Facebook Inc. has taken steps to prevent it from collecting unauthorized data about people’s medical conditions, religious practices and finances but should do more to limit the sharing of such sensitive information, the New York Department of Financial Services said Thursday in an investigative report that was sharply critical of the social-media giant.
The regulator concluded that Facebook has failed to appropriately investigate its past collection of sensitive data and called for further federal action.
The state’s investigation began after The Wall Street Journal reported in 2019 that personal health apps, including a popular period and pregnancy tracker called Flo, were quietly passing data to Facebook.
The transfer occurred through a snippet of code known as a software development kit without providing users notice or obtaining consent. Facebook would then match the app users’ sensitive data to their social media accounts, allowing the developers to target ads at them.
Officially, Facebook’s terms of service prohibited app developers from providing the platform with data from children or about health, finance or other sensitive topics. But the company told the New York regulator that it had “routinely obtained” such data from developers, contrary to its own policies.
