Meta is simplifying the process for developers building applications that use clients’ business data, eliminating a standalone verification step as it relies more heavily on its existing business verification and app approval systems.
The change, announced in a developer update published on October 9, means technology providers will no longer need to submit business information for a separate Access Verification review before launching integrations that handle Meta business data.
Under the revised process, developers can move forward without waiting for the outcome of this additional assessment. Meta says its established verification systems have evolved to provide stronger checks, making the separate requirement unnecessary.
The company introduced Access Verification in 2022 to establish whether businesses seeking access to other companies’ data were legitimately operating as technology providers. The measure added an extra layer of scrutiny to API access, with certain requests rejected when the business associated with an app had not passed the verification process.
Existing safeguards will remain in place
Despite removing the separate review, Meta is not abandoning its main approval requirements for applications that handle business information.
Business Verification will still be mandatory before an app can access data belonging to other businesses. Developers seeking advanced permissions must also continue to pass App Review, with existing approval standards remaining unchanged.
Meta said its Business Verification and App Review systems now rely on more sophisticated signals to address the checks previously covered by Access Verification.
The company is also removing the Access Verification form, its prerequisites, and the associated status field from the App Dashboard. API endpoints that previously rejected requests because a business lacked a successful Access Verification status will no longer carry out that specific check.
App classification rules are also being clarified. Simply adding an app to a business will no longer alter its designated business use. Instead, an app will be classified as a Tech Provider when its developer explicitly upgrades it or when the app requests the relevant advanced permissions. Direct Integrator will remain the default classification.
Data protection obligations remain unchanged
The policy adjustment comes against the backdrop of earlier concerns over third-party access to Facebook user information.
The 2018 Cambridge Analytica scandal exposed how data access granted for academic purposes was allegedly exploited in a political influence operation. In another incident reported by the BBC in 2020, approximately 5,000 developers were mistakenly allowed to access information from Facebook user profiles.
These episodes contributed to years of efforts by Meta to tighten data controls and address regulatory and privacy concerns.
Under the new arrangement, developers must continue to comply with Meta’s Platform Terms and Developer Policies. Requirements relating to the Data Use Checkup, Data Handling Questionnaire and Data Protection Assessment also remain in force.
Meta stressed that ending Access Verification does not expand the uses permitted for data obtained through its platforms. Developers remain subject to the same rules governing how that information can be handled.
Meta seeks to streamline app development
The company described the move as part of a broader effort to remove overlapping checks from the process of developing and launching integrations.
Meta said it will continue examining its onboarding procedures for reviews that duplicate existing safeguards and will announce further changes as they are introduced.
Although the change removes one administrative hurdle for third-party developers, it does not eliminate the core verification and permission requirements governing access to business data. Meta also retains the option to introduce additional conditions for technology providers or data access where necessary to govern the sharing of information across its platforms.
Source: Meta Blog