas but they all require some manual actions. We're completely uninterested in the friends' data, we don't store it, it's only used for the individual user to allow him to perform an action at his own will (send a birthday card) and facilitate that. It's really too bad they clamped down on this one. It seems it could have easily been solved by putting the friends' birthday permission behind an approval wall (which even the user birthday requires, you need to get your app approved by FB if you use it), and offering users (an already existing) the ability to turn off sharing of basic data with friends' apps. Especially when people have it on their public profile, if your data can be scraped publicly because the user makes it public, why restrict an API? I'm one of those people that is very private about my data, but a lot of my users are 38 year old moms who share their date of birth (not necessarily year) with friends, and would love for them to send them a birthday card and couldn't care less if the day/month of their birth was somehow known to the world, while they're protected by a decent approval process and have the autonomy to turn off sharing. As a developer, I feel they weren't as practical as they could have been here and there.
  - 11y ago
mgkimsal 11y ago
Will they give me the option of not request users' basic data and email? Last I saw (last fall?) any app I created to do oauth stuff forced a request for far more info than I wanted or used, but there was no way to opt out of it. We would constantly have people bitching "I don't want you to have XYZ!" but we couldn't not have it available. :(
- immad 11y ago
  They launched anonymous login buttons, but its in beta: https://developers.facebook.com/products/anonymous-login https://developers.facebook.com/products/anonymous-login
  - mgkimsal 11y ago
    It'd be nice to just let me get the name, which is what people expect. They sort of expect identity to include their name, but not their friend list, which is another one of those 'basic' things that you can't not have access to. So... FB makes all this stuff overtly available, companies abuse it, people get pissed off and now the swing to 'anonymous'... Just let me get a name (and... maybe an email if they allow it). Google got this much better, but have their own issues.
    - tracker1 11y ago
      Agreed... name and email for correlation at least... this way you can start with FB login, but change/add the same email with a password, or register via Gmail or Twitter with the same address.. email gets sent for validation... I don't think it should be too much to ask to only get a "real name" and "email address" as a minimum permission set.
gfodor 11y ago
Basically all of the potential of the Facebook API can be represented by one idea: building applications on top of the social graph. Now that value proposition is dead, so the API is now little more than Microsoft Passport. I'm not really sure why Facebook is even keeping it around. edit: To be clear, preventing private friend data from being shared is a good idea. But they did more than that, an app you install can't even see the list of your friends that haven't also installed your app. This effectively kills any app concept that expects you to have a 'friend list' screen populated even if your friends do not have the app yet. In other words, most interesting social app ideas.
- chkuendig 11y ago
  apps can still get the list of friends of a user, so building on top of the social graph is still possible. (e.g. to discover friends using the same app)
  - gfodor 11y ago
    Only users who have your app. I have an app that lets users mail postcards to their friends. Open app, see friend list, pick friend, enter address, mail card. This idea no longer works (and has to rely upon phone contacts.) There are a million other ideas like this that aren't spammy/unethical/evil. This was basically the main pitch Zuck et al made for the API when it was launched, that you could bring in your friends and make your apps social. It's hard to imagine a way to bootstrap an app up from nothing if you have no way of knowing who the user might want to socialize with in the first place.
    - mavdi 11y ago
      Yup. I have this principle of never investing in or building on a closed ecosystem. This means I miss on a lot, but ultimately all of these services go down with no regard to your business.
Deebot 11y ago
Reading all of the whining from shady "app" developers in this thread put a huge smile on my face.
acjohnson55 11y ago
I shut off the App platform on my account a few months ago and never looked back. The impact to my user experience has been basically zero, but I feel like I'm much less likely to have my data taken advantage of.

