Facebook's importance and scale has led to criticisms in many domains. Issues include Internet privacy, excessive retention of user information, its facial recognition software, DeepFace its addictive quality and its role in the workplace, including employer access to employee accounts.
Facebook has been criticized for electricity usage, tax avoidance, real-name user requirement policies, censorship and its involvement in the United States PRISM surveillance program. According to The Express Tribune, Facebook "avoided billions of dollars in tax using offshore companies".
Facebook is alleged to have harmful psychological effects on its users, including feelings of jealousy and stress, a lack of attention and social media addiction. According to Kaufmann et al., mothers' motivations for using social media are often related to their social and mental health. European antitrust regulator Margrethe Vestager stated that Facebook's terms of service relating to private data were "unbalanced".
Facebook has been criticized for allowing users to publish illegal or offensive material. Specifics include copyright and intellectual property infringement, hate speech, incitement of rape and terrorism, fake news, and crimes, murders, and livestreaming violent incidents. Commentators have accused Facebook of willingly facilitating the spread of such content. Sri Lanka blocked both Facebook and WhatsApp in May 2019 after anti-Muslim riots, the worst in the country since the Easter Sunday bombing in the same year as a temporary measure to maintain peace in Sri Lanka.
Facebook removed 3 billion fake accounts only during the last quarter of 2018 and the first quarter of 2019; in comparison, the social network reports 2.39 billion monthly active users.
In late July 2019, the company announced it was under antitrust investigation by the Federal Trade Commission.
Read the full text
The consumer advocacy group Which? claimed individuals were still utilizing Facebook to set up fraudulent five-star ratings for products. The group identified 14 communities that exchange reviews for either money or complimentary items such as watches, earbuds, and sprinklers.
Facebook and its parent Meta have been subject to regulatory actions and fines over past privacy failures, including a substantial fine by the Irish Data Protection Commission for a severe 2018 breach affecting millions of accounts. Earlier, Facebook's role in the Facebook–Cambridge Analytica data scandal exposed the personal data of tens of millions of users without proper consent, leading to global criticism and legal actions. Moreover, investigative reports have highlighted ongoing issues with fraudulent and scam advertisements on Facebook platforms, revealing that the company earned significant revenue from such content even as enforcement efforts have lagged, drawing regulatory pressure worldwide.
Privacy concerns
Facebook has experienced a steady stream of controversies over how it handles user privacy, repeatedly adjusting its privacy settings and policies. Since 2009, Facebook has been participating in the PRISM secret program, sharing with the US National Security Agency audio, video, photographs, e-mails, documents and connection logs from user profiles, among other social media services.
On November 29, 2011, Facebook settled Federal Trade Commission charges that it deceived consumers by failing to keep privacy promises. In August 2013 High-Tech Bridge published a study showing that links included in Facebook messaging service messages were being accessed by Facebook. In January 2014 two users filed a lawsuit against Facebook alleging that their privacy had been violated by this practice.
On June 7, 2018, Facebook announced that a bug had resulted in about 14 million Facebook users having their default sharing setting for all new posts set to "public". Its data-sharing agreement with Chinese companies such as Huawei came under the scrutiny of US lawmakers, although the information accessed was not stored on Huawei servers and remained on users' phones. On April 4, 2019, half a billion records of Facebook users were found exposed on Amazon cloud servers, containing information about users' friends, likes, groups, and checked-in locations, as well as names, passwords and email addresses.
The phone numbers of at least 200 million Facebook users were found to be exposed on an open online database in September 2019. They included 133 million US users, 18 million from the UK, and 50 million from users in Vietnam. After removing duplicates, the 419 million records have been reduced to 219 million. The database went offline after TechCrunch contacted the web host. It is thought the records were amassed using a tool that Facebook disabled in April 2018 after the Cambridge Analytica controversy. A Facebook spokeswoman said in a statement: "The dataset is old and appears to have information obtained before we made changes last year...There is no evidence that Facebook accounts were compromised."
