Question 1

How does it work?

Accepted Answer

Here are the stages a submission passes through 1. Identify: You identify a malicious platform app collecting data and abusing it. 2. Submit: You submit a potential issue through the Data Abuse Bounty form. 3. Vet: We vet the submission for a potential investigation. 4. Investigate: If we believe that your report is credible we will ask for further information and details to launch a deeper investigation. 5. Enforce: We will choose the appropriate enforcement, which may include shutting down the offending platform app, taking legal action, or an onsite forensic audit of the company selling or buying the data. 6. Reward: We reward you for helping protect people's information.

Question 2

What is the goal of this program?

Accepted Answer

We want to protect our users’ data and ensure their privacy isn’t compromised.

Question 3

What are you looking for?

Accepted Answer

Any situation where a third-party app currently or formerly operating on Facebook or Instagram collected data from users and then bought, sold, disclosed, transferred, or used user data in any manner prohibited by policies or terms governing the Facebook or Instagram platforms or any applicable laws.

Question 4

What do I need to provide?

Accepted Answer

You must provide information concerning: the identity of the applicable third-party app operator and the app’s name; the actions taken by the operator that violate policies or terms governing the Facebook or Instagram Platforms or are otherwise illegal; the nature and scope of the Facebook/Instagram user data or credentials abused; proof of such abuse; and any information you have about the reason or purpose for the third-party app operator’s abusive conduct.

Question 5

Information about the third-party app operator’s reason for the misuse?

Accepted Answer

This program is complementary to our existing Bug Bounty program in that it 'follows the data' even if the root cause isn't a security flaw in Facebook's code. Bad actors can maliciously collect and abuse Facebook/Instagram user data even when no security vulnerabilities exist. This program is intended to protect against that abuse.

Question 6

Can I report any third-party app’s misuse of user data?

Accepted Answer

You must have specific and direct knowledge regarding the Facebook/Instagram abusive conduct that you are reporting.

Question 7

How much can I expect to make?

Accepted Answer

We determine reward amounts based on a variety of factors, including the quality and impact of the report you submit. The amount of any reward is entirely up to our discretion. There is no maximum cap on the rewards offered under the program.

Question 8

When do I get paid?

Accepted Answer

We reward submissions once we complete an investigation based on your report that leads to discovery of significant actionable abuse.

Question 9

How long does it take to process submissions?

Accepted Answer

A data abuse investigation may require an extended period of time, based on the technical, legal, and organizational eﬀorts that may be required, which may vary depending on the country and market at issue. It will not be unusual for an investigation to take several months or longer.

Question 10

Where will updates be publicized?

Accepted Answer

Updates about and to the Data Abuse Bounty Program will be posted at https://bugbounty.meta.com/data-abuse.

Question 11

What if I tell you about a case you are already investigating?

Accepted Answer

As part of our program terms, only the first person to give us information about data abuse that leads to discovery of significant actionable conduct is eligible for a reward.

Question 12

What if I have more than one issue to report?

Accepted Answer

Your report should include all instances of data abuse you are aware of that relate to a single third-party app or website. Please submit a separate report for each separate third-party app or website you are reporting on.

Programa Data Abuse Bounty

Ejemplos del alcance del programa

Preguntas frecuentes