149 points by FabianBeiner 11y ago

untog 11y ago

What the post doesn't seem to mention is that you can still read the data of your friends who also use the app if you store it yourself. So sites like JobFusion could continue to use the API, but won't be able to use the data of users who haven't opted into their service. Honestly, their shutdown post[1] is pretty laughable, given what they're complaining about. [1] http://jobfusion.co/blog/no-more-referrals-fb-friends-api-shutting-down-april-30 http://jobfusion.co/blog/no-more-referrals-fb-friends-api-sh...

cratermoon 11y ago
It should also be noted that Facebook is going to app-specific IDs, which means that App A from company A can't share data with App B from company B, and the app-specific ID isn't your primary Facebook identifier. There is a Business Mapping API that lets different Facebook apps from the same company share data, and theoretically Company A and Company B could collaborate on that.

EScott11 11y ago

Stating the obvious here: It's pretty interesting to think about the tradeoffs here. As a user I understand the obvious privacy benefits of this move. As a developer, I found having access to that data quite useful sometimes.

nostromo 11y ago

While this is probably the right move for users, Facebook OAuth is less and less relevant. We see a trend across our customer deployments: more people are choosing Google as an OAuth provider over Facebook than ever before. Google will overtake Facebook this year. Customer preference used to be: 1) Email & Password 2) Facebook. Now it's: 1) Email & Password 2) Google and/or Facebook (tied for 2nd). Other companies in our space (Janrain in particular) have confirmed this. I bet Facebook knows this and is trying to regain trust. The problem with what they are doing now is that more and more publishers and apps will probably just skip Facebook altogether. The primary reason Facebook was pushed so hard by so many for so long was because of the data provided. Take that away and people may move off the platform entirely.

krschultz 11y ago
I wonder if this is related to Android or Google Apps for Business more than any particular customer (dis)-satisfaction with Facebook. I know that I have been leaning on the Google+ login a lot more now than before, because it integrates so well with my Android phone.
- mblevin 11y ago
  My sample-size-of-a-few take is that it's a combination of factors: 1) The probability that a Facebook users at somepoint has had a bad experience with rogue Facebook app publishing personal information (or even an accidental acceptance) or was witness to a friend's experience is non-trivial 2) The increasing awareness of the scope and scale of personal data that is taken from logins and shared with advertisers 3) The demographic shift in Facebook usage to older users 4) The large secular increase in awareness of ongoing privacy and financial information breaches that rightly or wrongly is associated with over-sharing of personal information
  - guelo 11y ago
    Seeing a friend post embarrassing spam or porn is a horror inducing visceral experience. It wakes people up to the fact that Facebook's business is fundamentally unseemly.
    - mblevin 11y ago
      Exactly - given an average of 500+ friends and years of being active daily or weekly for a large chunk of that time, the probability that you've at least witnessed an embarrassing incident is many orders of magnitude greater than just having done it yourself. I really believe there's a high level of wariness among the general FB user population that no amount of marketing or changes in authorization policy can fix. It's a level of trust that's irretrievable.
- amyjess 11y ago
  For me, I see Facebook as an application. It's a social network, just one thing of many I use. Google, on the other hand, is a platform. It's Gmail and YouTube and Maps and G+ and the Play Store and Drive and a whole bunch of other things. Not just a single app, but a family of apps that share a common identity. I don't see my Google account as just credentials for an app; I see it as a common login for a whole ton of different apps. In particular, I'm used to the paradigm of "use my Google account to pull my identity and my data down to my Android device", and I don't see any problem in extending that paradigm to apps that aren't made by Google.

sehugg 11y ago

This was a PITA for us, since we had been using App Requests as an invite channel, not snarfing the entire user graph like other sketchy apps do. Then Facebook changed the rules so that you had to be in the Games category to use App Requests -- kind of a strange policy unless you are trying to shut out competitors. Now there are App Invites which seem open to all apps, but I'm tired of the churn. Already our messaging app is shut out of certain platform features like Audience Network because we are deemed to "duplicate core functionality" (despite having this feature 3 years before they did). I may as well assume the ratchet will tighten even further and diversify, putting minimum effort into Facebook support.

