Facebook admits harvesting 1.5 million people’s email contacts without consent

Facebook has admitted to accessing and storing the email contacts of as many as 1.5 million of its users without their consent. Business Insider reports that between May 2016 and last month, the social media platform asked some of its new users to verify their email address by providing the password to their email account. After doing so, the users’ contacts would be automatically imported, without any option for the user to opt out.

Responding to the report, a Facebook spokesperson told Business Insider that email contacts were “unintentionally uploaded” as part of the process. They said that these contacts had never been shared with anyone, and that the company is now deleting the contacts that were uploaded. Facebook also claims to have fixed the “underlying issue” that led to the problem.

Email verification is a standard practice for online services, but Facebook handled it in a very different way. Usually, when you sign up to a new service you’re asked to provide an email address, which then receives an email with a link in it that you have to manually click in order to verify that the email account belongs to you.

Instead, what Facebook did was to have users verify that they owned an email account by handing over their password to Facebook. “To continue using Facebook, you’ll need to confirm your email address” read the page asking for a user’s email password.

Users didn’t technically have to go through this process, but The Daily Beast notes that the service’s more traditional verification options were hidden behind a nondescript “Need help?” link located below the email password box. Users could also verify their account with a code sent to their phone.

Prior to May 2016, Facebook would still upload a user’s contacts if they provided their email account password. However, that month, Facebook deleted the message that informed users that this upload was going to take place, but didn’t stop the upload from happening.

In small print displayed beneath the password box, Facebook claimed that it wouldn’t store the password entered as part of this process. However, the social network, which hasn’t had a chief security officer since August of last year, has previously had problems keeping to its security obligations. Just last month, it emerged that the platform had stored hundreds of millions of passwords in plain text, and in the past it’s also used phone numbers provided for security verification purposes to target users with ads.

Facebook said it’s notifying anyone whose contacts were uploaded to the service over the coming days.