Facebook's privacy problems resulted in companies like Viber Media and Mozilla discontinuing advertising on Facebook's platforms. A January 2024 study by Consumer Reports found that among a self-selected group of volunteer participants, each user is monitored or tracked by over two thousand companies on average. LiveRamp, a San Francisco-based data broker, is responsible for 96 per cent of the data. Other companies such as Home Depot, Macy's, and Walmart are involved as well.
In March 2024, a court in California released documents detailing Facebook's 2016 "Project Ghostbusters". The project was aimed at helping Facebook compete with Snapchat and involved Facebook trying to develop decryption tools to collect, decrypt, and analyze traffic that users generated when visiting Snapchat and, eventually, YouTube and Amazon. The company eventually used its tool Onavo to initiate man-in-the-middle attacks and read users' traffic before it was encrypted.
Racial bias
Facebook was accused of committing "systemic" racial bias by the Equal Employment Opportunity Commission based on the complaints of three rejected candidates and a current employee of the company. The three rejected employees, along with the Operational Manager at Facebook as of March 2021, accused the firm of discriminating against Black people. The EEOC initiated an investigation into the case in March 2021.
Shadow profiles
A "shadow profile" refers to the data Facebook collects about individuals without their explicit permission. For example, the "like" button that appears on third-party websites allows the company to collect information about an individual's internet browsing habits, even if the individual is not a Facebook user. Data can also be collected by other users. For example, a Facebook user can link their email account to their Facebook to find friends on the site, allowing the company to collect the email addresses of users and non-users alike. Over time, countless data points about an individual are collected; any single data point perhaps cannot identify an individual, but together allows the company to form a unique "profile".
This practice has been criticized by those who believe people should be able to opt-out of involuntary data collection. Additionally, while Facebook users have the ability to download and inspect the data they provide to the site, data from the user's "shadow profile" is not included, and non-users of Facebook do not have access to this tool regardless. The company has also been unclear whether it is possible for a person to revoke Facebook's access to their "shadow profile".
Cambridge Analytica
Facebook customer Global Science Research sold information on over 87 million Facebook users to Cambridge Analytica, a political data analysis firm led by Alexander Nix. While approximately 270,000 people used the app, Facebook's API permitted data collection from their friends without their knowledge. At first Facebook downplayed the significance of the breach, and suggested that Cambridge Analytica no longer had access. Facebook then issued a statement expressing alarm and suspended Cambridge Analytica. Review of documents and interviews with former Facebook employees suggested that Cambridge Analytica still possessed the data. This was a violation of Facebook's consent decree with the Federal Trade Commission. This violation potentially carried a penalty of $40,000 ($51,285 in 2025 dollars) per occurrence, totalling trillions of dollars.
According to The Guardian, both Facebook and Cambridge Analytica threatened to sue the newspaper if it published the story. After publication, Facebook claimed that it had been "lied to". On March 23, 2018, the English High Court granted an application by the Information Commissioner's Office for a warrant to search Cambridge Analytica's London offices, ending a standoff between Facebook and the Information Commissioner over responsibility.
On March 25, Facebook published a statement by Zuckerberg in major UK and US newspapers apologizing over a "breach of trust".
You may have heard about a quiz app built by a university researcher that leaked Facebook data of millions of people in 2014. This was a breach of trust, and I'm sorry we didn't do more at the time. We're now taking steps to make sure this doesn't happen again.
We've already stopped apps like this from getting so much information. Now we're limiting the data apps get when you sign in using Facebook.
We're also investigating every single app that had access to large amounts of data before we fixed this. We expect there are others. And when we find them, we will ban them and tell everyone affected.
Finally, we'll remind you which apps you've given access to your information – so you can shut off the ones you don't want anymore.
Thank you for believing in this community. I promise to do better for you.
On March 26, the Federal Trade Commission opened an investigation into the matter. The controversy led Facebook to end its partnerships with data brokers who aid advertisers in targeting users.