cordite 11y ago
Sounds similar to what happens when apple adds functionality an app used to provide. At least you are not in the situation where they took an MIT licensed project of yours, brought in a few functions, and because you made the project and your app uses it--but it is now considered internal API, your next app submissions are declined.
- r00fus 11y ago
  What app and API is this?
  - cordite 11y ago
    I cannot recall, but I do remember it being on HN as a submission or a link in comments somewhere
  - shakethemonkey 11y ago
    Might be referring to the Mogenerator case[1]. [1] http://rentzsch.tumblr.com/post/82453434093/apple-claims-mogenerators-methods http://rentzsch.tumblr.com/post/82453434093/apple-claims-mog...
    - cordite 11y ago
      This looks to be what I vaguely remember, and the update at the bottom is good news.

deleted 11y ago

[deleted]

joshstrange 11y ago

This is great news. Quick story: A few years ago I was tasked with working on a voter management platform (used by campagins to track people, how they are voting, and calls made to them. A CRM for voters if you will). The part I was in charge of the Facebook data. The company we were working for would have parties where they got people to sign in with FB and give ALL their friends info up which we would then fetch and import into our backend. The idea here was to grab their political affiliation, interests, jobs, education (pretty much everything FB offered up) and then use that to match them to their voter records (you can get these records from the state I guess). They could then target people based on interests and the like. Overall it was a neat project and my first foray into auto-scaling on AWS, event queues, and creating AMI's (ready to go images that when launched would start consuming the queue). However after working on this for a few weeks I took a look at FB's ToS and realized that by storing that data, planning on keeping it forever, and not giving users a way to delete the data (let alone any sort of private policy outlining what we were doing with the data) we were in violation. I brought this all to my bosses attention who more or less told me to "don't worry about it" and then shortly after I was moved off the project. That project (and the company that paid us to write it) no longer exists AFAIK (which is for the better) but this would have been the nail in the coffin for them. I'm really glad FB is taking this step b/c that project opened my eyes to something this article touches on which I don't think a large number of users have considered: when you "Friend" someone on FB you also give them a blank check for all of the data you share with them that they can sign over to any/everyone. It's good that FB is reigning this back in and not letting people give up access to their friends data.

dmix 11y ago
Has Facebook ever pursued companies who violated their ToS regarding storing this data? I highly doubt it. I'd imagine there are tons of similar companies who store this data. Pretty much every contract gig of mine that involved adding support for FB auth only decided to use Facebook because they wanted the metadata that comes with the FB oauth API. Otherwise they tend to prefer their our email/login systems. So I don't see what the voting company did as particularly unusual. FB is pretty much unable to control the data it releases to private companies after a user auths on their website and the data gets put in a private database. The only way for FB to practically protect that data is to not release it, as they've done today.

EGreg 11y ago

Another example of why a centralized platform can bite people in the butt. Whether it's massive changes to privacy settings for users, or massive changes for developers, there is always a one-size-fits-all policy, which will alienate many people. Many of whom have invested a lot on the platform. It would be much better to have a decentralized social platform: http://www.faqs.org/patents/app/20120110469#b http://www.faqs.org/patents/app/20120110469#b Similar problems exist on other centralized platforms. Even "net neutrality" is a result of lack of decentralization in internet service providers. It's a side effect. The most we can do is choose a one-size-fits-all solution.

UUMMUU 11y ago

I've been hoping they would do this for a while. A couple years ago my friend sent me 2 screenshots she'd grabbed from Lulu app of my "profile" basically a girl I'd dated had signed up and it pulled all the info from guys she was friends with and allowed girls with the app to rate them on everything from how polite they were to what they did for a living to how they were in bed. This was pretty insulting as the only way to delete your "profile" was to sign up for the app and log in with facebook. Sorry for the long story but I'm personally glad Facebook is doing this.

jgrowl 11y ago
That's pretty messed up!

idoh 11y ago

This is a pretty big deal for the app I work on, Birthday Cards. The app allows users to send cards to their friends on their birthday. Now it is a lot harder to know when the user's friend's birthdays are. With FB cutting off viral channels, and cutting off social graph info, there are not many reasons to develop apps on their platform. It's their platform, they can do what they want with it, but I am not sure what the use case for it is anymore.

