Some of Facebook's largest data deals are under federal criminal investigation following a nightmare year of scandals, reports the New York Times, which reveals that a New York grand jury has subpoenaed records from at least two leading manufacturers of smartphones and other devices which gained access to personal data of hundreds of millions of users.

The companies were among more than 150 firms, including Amazon, Apple, Microsoft and Sony, that had cut sharing deals with the world’s dominant social media platform. The agreements, previously reported in The New York Times, let the companies see users’ friends, contact information and other data, sometimes without consent. Facebook has phased out most of the partnerships over the past two years. -New York Times

Facebook - known for its occasional mistakes, said in a statement that they are "cooperating with investigators" and assured the Times that they "take those probes seriously."

It is unclear when the grand jury probe started, nor has the scope or focus of the inquiry been disclosed. It is being overseen by prosecutors in the Eastern District of New York.

The company is simultaneously facing investigations by the Securities and Exchange Commission (SEC) and the Federal Trade Commission (FTC), while the Justice Department's fraud division began investigating the social media giant following reports that political consulting firm Cambridge Analytica had improperly harvested the Facebook data of up to 87 million people for political purposes.

The investigation into the Cambridge Analytica scandal by both the DOJ and FBI is ongoing in the Northern District of California, with one former Cambridge employee reporting that he was questioned by investigators as recently as several weeks ago, while three other witnesses in the case said that much of the questioning revolved around Facebook's claims that it was misled by Cambridge.

In public statements, Facebook executives had said that Cambridge told the company it was gathering data only for academic purposes. But the fine print accompanying a quiz app that collected the information said it could also be used commercially. Selling user data would have violated Facebook’s rules at the time, yet the social network does not appear to have regularly checked that apps were complying. Facebook deleted the quiz app in December 2015. The disclosures about Cambridge last year thrust Facebook into the worst crisis of its history. Then came news reports last June and December that Facebook had given business partners — including makers of smartphones, tablets and other devices — deep access to users’ personal information, letting some companies effectively override users’ privacy settings. -New York Times

Facebook's orgy of data sharing allowed companies such as Microsoft map out the friends of virtually every Facebook user over Bing without their explicit consent, while Amazon was able to harvest users' names and contact information through their friends.

In fact, thanks to the United States having no general consumer privacy laws regarding data, up to 400 million people's private information was freely shared with the likes of Google, Netflix, Spotify and other partners - and Facebook didn't sell it; they gave everyone's information away for free throughout the tech community in order to foster industry relationships and advance their own interests.

China's Huawei and Russian search giant Yandex - accused last year by Ukraine of funneling user data to the Kremlin - also had access to Facebook's unique user IDs.

Facebook records show Yandex had access in 2017 to Facebook’s unique user IDs even after the social network stopped sharing them with other applications, citing privacy risks. A spokeswoman for Yandex, which was accused last year by Ukraine’s security service of funneling its user data to the Kremlin, said the company was unaware of the access and did not know why Facebook had allowed it to continue. She added that the Ukrainian allegations “have no merit.” -NYT

Facebook was able to circumvent a 2011 consent agreement with the Federal Trade Commission (FTC) which barred the company from sharing user data without explicit permission, because Facebook considered the partners extensions of itself - "service providers that allowed users to interact with their Facebook friends."

"This is just giving third parties permission to harvest data without you being informed of it or giving consent to it," said former FTC consumer protection bureau chief David Vladeck. "I don’t understand how this unconsented-to data harvesting can at all be justified under the consent decree."

Facebook has defended itself aggressively - claiming that the partnerships were permitted under a provision in the FTC agreement covering service providers as "extensions" of the social network.

Perhaps they were, once again, mistaken?