>Giving Apple access to users’ Facebook contacts and calendar entries, even if they had disabled data sharing, as part of a partnership that still exists.
First, the Verge article (https://www.theverge.com/2018/12/18/18147616/facebook-user-d...) did not do any original reporting, they are referencing the New York Times. This is another thing - people think stories have more weight and truth than they do because you've got a 100 publications writing about some other publications article.
The New York Times article makes this claim, but does not explain what "explicitly disabling data sharing" means.
Are they saying that I sign in to Spotify, I am asked to give access, I say no, but Spotify still gets the data? That would indeed be bad. It is unlikely this has happened. If this did happen, it would be worth a couple of words of explanation more, no?
They are instead likely referring to this dialog: https://c-7npsfqifvt0x24dofu4x2edctjtubujdx2edpn.g00.cnet.co...
Best guess, they are saying, although my friend disabled all the options in this dialog, I was still able to grant third parties access to my contact list and my messages, which included my friends data - that makes sense to me: I can't use a chat app if half the messages you sent me are missing.
In any case, we have to guess what really happened, because the New York Times can't be bothered to tell us.
This is exactly where we need congress to step in and regulate personal data.
I’ve built rest APIs at work and I almost always restrict this type of behavior. Why weren’t they only given access to create PMs and update PMs they create? No requests to pull all the PMs of a certain user.