Facebook Harvested Email Contacts of 1.5 Million Users Without Their Consent

Facebook harvested the email contacts of 1.5 million users without their knowledge or consent and used the data to build a web of their social connections, it emerged today. Business Insider reports that Facebook began collecting the contact lists in May 2016 when new users opened a new account on the social network.

Image via Business Insider

The harvesting occurred when users were offered email password verification as an option to verify their identity when signing up to Facebook, a method widely condemned by security experts. In some cases if users did enter their password, a pop-up message would appear informing them that it was "importing" their contacts, without even asking their permission to do so.

These contacts were then fed into Facebook's database systems and used to build a map of users' social links and inform recommended friends on the social network. It's not clear if the data was also used for ad-targeting purposes.

In a statement given to Business Insider, the company said that these email contacts had been "unintentionally uploaded" to Facebook when users created their account.

It also said that prior to May 2016, it offered an option to verify a user's account and voluntarily upload their contacts at the same time. However, the feature was changed and the text informing users that their contacts would be uploaded was deleted, but the underlying functionality was not. Facebook says at no point did it access the content of users' emails.
We estimate that up to 1.5 million people's email contacts may have been uploaded. These contacts were not shared with anyone and we're deleting them. We've fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage the contacts they share with Facebook in their settings.
The news is just the latest addition to a long list of privacy blunders and violations by Facebook. In March, for example, it emerged that between 200 and 600 million Facebook users may have had their account passwords stored in plain text in a database accessible to 20,000 Facebook employees. Some Instagram passwords were also included.

That was followed earlier this month by news that cybersecurity researchers had discovered millions of Facebook records publicly accessible on Amazon's cloud servers, after the data was uploaded by third-party companies that work with Facebook.

In yet another development just this week, over 4,000 pages of documents from 2011 to 2015 were leaked which provide insight into how Facebook took advantage of user data while publicly promising to protect user privacy before and after its 2015 move to end broad access to user data.



Top Rated Comments

(View all)
Avatar
17 weeks ago
Facebook saying they will ‘delete the harvested email addresses’ is like me saying I’ll put away this pack of biscuits after this last one.
Rating: 27 Votes
Avatar
17 weeks ago
DELETE Facebook already. What on earth keeps this thing alive?! Every other "social" media would be dead by now.
Rating: 26 Votes
Avatar
17 weeks ago
Why hasn't Tim removed the FB app from the store?
Rating: 15 Votes
Avatar
17 weeks ago
This sort of thing keeps happening because there are no real consequences. A million-dollar fine per e-mail address would change things very, very quickly IMO.
Rating: 13 Votes
Avatar
17 weeks ago
Not surprised... they are not trustworthy.

But as long as people stay with them nothing will change.
Rating: 8 Votes
Avatar
17 weeks ago
Facebook definitely has its share of ongoing problems, it’s unfortunate what it’s become over the years, especially when it doesn’t value the users privacy in mind, even when they claim too. And in today’s digital era of the Internet, privacy is crucial, and Facebook has failed on many levels. (Proud to say I’ve never had a Facebook account and now I’m glad I never did.)
Rating: 6 Votes
Avatar
17 weeks ago

This sort of thing keeps happening because there are no real consequences. A million-dollar fine per e-mail address would change things very, very quickly IMO.

Not only there are no real consequences, there is literally zero effect on Facebook’s brand. The people simply don’t mind. Plus majority of Silicon Valley are part of the circle jerk with Facebook, relying on them as a platform.
Rating: 5 Votes
Avatar
17 weeks ago
It won't change as long as government doesn't make laws or investigate these bastards.

This sort of thing keeps happening because there are no real consequences. A million-dollar fine per e-mail address would change things very, very quickly IMO.


Set the fine as high as their annual profit.
Rating: 5 Votes
Avatar
17 weeks ago
The privacy concerns keep piling on
Rating: 3 Votes
Avatar
17 weeks ago

FB belongs to the top five richest company in the world, and their product is 100% free. Who on earth actually thinks they’re not profiting from data of the users?
If you’re fine with that (which most are), then do nothing. If you’re not, then go somewhere else. Why all the hate though?


Because Facebook isn't just harvesting the information from its users. They also harvest the information of the contacts of the users. Those people have not given Facebook permission to use their information.
Rating: 2 Votes
[ Read All Comments ]