barce 11y ago
Sorry about your app. It does definitely creates an opportunity for a birthday API free of Facebook.
IkmoIkmo 11y ago
Yep, same experience here (birthday cards as part of a larger app, which contains a viral component in it). The added value of a FB login etc just dropped tremendously. And it's made devs wary of building on FB as you may get a notice that a year later your API permissions are getting revoked. Did you ever find a solution to that by the way? I've had some ideas but they all require some manual actions. We're completely uninterested in the friends' data, we don't store it, it's only used for the individual user to allow him to perform an action at his own will (send a birthday card) and facilitate that. It's really too bad they clamped down on this one. It seems it could have easily been solved by putting the friends' birthday permission behind an approval wall (which even the user birthday requires, you need to get your app approved by FB if you use it), and offering users (an already existing) the ability to turn off sharing of basic data with friends' apps. Especially when people have it on their public profile, if your data can be scraped publicly because the user makes it public, why restrict an API? I'm one of those people that is very private about my data, but a lot of my users are 38 year old moms who share their date of birth (not necessarily year) with friends, and would love for them to send them a birthday card and couldn't care less if the day/month of their birth was somehow known to the world, while they're protected by a decent approval process and have the autonomy to turn off sharing. As a developer, I feel they weren't as practical as they could have been here and there.
- 11y ago

mgkimsal 11y ago

Will they give me the option of not request users' basic data and email? Last I saw (last fall?) any app I created to do oauth stuff forced a request for far more info than I wanted or used, but there was no way to opt out of it. We would constantly have people bitching "I don't want you to have XYZ!" but we couldn't not have it available. :(

immad 11y ago
They launched anonymous login buttons, but its in beta: https://developers.facebook.com/products/anonymous-login https://developers.facebook.com/products/anonymous-login
- mgkimsal 11y ago
  It'd be nice to just let me get the name, which is what people expect. They sort of expect identity to include their name, but not their friend list, which is another one of those 'basic' things that you can't not have access to. So... FB makes all this stuff overtly available, companies abuse it, people get pissed off and now the swing to 'anonymous'... Just let me get a name (and... maybe an email if they allow it). Google got this much better, but have their own issues.
  - tracker1 11y ago
    Agreed... name and email for correlation at least... this way you can start with FB login, but change/add the same email with a password, or register via Gmail or Twitter with the same address.. email gets sent for validation... I don't think it should be too much to ask to only get a "real name" and "email address" as a minimum permission set.

gfodor 11y ago

Basically all of the potential of the Facebook API can be represented by one idea: building applications on top of the social graph. Now that value proposition is dead, so the API is now little more than Microsoft Passport. I'm not really sure why Facebook is even keeping it around. edit: To be clear, preventing private friend data from being shared is a good idea. But they did more than that, an app you install can't even see the list of your friends that haven't also installed your app. This effectively kills any app concept that expects you to have a 'friend list' screen populated even if your friends do not have the app yet. In other words, most interesting social app ideas.

chkuendig 11y ago
apps can still get the list of friends of a user, so building on top of the social graph is still possible. (e.g. to discover friends using the same app)
- gfodor 11y ago
  Only users who have your app. I have an app that lets users mail postcards to their friends. Open app, see friend list, pick friend, enter address, mail card. This idea no longer works (and has to rely upon phone contacts.) There are a million other ideas like this that aren't spammy/unethical/evil. This was basically the main pitch Zuck et al made for the API when it was launched, that you could bring in your friends and make your apps social. It's hard to imagine a way to bootstrap an app up from nothing if you have no way of knowing who the user might want to socialize with in the first place.
  - mavdi 11y ago
    Yup. I have this principle of never investing in or building on a closed ecosystem. This means I miss on a lot, but ultimately all of these services go down with no regard to your business.

Deebot 11y ago

Reading all of the whining from shady "app" developers in this thread put a huge smile on my face.

acjohnson55 11y ago

I shut off the App platform on my account a few months ago and never looked back. The impact to my user experience has been basically zero, but I feel like I'm much less likely to have my data taken advantage of.