Already under fire for apparently tricking kids into spending their parents’ money to play games on the social networking platform, Facebook now finds itself confronting a new privacy wrinkle that’s emerged and reportedly involves the company paying teenagers and young adults for permission to track everything they do on their phones.

The report comes via TechCrunch, which notes that Facebook has been quietly paying users between the ages of 13 and 35 up to $20 a month — and a little more, in some cases — for permission to install a “Facebook Research” VPN on their phones. If this sounds suspiciously like Facebook’s Onavo Protect app the social network got in trouble for, with Apple actually banning it entirely, you’re not wrong.

The other troubling thing here is the teens and adults involved in this study may not have been completely aware of what they were giving up, by way of giving Facebook extremely broad access to their data. 

Per TC, Facebook has been quietly doing this since 2016. In addition to asking users to install the so-called “Facebook Research” app, the social network also apparently asked users to take screenshots of their Amazon order histories. This “is referred to in some documentation as ‘Project Atlas’ — a fitting name for Facebook’s effort to map new trends and rivals around the globe.”

Guardian Mobile Firewall security expert Will Stafach told TechCrunch that Facebook could, if it wanted to, use the access it’s given via this process to collect private messages in social media apps, plus chats, web searches, emails, web browsing activity and detailed location data.

All of this comes as Facebook is already facing scrutiny over a report from the Center for Investigative Reporting that the company has “had a policy of willful blindness toward credit card charges by children — internally referred to as ‘friendly fraud’ — in order to boost revenue at the expense of parents.” That’s from a new letter written to Facebook CEO Mark Zuckerberg by US Sens. Edward Markey, D-Mass., and Richard Blumenthal, D-Conn. “Notably,” their letter continues, “Facebook appears to have rejected a plan that would have effectively mitigated this risk and instead doubled down on maximizing revenue.”

It seems that many kids racked up thousands of dollars in charges while playing games like Angry Birds, according to the letter, which goes on to basically ask Zuckerberg to explain himself and gives him a deadline of February 19 to do so.