Facebook Has Been Storing Logs Of Phone Calls, Text Messages For Years: Report

As the #deletefacebook campaign gains traction in the wake of the Cambridge Analytica data harvesting scandal, a number of people have reported that Facebook has also maintained a comprehensive record of phone calls and text messages on Android devices.

If you granted permission to read contacts during Facebook’s installation on Android a few versions ago—specifically before Android 4.1 (Jelly Bean)—that permission also granted Facebook access to call and message logs by default. The permission structure was changed in the Android API in version 16. But Android applications could bypass this change if they were written to earlier versions of the API, so Facebook API could continue to gain access to call and SMS data by specifying an earlier Android SDK version. Google deprecated version 4.0 of the Android API in October 2017—the point at which the latest call metadata in Facebook users’ data was found. Apple iOS has never allowed silent access to call data. –Ars Technica

Last week, New Zealander Dylan McKay requested his data from Facebook. Upon unzipping the downloaded file, McKay discovered that Facebook had stored around two years’ worth of metadata from phone calls he had made or received.

Downloaded my facebook data as a ZIP file

Somehow it has my entire call history with my partner's mum pic.twitter.com/CIRUguf4vD

— Dylan McKay (@dylanmckaynz) March 21, 2018

McKay’s grandmother emailed him a photo of SMS text messages logged by Facebook.

My grandmother emailed me this from her data dump

sorry for the potato quality (read: what is a screenshot)

has a number of SMS records, spanning 2015-2017 claims to not use facebook or messenger apps, I have not verified this though pic.twitter.com/Nax5aBUeWQ

— Dylan McKay (@dylanmckaynz) March 25, 2018

I also have these from my grandmother, covering May-October 2017 pic.twitter.com/0T5PSmZNKc

— Dylan McKay (@dylanmckaynz) March 25, 2018

Others have reported similar data logged from their devices:

Oh wow my deleted Facebook Zip file contains info on every single phone cellphone call and text I made for about a year- cool totally not creepy.

— Mat Johnson (@mat_johnson) March 23, 2018

I had a similar issue with mine on Android. Don't have FB installed but I do use Messenger and Instagram. Interestingly they only tracked when I rang my parents and girlfriend. Have never used Messenger in regards to my parents. Weird.

— Ben Wigham (@bmdwigham) March 24, 2018

I’ve just looked at the data files I requested from Facebook and they had every single phone number in my contacts. They had every single social event I went to, a list of all my friends (and their birthdays) and a list of every text I’ve sent.

— Emma Kennedy (@EmmaKennedy) March 25, 2018

Facebook explained that users’ contacts were uploaded in a “widely used practice.” 

“The most important part of apps and services that help you make connections is to make it easy to find the people you want to connect with. So, the first time you sign in on your phone to a messaging or social app, it’s a widely used practice to begin by uploading your phone contacts,” said the company.

“Contact uploading is optional. People are expressly asked if they want to give permission to upload their contacts from their phone – it’s explained right there in the apps when you get started. People can delete previously uploaded information at any time and can find all the information available to them in their account and activity log from our Download Your Information tool.”