You used to be able to do searches on Facebook like "photos taken by friends of _____" and you could easily stalk them without being friends with them. Today that search will yield photos only if you are friends with them, or they enabled their privacy settings to public.
Neither exposed data that wasn’t available from using the product normally. For example you could visit someone’s profile, see who their friends were, and then look at those friends’ photos.
Basically everything you see on yourself, plus pages you visit and like, groups you belong to, your picture, your friend list, as well as their friends, so it was really three steps out and included things not available through FB normally.
It was totally predictable this data would get collected and abused.
That’s a fair product to build and provides lots of great value!
Now can it be abused...of course it can, a rouge app developer could try to use this data for whatever, or sell it. That’s a problem.
I think FB did a great job over the years though to improve UX for users to make it more clear what is happening and what information is being shared.
Back in the day you could for example get a users friend list for example (only public profile information though)...I think they did the right thing in limiting that to only users who also use the app.
It’s what makes apps like Spotify great...the fact that I can easily find my friends on it.
I think there is tradeoff in anything we build. And 2B people believe it’s a good tradeoff! And don’t tell me that users are stupid and don’t know...because then I am gonna flag you as stupid first :)
We also don’t sue Ford or the state that owns the streets for any accident that happens...that be nuts! We ask drivers and pedestrians to be responsible and that works for the most part. Of course there is the occasional deadly accident...but we accept that risk for the benefits of mobility.
Saw too much information about friends, realized some friends began "using" my app, just because it was made by me. Realized all the quizzes and dumb polls are data-gathering apps for the developers.
Realized, all the awkward "friend requests" from other side of the world, are fake profiles, to gather more data.
Made a fake profile, to seem from a different part of the continent, with such an awkward for us name. Facebook recommended me to befriend people from that area. Some accepted the friend request. Soon I had 30+ friends on a fake profile, all within the same "web" of friends, within same region.
Then I made more of those fake profiles, and made more fake apps with same theme, since this soo easy, for this and other regions which I suspected had hot women, and I was 25ish single at the time. My devious plan was to get outside my own social network and cast my net to catch the women who my algorithm would say - they are not on the edge of their own social network - they are a hub a popular and single etc. But that was too much work to complete. Later facebook gave me the graph search query where one could say "friend of my friends and single in this city", but that was still meh compared to what I had planned - since I would be doing the data gathering and analysis.
I wanted to catch the woman who had good privacy settings, those not show up on fb own searches, those not installing my app, but appearing in friend list of those who do accept fake friend requests or use dumb quizz apps. Those who appear to be recommended by many fake profiles.
If your friends can see your posts, the app can see your posts. If your friends can see your birthdate, the app can see your birthdate. And so on, so forth.