Facebook has admitted to “unintentionally” uploading the address books of 1.5 million users without their consent. It now says it will delete the collected data and notify people who have been affected.
This discovery follows the criticism of Facebook by security experts for a feature that asked new users for their email passwords as part of the sign up process.
The information grabbed is believed to have been used by Facebook to help map social and personal connections between users.
Facebook has admitted they were wrong and said the upload was inadvertent. In a statement the social media company said “Last month we stopped offering email password verification as an option for people verifying their account when signing up for Facebook for the first time,”.
A spokesperson added: “When we looked into the steps people were going through to verify their accounts we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account,”
We estimate that up to 1.5 million people’s email contacts may have been uploaded. These contacts were not shared with anyone and we’re deleting them. We’ve fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage the contacts they share with Facebook in their settings.”
The issue was first noticed in early April when a report of Facebook’s new feature of asking for email passwords. This meant that Facebook were able to automatically log in to a webmail account to effectively click the link on an email verification itself; this was meant to smooth the workflow for signing up for a new account. Security experts said the practice was “beyond sketchy”and said it gave Facebook access to a large amount of personal data.
The email contacts is the latest in the series in which Facebook has mishandled the data of some of its billion users.
