[detaro]

I haven't seen the specific prompts - if anyone has good info on them I'd like to see it.

Facebook in their response to this says:

> Did partners get access to messages?

Yes. But people had to explicitly sign in to Facebook first to use a partner’s messaging feature. Take Spotify for example. After signing in to your Facebook account in Spotify’s desktop app, you could then send and receive messages without ever leaving the app. Our API provided partners with access to the person’s messages in order to power this type of feature.

What does explicitly sign in mean here? For a while, signing in with Facebook was the only way to create a Spotify account, and sign in with X is a common pattern in apps for authentication purposes only. Did it explicitly ask for permission? (what permissions?) Could you use your Facebook-bound Spotify account without granting this permission? I wish both sides in this would publish screenshots...