{"id":14075,"date":"2019-01-30T18:49:20","date_gmt":"2019-01-30T18:49:20","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/facebooks-vpn-app-puts-spotlight-on-kids-consent.html"},"modified":"2019-01-30T18:49:20","modified_gmt":"2019-01-30T18:49:20","slug":"facebooks-vpn-app-puts-spotlight-on-kids-consent","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/facebooks-vpn-app-puts-spotlight-on-kids-consent.html","title":{"rendered":"Facebook\u2019s VPN app puts spotlight on kids\u2019 consent"},"content":{"rendered":"

Facebook <\/a> could face fresh scrutiny in Europe following a\u00a0TechCrunch report <\/a>on its use of a VPN app to\u00a0monitor people\u2019s smartphone activity \u2014 including teenagers as young as 13.<\/p>\n

The Irish Data Protection Commission (DPC) told us it\u2019s asked Facebook to provide more information on what data is collected via the market research program, codenamed \u2018Project Atlas\u2019, so that it can determine whether there are grounds for further investigation.<\/p>\n

\u201cThe Irish DPC only became aware of this story through this morning\u2019s media reporting. Before we can make any assessment as to whether or not there are any data protection concerns, we will need to understand better to what extent, how and on what basis the personal data in question is being processed and used. We have asked Facebook to provide us with this information,\u201d said the DPC\u2019s head of communications, Graham Doyle.<\/p>\n

Under European union law there are special requirements for processing minors\u2019 personal data. And, as we reported earlier<\/a>,\u00a0Facebook\u2019s research program is open to people around the world \u2014 although the company has yet to confirm whether it has any teenage participants in Europe. (We\u2019ve asked and will update this report with any response.)<\/p>\n

If it turns out that European teens have been participating in the research effort Facebook could face another barrage of complaints under the bloc\u2019s General Data Protection Regulation (GDPR) \u2014 and the prospect of substantial fines if any local agencies determine it failed to live up to consent and \u2018privacy by design\u2019 requirements baked into the bloc\u2019s privacy regime. (Facebook\u2019s international HQ is located in Ireland, which makes the Irish DPC the lead agency for any investigation of the project.)<\/p>\n

Less aware of the risks<\/h2>\n

Setting out conditions applicable to consent for processing the personal data of children aged 13 or older, one section of text from the GDPR reads:\u00a0\u201cChildren merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data.\u201d<\/p>\n

\u201cGiven that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand,\u201d runs another.<\/p>\n

The VPN app that Facebook has been using as a data-harvesting vehicle (since we reported on the story it\u2019s closed down the iOS version of the app) requires participants give root access to their device \u2014 potentially affording the company a very high resolution view of their digital activity indeed.<\/p>\n

According to an investigation we commissioned data continuously collected via the VPN app could include private messages in social media apps; chats from in instant messaging apps \u2013 including photos\/videos sent to others; emails; web\u00a0searches; web browsing activity; and ongoing location information.<\/p>\n

Although Facebook has also not confirmed exactly what data types it pulls via the program.<\/p>\n

Participants are offered payments of up to $20 (in e-gift tokens) to incentivize them to sign up to have their data harvested on an ongoing basis, with the program open to people aged 13-35.<\/p>\n

Facebook says parental consent is required for minors aged 13-17. But it\u2019s not clear how robust the company\u2019s age verification process is \u2014 after\u00a0BBC journalist Dave Lee reported being able to sign himself up to participate in Project Atlas, earlier today, as a \u201c14-year-old boy\u2026 with two kids\u201d.<\/p>\n

\u201cIt required no proof of parental consent at all. I\u2019ve just been sent a link to download the iOS app, \u201d he added via Twitter.<\/p>\n

\n

I thought I’d see how robust the parental control for Facebook’s programme is. In less than five minutes I was able to sign up as a 14-year-old boy\u2026 with two kids. It required no proof of parental consent at all. I’ve just been sent a link to download the iOS app. pic.twitter.com\/z6www8SgQJ<\/a><\/p>\n

\u2014 Dave Lee (@DaveLeeBBC) January 30, 2019<\/a><\/p>\n<\/blockquote>\n

\n

So while Facebook previously told us less than 5% of the (unknown number of) participants in the research program are teens it\u2019s not clear whether it can make that sort of assertion \u2014 or indeed put any verifiable figure\u00a0on children\u2019s participation in the program \u2014 if\u00a0its age verification process\u00a0fails at the first hurdle.<\/p>\n

