How Facebook turned a VPN into a surveillance engine to spy on Snapchat, YouTube and more

In 2013, Facebook bought an Israeli company called Onavo for about $120 million. At the time, the app was marketed as a helpful VPN, a tool to protect your data, reduce mobile usage, and keep your online life secure.

What most users didn’t know: installing Onavo gave Facebook complete visibility into your phone. It allowed the company to monitor every app you opened, how long you used it, every website you visited, and even when you did it. Over 33 million people downloaded the app, believing they were protecting their privacy, when they were actually opening the door to corporate surveillance.

According to publicly available court documents and regulatory findings, Facebook used Onavo to identify trends and detect rising competition. The company monitored usage of popular apps like Houseparty, YouTube, Amazon, and Snapchat, collecting detailed behavioural data to assess which ones were becoming threats.

Snapchat was the biggest target

By 2016, Snapchat’s popularity was exploding, but its traffic was encrypted, so Facebook couldn’t see exactly how users were engaging with it. That led to the creation of “Project Ghostbusters”, a covert effort to bypass Snapchat’s encryption and get a closer look at what users were doing on the app.

Here’s how it worked:

• Facebook engineers created custom client/server code based on Onavo’s infrastructure.
• The app installed a root certificate on user phones (with consent buried in legalese).
• Facebook then generated fake certificates to impersonate Snapchat’s servers, effectively decrypting and rerouting traffic for internal analysis.

The idea: use this decrypted data to inform strategy, product development, or acquisition plans.

Snap Said No, So Facebook Copied Instead

Armed with usage data, Facebook offered to buy Snapchat for $3 billion. When Snap CEO Evan Spiegel refused, Facebook didn’t back down. It launched Instagram Stories, a direct clone of Snapchat’s flagship feature. The rest is internet history.

But this wasn’t just about copying a competitor.

It was about weaponising internal surveillance to spot trends early, neutralise threats, and maintain dominance in the social media space.

Onavo Gets Banned, But Facebook Has a Backup Plan

In 2018, Apple kicked Onavo off the App Store for violating data privacy rules. Facebook responded by launching a similar program under a new name: Facebook Research, internally known as Project Atlas.

This time, the company paid users (some as young as 13 years old) up to $20/month to install the app which provided the same deep-level access to user activity.

When Apple discovered this, it revoked Facebook’s enterprise developer certificates, temporarily breaking all of Facebook’s internal iOS apps. The move was seen as one of Apple’s boldest enforcement actions ever.

Regulators Step In Eventually

In 2020, the Australian Competition and Consumer Commission (ACCC) took Facebook (now Meta) to court, alleging the company misled consumers with Onavo’s privacy claims. In 2023, Meta subsidiaries were fined a combined AUD 20 million for deceptive conduct, a rare example of Big Tech being held accountable.

Why This Still Matters

This isn’t just a story about a shady app. It’s about how one of the most powerful tech companies in the world built a surveillance system disguised as a privacy tool, then used that data to:

• Clone competitors,
• Kill threats before they grew too big,
• And target young users for data collection.

Even a decade later, Onavo remains a case study in how “data is power” and how far companies are willing to go to get it.