Aleksandr Kogan collected direct messages sent to and from Facebook users who installed his This Is Your Digital Life app, the Guardian can reveal. It follows Facebook’s admission that the company “may” have handed over the direct messages of some users to the Cambridge Analytica contractor without their express permission. The revelation is the most severe breach of privacy yet in the Cambridge Analytica scandal.

The social network admitted to the transfer of data in its warning to users whose friends had installed the This Is Your Digital Life app, which harvested data from not only the installer, but also all their friends on the site.

“A small number of people who logged into This Is Your Digital Life also shared their own news feed, timeline, posts and messages, which may have included posts and messages from you,” the company told affected users.

Following publication of this article, Kogan and Facebook contacted the Guardian. Kogan said he had never collected private message data for any commercial purpose of his business Global Science Research (GSR). He said private messages were only ever used for university work within his lab, for which Cambridge University ethics approval had been obtained.

A Facebook spokesperson said: “In 2014, Facebook’s platform policy allowed developers to request mailbox permissions but only if the person explicitly gave consent for this to happen. At the time when people provided access to their mailboxes - when Facebook messages were more of an inbox and less of a real-time messaging service - this enabled things like desktop apps that combined Facebook messages with messages from other services like SMS so that a person could access their messages all in one place. According to our records only a very small number of people explicitly opted into sharing this information. The feature was turned off in 2015.”

The Facebook admission that the company may have handed over direct messages of some users appears to echo previously unreported claims made by Christopher Wylie, the Cambridge Analytica whistleblower. Wylie told the Observer that he had seen a table, produced by Kogan, that included private messages. It remains unclear whether GSR, Kogan’s company, or Cambridge Analytica ever used the messages to build any targeting models.

Prior to, and after, publication of this article Kogan referred the Guardian to an interview with the New York Times in which he said his app collected information from a “couple thousand” people, and that the data “was obviously sensitive so we tried to be careful about who could access it”.

Kogan told the New York Times that he took messages only from people who had installed his app, not their friends, and that none of the information was shared with Cambridge Analytica.



For users who did not install the app, only their messages with the friend who had actively installed the app could have been shared, owing to the specific functionality offered by Facebook at the time. But those users would not have been offered any opportunity to opt out of the data sharing, since Facebook required the mailbox owner only to consent to uploading the entire contents, both sent and received.

For the users who did install the app, potentially their entire mailbox history was uploaded. Those users, however, would have been explicitly notified – through a simple clickthrough panel listing all the permissions they were handing over – that they were granting mailbox access.

The potential that Facebook may have handed over direct messages was first publicly highlighted in late March by Jonathan Albright, a professor at the Tow Center for Digital Journalism. On 21 March he noted that apps such as Kogan’s “could also request users’ private messages [ie their Facebook DM inbox] via the ‘read_mailbox’ API request”. Albright said at the time that Facebook should “immediately” share the API access that it had granted Kogan, as well as whether or not private messages were collected.

Speaking yesterday, Albright said: “Have to admit, I didn’t expect private DMs/messages to show up in people’s CA notifications today … Might explain why FB late getting these [notifications] out?”

• This article was amended on 16 April 2018 to add statements by Aleksandr Kogan and Facebook.

