Friend Spam

Friend Spam is a coercive and privacy-invasive dark pattern categorized under “Sneaking” and “Interface Interference.” It occurs when an application requests access to a user's contact list or social media graph under the explicit pretense of a benign utility—such as “finding friends already on the platform”—but then silently weaponizes those permissions to broadcast unsolicited promotional messages to the user's entire network. Critically, these outbound messages are often spoofed to appear as if they were personally drafted by the user, exploiting their social capital to bypass the recipients' trust thresholds. This pattern represents a dual violation of privacy: the non-consensual harvesting of the user's social graph and the deceptive appropriation of their identity for corporate marketing.

Feedforward Intent vs. Payload Execution

Find your friends

Find your friends on PopSocial

PopSocial is where you share photos with people you know. Allow contact access so we can find friends who are already on the platform.

Condition 1: Feedforward Intent vs. Payload Execution

Intent_{NLP} (N_{prompt}) \in D_{read_only} \land E_{backend_action} (T_{access}) ⟹ SendMessages ()

Given

To identify this deceptive shift in intent, we define

N_{prompt}

as the text node requesting OAuth access or native contact permissions. We map the NLP-derived intent,

Intent_{NLP} (N_{prompt})

, to an expected action domain. The feature triggers if the textual promise implies a localized, read-only matching operation (e.g., {“find”, “search”}), but the backend script immediately executes a write-oriented mass broadcast protocol (

E_{backend_action}

) upon receiving the access token

T_{access}

Absence of Granular Selection

Invite friends to PopSocial

We’ve selected your contacts for you — just confirm to get started.

Mia Chenmia.chen@example.comLucas Silvalucas.silva@example.comAva Johnsonava.johnson@example.comNoah Kimnoah.kim@example.comSofia Rossisofia.rossi@example.com

…and 19 more contacts (all selected)

Condition 2: Absence of Granular Selection

∣ S_{selected} ∣ = 0 \land ∣ M_{dispatched} ∣ \approx ∣ C_{network} ∣ ⟹ Unauthorized Broadcast

Given

The most common implementation of Friend Spam involves bypassing the curation process to maximize message reach. We define

C_{network}

as the full set of contacts extracted and

S_{selected}

as the subset explicitly chosen by the user via DOM checkboxes. Let

M_{dispatched}

be the set of promotional messages generated. The feature triggers if the interface skips the curation state entirely, automatically setting the dispatch target to the maximum theoretical limit of the extracted contact array without affirmative, granular user selection:

Sender Identity Spoofing

Invite your friends

We’ll send a welcome offer to the 3 contacts you selected. Sent as your personal invite.

Recipients: Mia Chen, Lucas Silva, Ava Johnson

Condition 3: Sender Identity Spoofing

SenderAlias (m_{outbound}) = I_{user} \land Author (m_{outbound}) = I_{corp}

Given

To quantify the deceptive appropriation of identity, we isolate

I_{user}

as the user's personal identity vectors (e.g., name or profile picture) and

I_{corp}

as the actual corporate entity. We analyze

m_{outbound}

as a single message dispatched to a contact. The feature triggers if the system deliberately injects the user's identity vectors into the sender alias of a corporate marketing message. This non-consensual usage transforms the user into a trusted "trojan horse" to increase the conversion rate of the marketing payload: