This week, reports have percolated that Facebook is testing a new menu item, called "Protect," in its iOS app. The feature sports a blue shield icon, and tapping it redirects you to the App Store listing for Facebook-owned VPN app Onavo Protect. But while Onavo does claim to offer some tools that make the web safer, in practice it falls far short of the privacy protections that VPN users reasonably expect.
Onavo, Inc.[1] was an Israeli mobile web analytics company that was purchased by Facebook, Inc. (now Meta Platforms), who changed the company's name to Facebook Israel.[2] The company primarily performed its activities via consumer mobile apps, including the virtual private network (VPN) service Onavo Protect, which analysed web traffic sent through the VPN to provide statistics on the usage of other apps.
Guy Rosen and Roi Tiger founded Onavo in 2010. In October 2013, Onavo was acquired by Facebook, which used Onavo's analytics platform to monitor competitors. This influenced Facebook to make various business decisions, including its 2014 acquisition of WhatsApp.
Since the acquisition, Onavo was frequently classified as being spyware, as the VPN was used to monetize application usage data collected within an allegedly privacy-focused environment. In August 2018, Facebook pulled Onavo Protect from the iOS App Store due to violations of Apple's policy forbidding apps from collecting data on the usage of other apps. In February 2019, in response to criticism over a Facebook market research program employing similar techniques (including, in particular, being targeted towards teens), Onavo announced that it would close the Android version of Protect as well.
Onavo was founded in 2010 by Roi Tiger and Guy Rosen.[3] Onavo won multiple awards in 2011. The company received first prize at the Mobile Beat 2011 conference hosted by VentureBeat,[4] and the award for most innovative app at the 2011 International Startup Festival, as well as being selected as the "Best Mobile Startup" by The Next Web.[5][6]
Onavo had two rounds of funding: the first was a Series A investment for $3 million from Magma Venture Partners and Sequoia Capital in May 2011.[7] The second was a Series B investment of $13 million from Magma Ventures, Sequoia Capital, and Horizons Ventures. Onavo's sale to Facebook is one of the top exits for Magma Venture Partners and other Israeli venture capital firms.[8]
In February 2018, it was reported that Facebook had begun to include advertising for the Onavo Protect app within the Facebook app for iOS users in the United States. This led to denouncements of the app by media outlets, who classified Onavo as spyware because it is used by Facebook to monetize usage habits within a privacy-focused environment, and because the app listing did not contain a prominent disclosure of Facebook's ownership.[14][15][16] The app's listings were later amended to disclaim that Onavo Protect may collect information on app and website usage to improve Facebook products and services.[17][18]
In August 2018, Facebook pulled Onavo Protect from the iOS App Store after pressure by Apple, who declared it a violation of guidelines barring apps from harvesting data from other apps on a user's device.[25]
On February 21, 2019, in the wake of renewed controversy over the service due to the related Facebook Research program, Facebook announced that it would sunset Onavo Protect VPN and pull its app from Google Play Store. Effective immediately, the service ceased collecting personal data.[26]
The Australian Competition & Consumer Commission (ACCC) initiated legal proceedings against Facebook on December 16, 2020, alleging that Facebook engaged in "false, misleading or deceptive conduct" by using personal data collected from Onavo "for its own commercial purposes" contrary to Onavo's privacy-oriented marketing. Facebook responded that it was "always clear about the information we collect and how it is used", and would defend itself in court.[27][28] In July 2023 Australia's Federal Court ordered Facebook's owner to pay A$20 million for failing to disclose how Onavo would be used to collect data, as well as A$400,000 to cover the ACCC's legal fees.[29]
In 2016, Jordana Cutler, who had previously served as the director of Ambassador Ron Dermer's office and as an advisor to Prime Minister Benjamin Netanyahu, was appointed as Public Policy Director for Facebook Israel.[30]
