The data sharing scandals surrounding Facebook Inc. throughout the year may have just gotten worse.

A new report finds that leading Android apps are sharing user data with the social media giant in breach of European Union law. That’s according to a new report released Saturday by Privacy International that found 61 percent of popular Android apps tested sent data to Facebook without user permission.

The list of apps found to be sharing data with Facebook includes Kayak, MyFitnessPal, Skyscanner, Spotify, TripAdvisor and Yelp.

“The information sent instantly included the name of the application, the unique identification of the user with Google and the number of times the application was opened and closed since it was downloaded,” the researchers said. “Some, such as Kayak, the travel site, then sent detailed information about people’s flight searches to Facebook, including travel dates, if the user had children and what flights and destinations they had searched for.”

The data sharing also raises concerns in relation to Facebook building so-called “shadow profiles” of nonusers, particularly given the richness of the data shared.

“For example, a person who has installed the following applications that we have tried, Qibla Connect (a Muslim prayer application), Period Tracker Clue (a period tracker), Indeed (a job search application), My Talking Tom (an application for children), could be outlined as probable woman, probably Muslim, probable job applicant, probable mother,” they said.

Facebook’s data gathering may not seem strange in a year of nonstop scandal, but where this story differs is where the liability lies under the EU General Data Protection Regulation. On one hand, the apps sending the data are breaching GDPR, but that may be the fault of Facebook as well.

The Privacy International report notes that the default implementation of the Facebook SDK is designed to transmit event data automatically to Facebook. Further, developers are said to have raised concerns that the Facebook SDK automatically shares data before apps can ask users to agree or consent, one key requirement to GDPR compliance.

It’s not in and of itself illegal under the GDPR for an app to share data to Facebook, but it is without user permission.

Photo: Pexels