The Court declared that the two companies engaged in conduct liable to mislead the public in promotions for the Onavo Protect app, by failing to adequately disclose that users’ data would be used for purposes other than providing Onavo Protect, including Meta’s commercial purposes.

Onavo Protect, a free app providing a virtual private network (VPN) service, was installed more than 270,000 times by Australian users between February 2016 and October 2017.

In Google and Apple App Store listings, Onavo Protect was promoted as a product that would keep users’ data protected and safe, for example with language such as “Use a free, fast and secure VPN to protect personal information” and “Helps Keep You and Your Data Safe”.

In fact, Onavo and Facebook Israel shared the personal activity data from users collected by the app in anonymised and aggregated form with parent company Meta (then known as Facebook Inc) for commercial benefit.

Anonymised and aggregated data shared with Meta included data about users’ internet and app activity, such as records of every app they accessed and time they spent using those apps. This was used to support Meta’s market research activities.

In joint submissions to the Court, Facebook Israel and Onavo agreed that the App Store listings conveyed that Onavo Protect users’ data would only be used to provide the Onavo Protect VPN. The listings did not mention that data collected by Onavo Protect about its Australian users’ online activities was also used for other purposes, including as a ‘business intelligence tool’.

ACCC Chairman Gina Cass-Gottlieb said "“n the case of the Onavo Protect app, we were concerned that consumers seeking to protect their privacy through a virtual private network were not clearly told that in downloading and using this app they were actually facilitating the use of their data for Meta’s commercial benefit."

Onavo and Facebook Israel are indirect wholly-owned subsidiaries of Meta. Both were the developers and suppliers of Onavo Protect and responsible for the listings in the Google and Apple App Stores.

US-based Onavo, Inc. and Onavo Mobile Ltd, based in Israel, were mobile analytics companies that were acquired by Facebook in October 2013. After the acquisition Onavo Mobile became Facebook Israel Ltd.

Onavo Protect was marketed as a virtual private network service or VPN, and for some users, a data management service. A VPN uses encryption and other security mechanisms designed to provide secure, private transmission of a user’s app and web traffic.

The Onavo Protect app was available for download in Australia from 1 February 2016 to February 2019 and the service was available for active use from December 2016. The service ceased in May 2019.

A VPN uses encryption and other security mechanisms designed to provide secure, private transmission of a user’s app and web traffic.

Source: ACCC