Facebook bug allowed apps to access users’ private photos United States

Facebook has revealed that a major software bug may have allowed third-party apps to wrongly access the photos of up to 6.8 million users, including images that people began uploading to the site but didn’t post publicly.

The mishap, which occurred over a 12-day period in September, adds to Facebook’s mounting privacy headaches after a series of incidents earlier this year in which it failed to fully safeguard the personal data of its users. This has already prompted European regulators to investigate, and brought fresh calls for the company to be fined.

In general, Facebook allows apps by third-party developers to obtain users’ permission and access photos shared on their timeline. Because of the bug, though, roughly 1500 apps could access ‘‘a broader set of photos than usual’’, Facebook explained in a blog post yesterday.

These included photos that a user may have started to post but abandoned before actually publishing, because Facebook keeps a copy of the draft in the event that a user might want to finish uploading it later.

Facebook’s latest revelation quick drew sharp rebukes from privacy advocates.

‘‘It’s stunning that Facebook has the ability to send user photos to third parties when the user has not fully uploaded the photo,’’ said Marc Rotenberg, executive director of the Electronic Privacy Information Centre.

In response, Facebook apologised to users.

‘‘Early next week we will be rolling out tools for app developers that will allow them to determine which people using their app might be impacted by this bug,’’ the company said. ‘‘We will be working with those developers to delete the photos from impacted users.’’

Facebook declined to detail the exact apps that may have obtained the photos, or what they may have done with them.

Rotenberg said the new incident offered ‘‘more evidence‘‘ that Facebook has run afoul of a 2011 agreement it brokered with the US Federal Trade Commission that required the tech giant to improve its privacy practices.

Several of Facebook’s recent privacy lapses have involved third-party apps. In the case of Cambridge Analytica, the firm previously harnessed profile information on Facebook users in 2015 through a quiz app developed by a researcher.