After user has granted permissions to an app to fetch certain data from Facebook, while he does a 'Login with Facebook', is it OK for me to create an account for him on my app using his data fetched from facebook ?

  • 1
    isn't that the purpose of "Login with Facebook" ?
    – kmonsoor
    Nov 9, 2013 at 22:42
  • This could very well be a legal question in disguise. Certainly in Europe you can't store personal information without explicit permission. Facebook has that permission (else no Facebook account would exist), but that permission isn't transferable.
    – MSalters
    Nov 10, 2013 at 11:05
  • @MSalters: Is that still applicable to me if I dont host in Europe or I'm not a european company, but still engage european audience ? Nov 10, 2013 at 12:05
  • Yes it is for users of your site that come from Europe. Nov 10, 2013 at 15:26
  • I guess you can create your account but if you do that that account must be Facebook login only. If you want to have your account to be split from facebook it should be a user demands. Some site which want to keep users their own propose the fill the user form with facebook/g+/linkedin and then ask for login with third party as optional or the more classic user/pass
    – ColdCat
    Dec 11, 2013 at 15:33

4 Answers 4


To be on the up and up, you should notify the user of your intention and explain the benefit of auto creating an account for them.

One benefit would be that if the user decides to delete their Facebook account, they should still be able to login with the account that you create for them, as long as the user is provided with login details.

  • The point of logging in with Facebook (or any other OAuth provider) is specifically not to have to have another set of login details, and not divulging any of the Facebook login details to the site allowing logins through Facebook. So how am I gonna provide them with login details when they delete their Facebook account? At that point I can no longer verify that they own that account, so I should not give them any site specific login details for that account. If someone wants to delete their Facebook account, they will have to decouple it... Nov 10, 2013 at 15:33
  • ... from all sites where they used it before doing so. Decoupling meaning that on each site they login with their Facebook account and then set up a different means of authentication. Either by using a different OAuth provider, or site specific login details. Nov 10, 2013 at 15:35

If you are going to store any state for the user (I can't imagine a useful service that doesn't do this), then you have to create an account in your own database that is linked to the Facebook account. Look at how Stack Exchange works when you log in with Facebook; it stores information about all your activity and lets you create your own Stack Exchange profile.

  • But the thing is, I say "Login with facebook" (not "Sign up using Facebook"), & still create an account.. isn't this a concern. Do some others also do it this way ? Nov 11, 2013 at 3:46
  • 1
    No, this is not a concern. Every website that uses Login with Facebook works this way. Nov 11, 2013 at 15:15

The users intent when they 'Log in with Facebook' is to create a relationship with your site, associated with their Facebook account. That is the entire function of the action, and so I do not believe that you are breaking the trust of the user by storing persistent data related to their choices and preferences on your site. The relationship is meant to be persistent, otherwise it is not much of a relationship.

However, you should provide users with a 'Log Out' control, that clears their session cookie and allows them to return to anonymity should they choose. But if they log in with Facebook again, the user will expect you to remember the preferences they chose previously; this is impossible without storing persistent user data in your application (and that's really the definition of 'account'... a persistent user token tied to their preferences).


I hate it when I choose “log in with XXX” and then the site makes me pick yet another password.

Often I give up using the site at that point.

I expect a site to remember my email address and Facebook ID and maybe my name but nothing else. If the above is stored in an account it is not a problem for me, provided I never have to do anything to manage that account.

  • Where did the OP say anything about making you choose another password? Creating an account based on a Facebook login does not need another password as account access/login is always deferred to Facebook. Nov 10, 2013 at 15:28
  • @MarjanVenema, I have had a few websites in the last month, do this to me with uisng my Google acount, so I expect they do the same with Facebook
    – Ian
    Nov 10, 2013 at 22:46
  • 3
    @ian that is bizarre as it's defeating the entire point of using a openID login. Are you sure they weren't phishing sites?
    – DA01
    Nov 11, 2013 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.