Facebook suspends another data analytics firm after CNBC discovers it was using tactics like Cambridge Analytica

Update: This story has been updated to reflect CubeYou's statement that it was not involved with the Apply Magic Sauce quiz, which was labeled for academic use only. CubeYou disputes Facebook's statements to CNBC that the You Are What You Like quiz was approved only for academic research purposes. CubeYou also says that it has not shared individualized information about Facebook users with marketers.

Facebook is suspending a data analytics firm called CubeYou from the platform after CNBC notified the company that CubeYou was collecting information about users through quizzes.

Facebook told CNBC that one earlier CubeYou app was approved for academic research only, and is investigating whether the company improperly misused information from this app for marketing purposes. The scenario is eerily similar to how Cambridge Analytica received unauthorized access to data from as many as 87 million Facebook user accounts to target political marketing. CubeYou has denied the apps were mislabeled or misused, and is seeking to be reinstated.

CubeYou, whose CEO denies any deception, sold data that had been collected by researchers working with the Psychometrics Lab at Cambridge University, similar to how Cambridge Analytica used information it obtained from other professors at the school for political marketing.

The CubeYou discovery suggests that collecting data from quizzes and using it for marketing purposes was far from an isolated incident. Moreover, the fact Facebook had not discovered the apparent mislabeling of its quiz for academic use until CNBC pointed out the problem suggests the platform has little insight into or control over this activity.

Facebook, however, disputed the implication that it can't exercise proper oversight over these types of apps, telling CNBC that it can't control information that companies mislabel. Upon being notified of CubeYou's alleged violations, Facebook said it would suspend all CubeYou's apps until a further audit could be completed.

"These are serious claims and we have suspended CubeYou from Facebook while we investigate them," Ime Archibong, Facebook vice president of product partnerships, said in a statement.

"If they refuse or fail our audit, their apps will be banned from Facebook. In addition, we will work with the UK ICO [Information Commissioner's Office] to ask the University of Cambridge about the development of apps in general by its Psychometrics Centre given this case and the misuse by Kogan," he said. Aleksander Kogan was the researcher who built the quiz used by Cambridge Analytica.

"We want to thank CNBC for bringing this case to our attention," Archibong added.

The revelation comes as Facebook CEO Mark Zuckerberg prepares to answer questions before Congress this week stemming from the Cambridge Analytica scandal. The Senate Commerce and Judiciary committees and the House Energy and Commerce Committee are expected to quiz him on what the site is doing to enhance user privacy, and prevent foreign actors from using Facebook to meddle in future elections.

Since the Cambridge Analytica scandal erupted, Zuckerberg has claimed personal responsibility for the data privacy leaks, and the company has launched several initiatives to increase user control over their data.

CubeYou boasts on its website that it uses census data and various web and social apps on Facebook and Twitter to collect personal information. CubeYou then contracts with advertising agencies that want to target certain types of Facebook users for ad campaigns.

CubeYou's site says it has access to personally identifiable information (PII) such as first names, last names, emails, phone numbers, IP addresses, mobile IDs and browser fingerprints.

On a cached version of its website from March 19, it also said it keeps age, gender, location, work and education, and family and relationship information. It also has likes, follows, shares, posts, likes to posts, comments to posts, check-ins and mentions of brands/celebrities in a post. Interactions with companies are tracked back to 2012 and are updated weekly, the site said.

"This PII information of our panelists is used to verify eligibility (we do not knowingly accept panelists under the age of 18 in our panel), then match and/or fuse other online and offline data sources to enhance their profiles," CubeYou wrote.

The company's website currently claims it has more than 10 million opted-in panelists, but the cached March 19 version said it had "an unbiased panel of more than 45 million people globally." (Click the images in this story to make them bigger.)

CubeYou collected a lot of this data through online apps that are meant to be entertaining or fun.

An ad agency exec who met with the company confirmed CubeYou said it mostly collects information through quizzes.

According to its website, one of CubeYou's "most viral apps" is a Facebook quiz created in conjunction with the University of Cambridge called "You Are What You Like." It is meant "to predict a user's personality based on the pages s/he liked on Facebook."

A substantially similar app, "Apply Magic Sauce," existed on the platform as recently as Sunday morning, and YouAreWhatYouLike.com redirected to ApplyMagicSauce.com. CubeYou denies the apps are connected, or that it had anything to do with Apply Magic Sauce. Another version still called "You Are What You Like" was also available as of Sunday morning, Facebook told CNBC.

When a user clicks on the "App Terms" link for the Apply Magic Sauce app, it links to a page saying that the information collected through the quiz is intended for "non-exclusive access for research purposes only" and only for "non-profit academic research that has no connection whatsoever to any commercial or profit-making purpose or entity."

After CNBC contacted Facebook for this story, Facebook said there were two previous versions of the app named "You Are What You Like," one created in 2013, which was deleted by the developer, and one submitted later in 2013.

Facebook told CNBC that both of those prior versions were approved only for academic use. Facebook takes no stance on whether CubeYou showed the proper disclaimers to users on its site.

In addition, those prior versions were able to get access to information from friends of the people who took the quiz — as also happened in the Cambridge Analytica case. Until 2015, Facebook allowed developers to access information on Facebook friends as long as the original app user opted in, a loophole that expanded the database of personal information considerably.

If the original user still remained opted in, CubeYou could theoretically still access their data to this day.

When reached for comment, CubeYou CEO Federico Treu said the app had the right disclaimers on a separate site. He said the company was involved with developing the app and website, but only worked with Cambridge University from December 2013 to May 2015.

Treu said CubeYou only collected data from that time and has not had access since June 2015 to data from new people who have taken the quiz.

He also pointed out that the YouAreWhatYouLike.com website has different — and looser — terms of usage than the Facebook terms that CNBC discovered.

The website says, "the information you submit to You Are What You Like may be stored and used for academic and business purposes, and also disclosed to third parties, including for example (but not limited to) research institutions. Any disclosure will be strictly in an anonymous format, such that the information can never be used to identify you or any other individual user." (Italics added by CNBC.)

He also denied CubeYou has access to friends' data if a user opted in, and said it only connects friends who have opted into the app individually.

Cambridge University said CubeYou's involvement was limited to developing a website.

"We were not aware of Cubeyou's claims on their blog," the University of Cambridge Psychometrics Center said in a statement.

"Having had a look now, several of these appear to be misleading and we will contact them to request that they clarify them. For example, we have not collaborated with them to build a psychological prediction model — we keep our prediction model secret and it was already built before we started working with them," the institution said.

"Our relationship was not commercial in nature and no fees or client projects were exchanged. They just designed the interface for a website that used our models to give users insight on their [the users'] data. Unfortunately collaborators with the University of Cambridge sometimes exaggerate their connection to Cambridge in order to gain prestige from its academics' work," it added.

CubeYou certainly claimed it was able to use this data to target Facebook users, and advertisers seem to have bought the pitch.

CubeYou's website says its customers include global communications firm Edelman, and sports and entertainment agency Octagon. It also works with advertising agencies including 72 and Sunny (which counts Google, Adidas and Coors Light as clients), the Martin Agency (Discover, Geico, Experian), and Legacy Marketing (L'Oreal, Hilton, TGI Fridays), among others.

The site does not say which CubeYou data was used on which projects, but all agencies' testimonials talk about how CubeYou's data has allowed more understanding of potential customers.

"CubeYou is a great place for us to get smart about the consumer," one customer testimonial from Legacy Marketing says. "We primarily use Mintel for our research, but there's very little consumer segmentation and I think that the greatest benefit of a tool like CubeYou is you can get highly nuanced data about demographics, psychographics and interests so easily."