My latest project has (had) a requirement for the user to invite their friends to their online service. I discovered that, apparently, as of April 2015 with the new v2.0+ Facebook Graph API, you cannot actually get a list of friends for the user, unless those friends are already subscribed members of your app.
The scenario:
My app is a web service that lets the user collaborate on research work in a private group online. The user needs to
- look up their list of friends,
- set permissions their friend will have in the group, and
- send them an invitation both join the service, and the specific group. (using a unique, one-time use link tied to each recipient)
The user would (ideally) receive an invitation with a specific link for them to not just become a subscriber of said online app, but specifically to join the group they were invited to (i.e. not just a generic "hey, check out this app" type of invitation).
The expectation:
The user doesn't care whether their friend is already a member of "MyApp.com". They expect to simply look up their friends just like they do today from their phone when they connect it to Facebook (makes all contacts available, regardless of whether those friends connected their Facebook to their phone, respectively). Likewise, compare inviting members to your Google docs, for example: look up your contact, set permission, send invite - so easy. Users demand this UX simplicity today and do not distinguish or care whether they are dealing with email, Facebook, Twitter contacts, whatever.
The problem:
The entire point of a social network is to be, well, social. If the Graph API only lets my app access friends that are ALREADY users of my app, it completely defeats the entire purpose - it cuts my user off at the knees, kills UX, no more ability to actually contact their own friends. My understanding is Facebook made this change to prevent developers from spamming users, and I get that, I completely support that. HOWEVER, my company and my app are not the ones that are trying to invite friends for it's own purposes, it is the USER and THEIR OWN friends that THEY have the right to access and converse with for their purposes (or so you'd think). Beyond just friends list, even if I had that, I think there are additional hurdles and limitations with posting messages to friends, even private (not wall) messages, which again would be anti-social.
The Question:
Am I understanding Facebook limitations properly, and if so, what is the work-around? I'd be ok with such an API being locked down until you pass a review that proves you aren't spamming users, but I did not see such an option.
Facebook supposedly prioritizes users over developers, and these changes were made because if the user is not comfortable with privacy (don't spam my friends), then they wont be users any longer, and that obviously affects developers and Facebook. OK, but did they not realize that by locking it down this extreme just killed UX for the user in legitimate scenarios? And to my original point, not just a little, but paramount - the result quite literally is that on April 30, 2015, Facebook became anti-social. Surely this is not inline with their mission. Surely there is a better approach.