Meta Sues US Subsidiary of Chinese Company for Scraping User Data

The logo of Meta Platforms in Davos, Switzerland, on May 22, 2022. Arnd Wiegmann/Reuters

Meta is suing the U.S.-based subsidiary of a Chinese tech firm and one individual, which it accused of illegally scraping data from Facebook and Instagram.

“Today, we’ve filed separate actions in federal court against Octopus and Defendant Ekrem Ates for scraping data from Facebook and Instagram,” a Meta representative said in a statement on July 5.

Meta alleged that Octopus, a U.S. subsidiary of a Chinese state-owned corporation, sold services and software that allowed users to “scrape” data from its platforms.

Scraping Data

Scraping is a method of collecting massive amounts of data from the internet by automating bots to swiftly visit webpages and extract stored information from them.

“Octopus designed the software to scrape data accessible to the user when logged into their accounts, including data about their Facebook Friends such as email address, phone number, gender and date of birth, as well as Instagram followers and engagement information such as name, user profile URL, location and number of likes and comments per post.”

Meta alleged that the scraping was a violation of its terms of service agreement and also of the Digital Millennium Copyright Act, a 1998 law that expanded copyright protections to digital platforms.

The collection of so much precious information by a Chinese subsidiary is immensely troubling for those targeted, as the Chinese Communist Party’s (CCP) national security and intelligence laws require China-based or Chinese-owned companies to share any data with the CCP if it’s deemed to be in the interest of national security.

This means that any data scraped from U.S. Meta users’ profiles by a Chinese-owned company could be collected by the CCP for its own use.

Meta also said it was suing Ates, a Turkish citizen, for his role in allegedly scraping the profiles of more than 350,000 Instagram profiles.

The mobile phone apps for Facebook (L), Instagram (C), and WhatsApp on a device in New York. Richard Drew/AP Photo

MyStalk

Ates allegedly used the scraped information to create a clone site called “MyStalk,” where anyone could view the material regardless of whether they had an actual Instagram account.

Meta said that it had been engaged in a number of legal actions against Ates since February 2021 but that the scraping attacks had persisted.

“Protecting people against scraping for hire services, operating across many platforms and national boundaries, also requires a collective effort from platforms, policymakers, and civil society and is needed to deter the abuse of these capabilities both among those who sell them and those who buy them.”

In a separate statement, Meta said that illegal clone sites such as MyStalk often gained access to private information through “self-compromised accounts.”

“A common way this happens is when people provide their Facebook or Instagram credentials to websites and apps offering free likes, followers or other promises in exchange for their Facebook or Instagram credentials,” the statement said. “None of the services are authorized, affiliated with or endorsed by Meta.”

“People should never provide their Facebook or Instagram password anywhere online outside of logging in through the official Facebook or Instagram website and apps or through the ‘Login with Facebook’ button that we allow authorized third-party developers to provide on their site.”

Ates, Meta said, used thousands of its fake Instagram accounts to falsely convince real Instagram users to connect their accounts, allowing MyStalk to build up quickly using the compromised information, which included photos, posts, stories, and profile information intended to be private to Instagram.