Developers access inactive user data (90-day policy bug)

2020 Unknown records affected

Data compromised

Details not publicly disclosed

Technical writeup

Bug allowed third-party developers to access data on inactive users if they were friends with active users. Violated post–Cambridge Analytica 90-day access policy. Fixed and disclosed July 1.

Root cause

Policy enforcement bug; developer access to inactive users.

References

https://about.fb.com/news/category/security/