We\u2019ve reached out to Facebook with questions and to the app testing companies it\u2019s been working with to administer the program \u2014 namely Applause\/uTest <\/a> and BetaBound \u2014 to ask how they verify the age of participants and how parental consents are collected. At the time of writing none had replied.<\/p>\n

In an earlier statement, provided in response to our first report on Project Atlas, Facebook defended the initiative, saying:<\/p>\n

\n

Like many companies, we invite people to participate in research that helps us identify things we can be doing better. Since this research is aimed at helping Facebook understand how people use their mobile devices, we\u2019ve provided extensive information about the type of data we collect and how they can participate. We don\u2019t share this information with others and people can stop participating at any time.<\/p>\n<\/blockquote>\n

Questions over verification<\/h2>\n

Returning to the GDPR, Article 8 \u2014 which concerns conditions application to children\u2019s consent for processing personal data \u2014 states data controllers must make \u201creasonable efforts\u201d to verify consent when processing children\u2019s personal data:<\/p>\n

\n

The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.<\/p>\n<\/blockquote>\n

And in further\u00a0guidance<\/a> on conditions for processing children\u2019s data, the UK\u2019s data protection agency says \u201cdata protection by design and by default\u201d must be the baseline.<\/p>\n

\u201cTransparency is also key,\u201d it continues. \u201cYou can raise children\u2019s (and their parents\u2019) awareness of data protection risks, consequences, safeguards and rights by: Telling them what you are doing with their personal data; Being open about the risks and safeguards involved; and letting them know what to do if they are unhappy.\u00a0This will also help them make informed decisions about what personal data they wish to share.\u201d<\/p>\n

Facebook has said parental consent forms were \u201csigned\u201d and also claims it provided \u201cextensive information\u201d about the data being collected. But plenty of questions remain over exactly how robustly it verified participants\u2019 ages; how parental consents were obtained; as well as the quality and accessibility of the information provided to parents and teens.<\/p>\n

One UK-based EU data protection expert we asked for a view, Pat Walshe<\/a>, suggested the approach to consent described in the article would not pass muster under GDPR.<\/p>\n

\n

Facebook pays teens to install VPN that spies on them<\/a><\/p>\n<\/blockquote>\n

\n

As well as offering up to $20 a month in incentivize teens to sign away their privacy, Facebook\u2019s program also included a referral scheme \u2014 which meant users could increase their \u2018earnings\u2019 by recommending a friend \u2014 aping the\u00a0\u2018growth hacking\u2019 tactics deployed by app developers everywhere hoping to spark a viral run for their latest release. <\/span><\/p>\n

But a viral run on kids\u2019 privacy wouldn\u2019t be at all cool.\u00a0\u00a0<\/span><\/p>\n

In instances where minors signed up to be watched by Facebook the program appears to have rewarded them for pestering their peers to do the same.<\/p>\n

Yet an age verification system that can\u2019t distinguish an adult male from a 14-year-old boy seems unlikely to be able to correctly identify a child younger than 13 who\u2019s \u2014 say \u2014 pretending to be an adult in order to get some sweet e-gift rewards\u2026<\/p>\n

\n

Another update relating to consent. FB statement said teens had provided parental consent before using the program. I asked FB what exactly that meant \u2013 signed form, scanned? \u2013 they said the vendors handled it. For at least one of the vendors, consent was basically a checkbox.<\/p>\n

\u2014 Dave Lee (@DaveLeeBBC) January 30, 2019<\/a><\/p>\n<\/blockquote>\n

\n

Last fall<\/a>\u00a0the children\u2019s commissioner for England published a report raising concerns about how extensively minors\u2019 data is being collected and shared across the board, in both the private and public sectors, writing that:\u00a0\u201cChildren and parents need to be much more aware of what they share and consider the consequences.\u201d<\/p>\n

The UK\u2019s ICO is currently working on an\u00a0Age Appropriate Design Code of Practice \u2014 which a spokeswoman told us is due out later this year, following responses<\/a> to a\u00a0call for evidence<\/a>\u00a0last summer.<\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/TxcHm8c7nH4\/<\/p>","protected":false},"excerpt":{"rendered":"

Facebook could face fresh scrutiny in Europe following a\u00a0TechCrunch report on its use of a VPN app to\u00a0monitor people\u2019s smartphone activity \u2014 including teenagers as young as 13. The Irish <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-14075","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t