New limitations
This is the new Facebook's policy. It looks like access to for example user_friends
will be now limited to companies which can afford to implement advanced security systems.
Their requirements seem to be similar to the new European regulation - GPDR. These breaking changes are most likely caused by recent lawsuit related with Facebook & Cambridge Analytica and Mark Zuckerberg's promises during his testimony in Congress.
Facebook requires now to verify your business for some permissions:
If you don't pass app or business review, you will loose access to these APIs after August 1, 2018.
Influence on mobile applications
It's a really bad news for small applications, most likely it will kill Facebook integration.
They don't even provide any form to contact and discuss it, when you click on "support" you are forwarded to support page for Facebook Analytics.
If you have a small company and creating apps for fun, their terms are very demanding and could cause a huge problems for your business in the future. Therefore you should decide if it's worth to risk in exchange of displaying friends.
Interesting things about their requirements
When you start business verification process, it asks about company details, if you provide these, you will be asked to sign a contract with Facebook. I encourage to read carefully their terms, because they ask you to:
- provide them from time to time upon a written request access to your books, records, agreements, services, facilities etc. which relate to user data in order to audit your security mechanisms and procedures,
- cover review costs and expenses if they detect any noncompliance with their terms or security requirements.
Good luck to small apps...
References
Facebook Login Changelog - here you can check which permission requires app review, business verification and contract,
contract with Facebook is not published, you will receive it when you start a business verification,
short overview of Mark Zuckerberg's promises,
post on my blog with this answer,
from Facebook Login Changelog:
In order to help protect people's data, we're now requiring that an increased number of permissions go through the App Review process. For certain permissions, we are also requiring business verification and a contract between your business and Facebook. Businesses can be verified by providing forms of documentation including utility bills, business licenses, certificates of formation, articles of incorporation, tax ID numbers, and others. The contract introduces additional security requirements and other provisions around data.
August 6, 2019 - Update
Finally, the time has come. Permissions were supposed to stop working on August 1, 2018, but actually Facebook has given one extra year. Yesterday I received this e-mail:
As of September 4, 2019, MY_APP_NAME will no longer have access to the
following permissions or features:
user_friends
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…