Facebook is halting a scheme that gathered highly personal data from paid volunteers, after it was exposed.
TechCrunch said participants – including those aged 13-17 – had been paid up to $20 (£15.30) a month to open up their phones to deep analysis.
The news site said the app involved appeared to breach Apple’s privacy protection policies.
TechCrunch reported that Facebook used social media ads to target teenagers for the scheme. Facebook denies this.
A spokeswoman for the social network was unable to say whether it ran the programme in the UK or other countries outside the US.
The app had the potential to provide Facebook with “nearly limitless access” to a user’s device including:
the contents of private messages in chat apps including photos and videos
web browsing activity
logs of what apps were installed, and when they were used
a location history of where the owner had physically been
In addition, TechCrunch reported that users were asked to provide screenshots of their Amazon orders.
When the BBC visited one of the sign-up pages, it stated that Facebook would use the information to improve its services.
It added that “there are some instances when we will collect this information even where the app uses encryption, or from within secure browser sessions”.
It added that participants had to agree not to disclose “any information about this project to third parties”.
The social network said everyone involved in the programme had consented, and that market research was standard practice.
However, in the hours after TechCrunch’s report was published, Facebook said it would end the programme on Apple devices.
It has not, however, suspended a parallel effort on Android.
The research focused on users aged 13-35, and those under 18 were asked to get signed parental consent, Facebook said.
However, when the BBC identified itself as a 14-year-old boy during its test, it was able to download the app without any parental consent being sought. A page did state, however, that users should be over the age of 18.
A reporter from BuzzFeed News tried signing up via an alternative registration page, where obtaining parental consent involved sharing an email address and clicking a tick box. He said this form did not mention Facebook by name.
In a statement, Facebook took issue with TechCrunch’s characterisation of the programme.
“Key facts about this market research programme are being ignored,” a spokeswoman said via email.
“Despite early reports, there was nothing ‘secret’ about this; it was literally called the Facebook Research App. It wasn’t ‘spying’ as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate.
“Finally, less than 5% of the people who chose to participate in this market research program were teens. All of them with signed parental consent forms.”
Facebook ‘less popular with UK children’
Children ‘afterthought’ for social media companies
Facebook defends Mark Zuckerberg’s exposed emails
Meet the data guardians taking on the tech giants
When asked by the BBC how exactly the parental consent was obtained, Facebook said it was handled by a third party and did not elaborate.
Apple has not yet commented on whether it felt Facebook had broken its rules, and what action it might take as a result.
There is also an app for devices running Google’s mobile operating system Android. Google is also yet to comment.
TechCrunch’s detailed report explained Facebook had previously conducted market research using an app called Onavo, which it acquired in 2013.
Internal documents, published online in December, revealed Facebook had used the data gathered to decide to takeover WhatsApp and track usage of rivals including Snapchat and Twitter’s former video service Vine.
But in August last year, Facebook removed the app from the App Store after Apple complained that violated its data-collection rules.
However, Facebook has another research app that has been running since 2016. It circumvents Apple’s App Store by using testing tools typically used to install software that is still in development.
The app installs a “root certificate”, which enables deeper access to a phone’s software including functions not reachable by typical apps.
Apple allows the installation of root certificates in narrow cases, such as for companies that provide employees with iPhones but want to install internal apps, monitoring capabilities and extra security.
But Apple’s Developer Enterprise Program License Agreement makes it clear that these certificates must only be used for “specific business purposes” and “only for use by your employees”.
There are scenarios that allow exceptions to the rule, the policy goes on to say. But market research does not appear to be one of them.
Facebook insisted its market research policies were not unusual.
“Like many companies, we invite people to participate in research that helps us identify things we can be doing better,” it said.
“Since this research is aimed at helping Facebook understand how people use their mobile devices, we’ve provided extensive information about the type of data we collect and how they can participate.
“We don’t share this information with others and people can stop participating at any time.”