The news that Facebook logs Android users’ calls and texts is raising new questions about Facebook’s privacy practices. Here are some answers and steps for opting out.
Facebook has clarified that it is just storing the metadata of calls, not the actual content. But make no mistake: there’s no such thing as “just” metadata. Metadata refers to almost everything except what you say or write: the identity of your contact, what time you contacted them, and even your location when you contacted them. This can paint a vivid picture of your habits, routines, and social circles. When combined with all of the other personal information and behavioral data available to Facebook, metadata collection is even more concerning.
Facebook has responded to media outrage with a "fact check" statement that Android users with Messenger installed had to opt in to Facebook logging their calls and texts. Generally, allowing users to opt in to a feature is generally much better from a privacy perspective than requiring them to opt out of a default. But the difference between opt-in and opt-out is not as simple as black and white. Misleading user interfaces, pushy pop-ups, and any number of variables can undermine users’ informed consent. Further, it’s hard for any one-time opt-in to meet the ethical bar of ongoing informed consent—something clearly needed when Facebook was not only accessing users’ call and text information but also storing it indefinitely.
Another important question to ask is about data minimization. It's a privacy best practice and an ethical imperative to not retain user data for any longer than absolutely necessary. The longer data is stored, the longer it is vulnerable to law enforcement requests, sharing with third parties, and other types of access or abuse. Why was this revealing user data stored for a moment beyond what was necessary for Facebook to provide services?
With all of these concerns in mind, Facebook's logging of user calls and texts presents a serious privacy problem.
Turn It Off
To check if this feature is on, and to turn it off, follow these steps. Note that this only applies to Android users, as Apple iOS does not allow this kind of silent access to call data.
On the home screen of Messenger, tap your profile picture in the top right corner.
Scroll down and tap People.
Tap Sync Contacts and make sure it is Off.
Now that you've turned off Facebook's call- and text-logging, you probably want to know how to delete any of that metadata that Facebook already has on its servers. Unfortunately, so far as we can tell, there's no easy way to do so. We'll update this post if we learn more.
UPDATE (3/30/18): Although Facebook's statement claims that changing this setting will also result in previously logged call and text history being deleted, this does not appear to be true for previously uploaded contact data. Further, this does not square with multiple user experiences reported by Ars Technica.