In September 2016, Israel's Minister of Justice Ayelet Shaked and Minister of Internal Security Gilad Erdan introduced a bill aimed at curbing online incitement and hate speech, imposing restrictions on the dissemination of illegal and offensive content on the Internet and social media platforms. Dubbed the "Facebook Law" by the media, the proposal garnered widespread support within the government. Between 2016 and 2018, it passed through various stages of approval: first gaining endorsement from the Ministerial Committee for Legislation, then advancing through preliminary and first readings in the Knesset Plenum, making it eligible for consideration in the Constitution, Law and Justice Committee. In July 2018, the committee greenlit the bill for its second and third readings, setting the stage for final ratification by the Knesset plenary. However, at the eleventh hour, Prime Minister Benjamin Netanyahu unexpectedly intervened to halt the process.[31] In response, Nissan Slomiansky, chairman of the Constitution, Law, and Justice Committee, asserted that the sudden reversal was prompted by pressure from "large forces" with vested interests.[32] Media reports speculated that Jordana Cutler, Netanyahu's former advisor who serves as Facebook's Public Policy Director in Israel, played a pivotal role in influencing the Prime Minister's decision to block the legislation.[33] Lawyer Itai Leshem, claimed during his campaign in the 2024 Israeli Labor Party leadership election, that this was part of an ongoing alleged bribe between PM Netanyahu and Facebook.[34][35][36]
Onavo maintained consumer-oriented utility apps, including Onavo Count, which tracked bandwidth usage by apps, as well as Onavo Extend and Onavo Protect, which were VPN services for data compression and security, respectively.[40]
In August 2017, The Wall Street Journal reported that since the acquisition of Onavo by Facebook, the company had been using the company's data to monitor Snapchat and other startups that are performing "unusually well". This data influenced Facebook to acquire WhatsApp in 2014, and plan a video chat app to rival Houseparty in 2017.[43][44][45]
Facebook initially responded by claiming that Facebook Research did not violate Apple's developer license agreement, and denied that the program was intended to bypass the rules that banned Onavo Protect from the iOS App Store, nor was intended to replace Onavo. Facebook later announced that it would discontinue the Facebook Research program on iOS. Facebook Research remains available for Android devices.[47][10]
On January 30, 2019, Apple revoked Facebook's Enterprise Developer Program certificates, which caused all of the company's internal iOS apps (including beta versions of its public software, as well as internal apps relating to Facebook's workplace) to become inoperable.[48][49] Apple's public relations team stated that "Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple", and that the certificates were revoked "to protect our users and their data".[48] Apple reinstated the certificates on January 31.[50]
After discontinuing Onavo Protect and Facebook Research, Facebook released a market research app named Facebook Study (also known as Study or Study from Facebook) on June 11, 2019. Access to Study is restricted to Facebook users who are at least 18 years old. Addressing concerns with previous incarnations of the research app, Study does not use a VPN or a root certificate to conduct its data collection. Study participants are paid through PayPal.[53][54]
In 2020, a class-action lawsuit was filed on behalf of Facebook users, alleging that the company "exploited the rich data it deceptively extracted from its users to identify nascent competitors and then 'acquire, copy, or kill' these firms".[55]
Meta, Facebook's parent company, employed its controversial VPN service as a way to intercept and decrypt the traffic between the people accessing its service and competitors' servers. The company shut down Onavo in 2019, following a TechCrunch investigation revealing the spyware-like VPN software was employed in a research project to collect sensitive user data from paid volunteers aged between 13 and 25.
Everything kicked off in June 2016 when Mark Zuckerberg, founder and CEO at Meta, actively requested its team to "figure out a new way to get reliable analytics" into Snapchat's encrypted data as the platform was starting to get more traction in the market.
The Onavo team took things into their own hands, coming up with a solution about a month later. They would use a method known as "SSL man-in-the-middle" to decrypt Snapchat's protected traffic to inform Meta's business decision-making. Man-in-the-middle is a popular cyberattack tactic for which perpetrators position themselves between a user (in this case, Facebook users) and a given application.
Plaintiffs Sarah Grabert and Maximilian Klein filed the ongoing lawsuit against Facebook in 2020, accusing the company of lying about its data collection practices and deceptively extracting data from users to unfairly compete against new rivals in the market.
Onavo is known for their application Onavo Extend, which allows you to compress the size of data that you use so that you can use more data than what your carrier allows you to. Onavo also released Onavo Count in October of last year, which breaks down your data usage application by application in a visually beautiful manner.
64591212e2