On April 24, 2019, Facebook said it could face a fine between $3 billion ($3.78 billion in 2025 dollars) to $5 billion ($6.3 billion in 2025 dollars) as the result of an investigation by the Federal Trade Commission. On July 24, 2019, the FTC fined Facebook $5 billion, the largest penalty ever imposed on a company for violating consumer privacy. Additionally, Facebook had to implement a new privacy structure, follow a 20-year settlement order, and allow the FTC to monitor Facebook. Cambridge Analytica's CEO and a developer faced restrictions on future business dealings and were ordered to destroy any personal information they collected. Cambridge Analytica filed for bankruptcy. Facebook also implemented additional privacy controls and settings in part to comply with the European Union's General Data Protection Regulation (GDPR), which took effect in May. Facebook also ended its active opposition to the California Consumer Privacy Act.
Some, such as Meghan McCain, have drawn an equivalence between the use of data by Cambridge Analytica and the Barack Obama's 2012 campaign, which, according to Investor's Business Daily, "encouraged supporters to download an Obama 2012 Facebook app that, when activated, let the campaign collect Facebook data both on users and their friends." Carol Davidsen, the Obama for America (OFA) former director of integration and media analytics, wrote that "Facebook was surprised we were able to suck out the whole social graph, but they didn't stop us once they realised that was what we were doing". PolitiFact has rated McCain's statements "Half-True", on the basis that "in Obama's case, direct users knew they were handing over their data to a political campaign" whereas with Cambridge Analytica, users thought they were only taking a personality quiz for academic purposes, and while the Obama campaign only used the data "to have their supporters contact their most persuadable friends", Cambridge Analytica "targeted users, friends and lookalikes directly with digital ads."
DataSpii
In July 2019, cybersecurity researcher Sam Jadali exposed a catastrophic data leak known as DataSpii involving data provider DDMR and marketing intelligence company Nacho Analytics (NA). Branding itself as the "God mode for the internet", NA through DDMR, provided its members access to private Facebook photos and Facebook Messenger attachments including tax returns. DataSpii harvested data from millions of Chrome and Firefox users through compromised browser extensions. The NA website stated it collected data from millions of opt-in users. Jadali, along with journalists from Ars Technica and The Washington Post, interviewed impacted users, including a Washington Post staff member. According to the interviews, the impacted users did not consent to such collection.
DataSpii demonstrated how a compromised user exposed the data of others, including the private photos and Messenger attachments belonging to a Facebook user's network of friends.
DataSpii exploited Facebook's practice of making private photos and Messenger attachments publicly accessible via unique URLs. To bolster security in this regard, Facebook appends query strings in the URLs so as to limit the period of accessibility. Nevertheless, NA provided real-time access to these unique URLs, which were intended to be secure. This allowed NA members to access the private content within the restricted time frame designated by Facebook.
The Washington Post's Geoffrey Fowler, in collaboration with Jadali, opened Fowler's private Facebook photo in a browser with a compromised browser extension. Within minutes, they anonymously retrieved the "private" photo. To validate this proof-of-concept, they searched for Fowler's name using NA, which yielded his photo as a search result. In addition, Jadali discovered Fowler's Washington Post colleague, Nick Mourtoupalas, was directly impacted by DataSpii. Jadali's investigation elucidated how DataSpii disseminated private data to additional third-parties, including foreign entities, within minutes of the data being acquired. In doing so, he identified the third-parties who were scraping, storing, and potentially enabling the facial-recognition of individuals in photos being furnished by DataSpii.
Breaches
On September 28, 2018, Facebook experienced a major breach in its security, exposing the data of 50 million users. The data breach started in July 2017 and was discovered on September 16. Facebook notified users affected by the exploit and logged them out of their accounts. In March 2019, Facebook confirmed a password compromise of millions of Facebook lite application users also affected millions of Instagram users. The reason cited was the storage of password as plain text instead of encryption which could be read by its employees.
