Facebook has admitted it allowed other big tech companies to read users' private messages, but denies it did so without consent.
The response came in a blog post by the firm Wednesday after a New York Times investigation found that Facebook gave companies including Netflix, Spotify and the Royal Bank of Canada the ability to read, write and delete users' private messages. The report on Tuesday also said it permitted Microsoft's Bing search engine to view the names of nearly all of a Facebook user's friends without consent.
Facebook said it enabled partner companies like Spotify to access users' private messages after a user had signed into Facebook through the partner company's app.
Spokespeople for Spotify and Netflix told the Times they were unaware of the broad powers Facebook had granted them, while an Royal Bank of Canada (RBC) spokesperson disputed the bank had such access.
Facebook stock was down more than 2 percent on Wednesday morning, as most other tech stocks were rallying.
The Times report, citing hundreds of internal documents and interviews with more than 50 former employees, also said Facebook allowed Amazon to obtain users' names and contact information through their friends, while Yahoo was able to view streams of friends' posts as recently as this summer. The report suggests Facebook's sharing of personal data extended well beyond what the social media giant had previously disclosed.
In all, the Times report said Facebook's data-sharing arrangements benefited more than 150 companies. The deals, in turn, helped Facebook bring in more users, it also said.
"To be clear: none of these partnerships or features gave companies access to information without people's permission, nor did they violate our 2012 settlement with the FTC (Federal Trade Commission)," Facebook said in the blog post.
Facebook said it shut down its "instant personalization" process in 2014, which allowed users to link their Facebook accounts with other services to see public information their friends shared. But it admitted the software components for the service were left in place after it shut down, potentially allowing developers to continue accessing users' personal information. Facebook said it has "no evidence data was used or misused after the program was shut down."
Facebook has been embroiled in a series of scandals this year over how it handles users' personal data. Documents released by a British lawmaker earlier this month showed Facebook had considered giving other companies special access to personal data.
Facebook shares have tumbled nearly 20 percent this year as investors have questioned the company's leadership and the possibility of more regulation.
A spokesperson for Netflix told CNBC the streaming service had launched a feature in 2014 that enabled members to recommend TV shows and movies to their Facebook friends via Messenger or Netflix, but then shut it down in 2015. "At no time did we access people's private messages on Facebook, or ask for the ability to do so," the Netflix spokesperson said.
A Microsoft spokesperson told CNBC in a statement: "Throughout our engagement with Facebook, we respected all user preferences." RBC said its use of the Facebook platform was limited to the development of a service that enabled clients to facilitate payment transactions to their Facebook friends, which it decommissioned in 2015.
In a statement, Amazon said: "We only use information in accordance with our privacy policy." Spotify said it cannot read users' private Facebook inbox messages across any of its current integrations.
"Previously, when users shared music from Spotify, they could add on text that was visible to Spotify. This has since been discontinued. We have no evidence that Spotify ever accessed users' private Facebook messages," a spokesperson for the company said.
