Facebook, Zoom convicted in Brazil of illegal access to user data

Photo: T.Y. Lim/Shutterstock

A court in the Brazilian northeastern state of Maranhão ordered Facebook and Zoom to compensate users for illegally harvesting their data. Both companies will have to pay BRL 20 million (just over USD 4 million) in collective damages and BRL 500 in individual compensation to each concerned user.

In March 2020, Vice’s Motherboard website revealed that the Zoom iOS app was sending user data to Facebook unbeknownst to the user — even if the user didn’t have a Facebook account.

Zoom had implemented the ‘login from Facebook’ button on its iOS app, which allowed the social media behemoth to access and extract user data from Zoom’s platform. Zoom apologized for allowing swaths of data that “included information about devices such as the mobile OS type and version, the device time zone, device OS, device model and carrier, screen size, processor cores, and disk space.”

The judge in the case found that Facebook and Zoom had violated users’ privacy rights by accessing data points that allowed the companies to direct ads, track and analyze user behavior, track conversion rates, and personalize user app experience. Having access to this type of data can be precious for advertisers.

In its defense, Zoom said it didn’t monetize the data — adding that it does not have a profit-sharing partnership with Facebook.

“While it has been argued that the data collected from such apps are only used to create a better user interface or to portray targeted ads to the users, the risk of completely forgoing privacy in such a collection is glaring and requires immediate remedial action,” wrote the Observer Research Foundation, a Delhi-based think tank.

As Brazilian Report journalists Fabiane Ziolla Menezes and Amanda Audi showed in November 2023, Brazilian data protection regulations allow practically all types of information sharing for marketing purposes. There is not yet a critical mass of consumers to question the predatory model in courts.

Experts, however, hope that the sharing of personal data for marketing purposes will eventually be on the radar of the Brazilian Data Protection Agency.