On December 19, 2019, security researcher Bob Diachenko discovered a database containing more than 267 million Facebook user IDs, phone numbers, and names that were left exposed on the web for anyone to access without a password or any other authentication. In February 2020, Facebook encountered a major security breach in which its official Twitter account was hacked by a Saudi Arabia-based group called "OurMine". The group has a history of actively exposing high-profile social media profiles' vulnerabilities.
In April 2021, The Guardian reported approximately half a billion users' data had been stolen including birthdates and phone numbers. Facebook alleged it was "old data" from a problem fixed in August 2019 despite the data's having been released a year and a half later only in 2021; it declined to speak with journalists, had apparently not notified regulators, called the problem "unfixable", and said it would not be advising users. In September 2024, Meta paid a $101 million fine for storing up to 600 million passwords of Facebook and Instagram users in plain text. The practice was initially discovered in 2019, though reports indicate passwords were stored in plain text since 2012.
Phone data and activity
After acquiring Onavo in 2013, Facebook used its Onavo Protect virtual private network (VPN) app to collect information on users' web traffic and app usage. This allowed Facebook to monitor its competitors' performance, and motivated Facebook to acquire WhatsApp in 2014. Media outlets classified Onavo Protect as spyware. In August 2018, Facebook removed the app in response to pressure from Apple, who asserted that it violated their guidelines. The Australian Competition and Consumer Commission sued Facebook on December 16, 2020, for "false, misleading or deceptive conduct" in response to the company's unauthorized use of personal data obtained from Onavo for business purposes in contrast to Onavo's privacy-oriented marketing.
In 2016, Facebook Research launched Project Atlas, offering some users between the ages of 13 and 35 up to $20 per month ($27.00 in 2025 dollars) in exchange for their personal data, including their app usage, web browsing history, web search history, location history, personal messages, photos, videos, emails and Amazon order history. In January 2019, TechCrunch reported on the project. This led Apple to temporarily revoke Facebook's Enterprise Developer Program certificates for one day, preventing Facebook Research from operating on iOS devices and disabling Facebook's internal iOS apps.
Ars Technica reported in April 2018 that the Facebook Android app had been harvesting user data, including phone calls and text messages, since 2015. In May 2018, several Android users filed a class action lawsuit against Facebook for invading their privacy. In January 2020, Facebook launched the Off-Facebook Activity page, which allows users to see information collected by Facebook about their non-Facebook activities. The Washington Post columnist Geoffrey A. Fowler found that this included what other apps he used on his phone, even while the Facebook app was closed, what other web sites he visited on his phone, and what in-store purchases he made from affiliated businesses, even while his phone was completely off.
In November 2021, a report was published by Fairplay, Global Action Plan and Reset Australia detailing accusations that Facebook was continuing to manage their ad targeting system with data collected from teen users. The accusations follow announcements by Facebook in July 2021 that they would cease ad targeting children.
Public apologies
The company first apologized for its privacy abuses in 2009.
Facebook apologies have appeared in newspapers, television, blog posts and on Facebook. On March 25, 2018, leading US and UK newspapers published full-page ads with a personal apology from Zuckerberg. Zuckerberg issued a verbal apology on CNN. In May 2010, he apologized for discrepancies in privacy settings.
Previously, Facebook had its privacy settings spread out over 20 pages, and has now put all of its privacy settings on one page, which makes it more difficult for third-party apps to access the user's personal information. In addition to publicly apologizing, Facebook has said that it will be reviewing and auditing thousands of apps that display "suspicious activities" in an effort to ensure that this breach of privacy does not happen again. In a 2010 report regarding privacy, a research project stated that not a lot of information is available regarding the consequences of what people disclose online so often what is available are just reports made available through popular media. In 2017, a former Facebook executive went on the record to discuss how social media platforms have contributed to the unraveling of the "fabric of society".
.PNG){kind=link}