Facebook Used VPN App Onavo for Covert Surveillance on Snapchat, YouTube & Competitors

In one of the most controversial episodes in tech surveillance history, Facebook transformed what appeared to be a privacy-focused VPN into a data-collection powerhouse to spy on rival platforms like Snapchat, YouTube, and Amazon.

In 2013, Facebook acquired Israeli startup Onavo for approximately $120 million, promoting its VPN app as a way to “protect your data, reduce mobile usage, and keep your online life secure.” What users didn’t know was that installing Onavo gave Facebook full visibility into their smartphone activities. The company could monitor every app opened, websites visited, duration of usage, and even precise timestamps, effectively creating a backdoor into users’ phones. Over 33 million people unknowingly downloaded what was essentially a corporate surveillance tool.

Court documents and regulatory findings revealed that Facebook used this data to identify emerging competitors and trends. Apps like Houseparty, YouTube, Amazon, and especially Snapchat were closely monitored to detect potential threats.

Targeting Snapchat: Project Ghostbusters
By 2016, Snapchat’s encrypted traffic posed a challenge. In response, Facebook launched a covert operation known as Project Ghostbusters. This involved:

• Creating custom client/server code based on Onavo infrastructure.
• Installing root certificates on user devices (buried in legal terms).
• Generating fake certificates to impersonate Snapchat servers, decrypting and rerouting traffic for internal analysis.

This allowed Facebook to bypass Snapchat’s encryption and gather insights into user behavior, informing its product strategy, development, and acquisition decisions.

From Surveillance to Copycat Features
Armed with these insights, Facebook offered to acquire Snapchat for $3 billion. When Snap CEO Evan Spiegel declined, Facebook responded by launching Instagram Stories — a direct clone of Snapchat’s core feature — reshaping the social media landscape.

This wasn’t just about copying a competitor; it was a strategic move to weaponize surveillance data, neutralize threats, and maintain dominance in the social media ecosystem. This revelation highlights how big tech companies leverage user data under the guise of privacy tools, raising serious concerns about digital privacy, corporate ethics, and regulatory oversight in the age of data-driven competition.