User ID privacy breach on Facebook confirmed

Investigation discovers third-party apps inadvertantly sharing UID data with other organizations

Facebook acknowledged late Sunday night that some Facebook Platform applications were unintentionally sharing Facebook user IDs (UID) in violation of the site’s policy, a privacy breach first uncovered by a Wall Street Journal investigation.

Sharing a UID with a third-party application, an action the user must themselves accept to access any app, in many cases resulted in the transference of that identity data to “advertising and Internet tracking companies,” according to the report.

While it would be comforting to think this breach only affected the less popular or less trusted apps available on the Facebook platform, that isn’t the nature of this particular incident.

"A Facebook user ID may be inadvertently shared by a user's Internet browser or by an application," a Facebook spokesman said. Knowledge of an ID "does not permit access to anyone's private information on Facebook.”

All 10 of the most actively used Facebook apps passed along UIDs to other companies, with the user supposedly left in the dark. That mean’s Zynga, with its popular games FarmVille, Texas Hold’Em Poker, and FrontierVille, put tens of millions of players at risk of losing identifying information. In some cases, information passed along included users’ friends.

Facebook, without naming names, immediately attempted some damage control, even after confirming the above issues:

Press reports have exaggerated the implications of sharing a UID. Knowledge of a UID does not enable anyone to access private user information without explicit user consent. Nevertheless, we are committed to ensuring that even the inadvertent passing of UIDs is prevented and all applications are in compliance with our policy.

It may not be for some time before we understand exactly how many users lost information and to what extent their private data was handed over to outside organizations.