Set the “days without a Facebook privacy problem” counter to zero. This week, an alarmed developer contacted TechCrunch, informing us that their Facebook App Analytics weekly summary email had been delivered to someone outside their company. It contains sensitive business information, including weekly average users, page views and new users.
Forty-three hours after we contacted Facebook about the issue, the social network now confirms to TechCrunch that 3 percent of apps using Facebook Analytics had their weekly summary reports sent to their app’s testers, instead of only the app’s developers, admins and analysts.
Testers are often people outside of a developer’s company. If the leaked info got to an app’s competitors, it could provide them an advantage. At least they weren’t allowed to click through to view more extensive historical analytics data on Facebook’s site.
Facebook tells us it has fixed the problem and no personally identifiable information or contact info was improperly disclosed. It plans to notify all impacted developers about the leak today and has already begun.
Update: 1pm Pacific: TechCrunch was provided with this statement from a Facebook spokesperson:
“Due to an error in our email delivery system, weekly business performance summaries we send to developers about their account were also sent to a small group of those developer’s app testers. No personal information about people on Facebook was shared. We’re sorry for the error and have updated our system to prevent it from happening again.”
Techcrunch event
San Francisco | October 13-15, 2026
Below you can find the email the company is sending:
Subject line: We recently resolved an error with your weekly summary email
We wanted to let you know about a recent error where a summary e-mail from Facebook Analytics about your app was sent to testers of your app ‘[APP NAME WILL BE DYNAMICALLY INSERTED HERE]’. As you know, we send weekly summary emails to keep you up to date with some of your top-level metrics — these emails go to people you’ve identified as Admins, Analysts and Developers. You can also add Testers to your account, people designated by you to help test your apps when they’re in development.
We mistakenly sent the last weekly email summary to your Testers, in addition to the usual group of Admins, Analysts and Developers who get updates. Testers were only able to see the high-level summary information in the email, and were not able to access any other account information; if they clicked “View Dashboard” they did not have access to any of your Facebook Analytics information.
We apologize for the error and have made updates to prevent this from happening again.
One affected developer told TechCrunch “Not sure why it would ever be appropriate to send business metrics to an app user. When I created my app (in beta) I added dozens of people as testers as it only meant they could login to the app…not access info!” They’re still waiting for the disclosure from Facebook.
Facebook wouldn’t disclose a ballpark number of apps impacted by the error. Last year it announced 1 million apps, sites and bots were on Facebook Analytics. However, this issue only affected apps, and only 3 percent of them.
The mistake comes just weeks after a bug caused 14 million users’ Facebook status update composers to change their default privacy setting to public. And Facebook has had problems with misdelivering business information before. In 2014, Facebook accidentally sent advertisers receipts for other business’ ad campaigns, causing significant confusion. The company has also misreported metrics about Page reach and more on several occasions. Though user data didn’t leak and today’s issue isn’t as severe as others Facebook has dealt with, developers still consider their business metrics to be private, making this a breach of that privacy.
While Facebook has been working diligently to patch app platform privacy holes since the Cambridge Analytica scandal, removing access to many APIs and strengthening human reviews of apps, issues like today’s make it hard to believe Facebook has a proper handle on the data of its 2 billion users.
Josh Constine is a Venture Partner at ~$3 billion AUM early-stage VC fund SignalFire where he invests in pre-seed startups with a focus on consumer. He teaches startup pitch writing and fundraising strategy as a recurring lecturer at the Stanford Graduate School Of Business, and with accelerators like Z Fellows, Inception Studios, and Stanford ASES. Previously, Constine was Editor-At-Large for TechCrunch where he wrote 4000 articles and was ranked the #1 most cited tech journalist in the world from 2016-2020 by Techmeme. Constine has led 300+ on-stage interviews and keynotes in 18 countries with luminaries including Mark Zuckerberg and the CEOs of Shopify, DoorDash, Snapchat, Instagram, and more. Constine graduated from Stanford University with a Master’s degree he designed in Cybersociology, and wrote his thesis in 2008 on why remixable memes would be the future of marketing. He has been quoted in the NYT and WSJ, is regularly featured on CNN for his thoughts on AI and Silicon Valley, and advises startups on PR, fundraising, and organic growth.