Apple says Facebook can no longer distribute an app that paid users, including teenagers, to extensively track their phone and web use.
The tech blog TechCrunch reports that Facebook paid about $20 a month. While Facebook says this was done with permission, the company has a history of defining "permission" loosely and obscuring what data it collects.
Facebook says fewer than 5 percent of the app's users were teens and they had parental permission. Nonetheless, the revelation is yet another blemish on Facebook's track record on privacy and could invite further regulatory scrutiny.
According to TechCrunch, Facebook sidestepped Apple's app store and its tighter rules on privacy. Apple says Facebook was using a distribution mechanism meant for company employees, not outsiders, so Apple has revoked that capability.
Apple offers what are known as certificates that let businesses have deep controls over iPhones, with the potential to remotely install apps, monitor app usage and access, and delete data owned by a business on an iPhone. Apple designed the program for organisations whose staff use iPhones for official duties, when privacy needs are different from phones for personal use.
On Tuesday, technology news site TechCrunch reported that Facebook was paying users as young as 13 years old to install an app called Facebook Research. The app used Apple's business tools to ask for an iPhone user's permission to install so-called virtual private network software that can track browsing habits.
Apple ejected Facebook from the business app program, saying in a statement on Wednesday the program was "solely for the internal distribution of apps within an organisation."
"Facebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple," Apple said in the statement.
The ban does not affect Facebook's apps in Apple's App Store, which Facebook depends on to distribute Facebook, WhatsApp and Instagram apps to iPhone users. But it does mean that Facebook will not be able to distribute internal apps to its own employees.
In a statement, Facebook said key aspects of the research program were being ignored and that it had secured users' permission.
"Despite early reports, there was nothing 'secret' about this," Facebook said in a statement. "It was literally called the Facebook Research App. It wasn't 'spying' as all of the people who signed up to participate went through a clear on-boarding process asking for their permission and were paid to participate."
Facebook said fewer than 5 per cent of the participants in the program were teens and that all of those teens had signed parental consent forms.