Just as Facebook has been trying to overcome a user data scandal involving the U.K. political consulting firm Cambridge Analytica, the world’s largest social media company is again under fire for practices related to overreaching data collection.
Facebook acknowledged Sunday that for years it has been collecting the call and text history of users who own Android phones. It says it has been doing so with users permission, but it’s not that simple.
People who explicitly “opted in” to allowing Facebook to harvest their cell phone data did so by agreeing to let the company import their phone contacts so they could use Messenger or Facebook Lite on Android phones — but it was not obvious to many users that they were agreeing to have their cell phone records logged when they agreed to import their contacts to use those apps on their Android phones.
The company defended itself by explaining that “people have to expressly agree to use” the opt-in feature for importing their contacts on Messenger or Facebook Lite to allow Facebook to collect the cell phone data, but Sunday’s statement is the first time the social media company actually spelled out that practice in clear terms for users.
“When you sign up for Messenger or Facebook Lite on Android, or log into Messenger on an Android device, you are given the option to continuously upload your contacts as well as your call and text history,” the statement reads. “For Messenger, you can either turn it on, choose ‘learn more’ or ‘not now’. On Facebook Lite, the options are to turn it on or ‘skip’. If you chose to turn this feature on, we will begin to continuously log this information, which can be downloaded at any time using the Download Your Information tool.”
This circumspect cell phone data harvesting came to light via Twitter as users began posting their personal records downloaded from Facebook, offering incontrovertible evidence the company had indeed been collecting the data.
The social media juggernaut does say that people who no longer want to use this opt-in feature can disable it in settings, and it claims that doing so triggers all of the call and text histories that were previously logged to be deleted.
“If, at any point, you no longer wish to continuously upload this information, you can easily turn this feature off in your settings,” the statement says. “You can also turn off continuous call and text history logging while keeping contact uploading enabled.”
Facebook also said in its statement that users’ information “is securely stored and we do not sell this information to third parties,” but last week’s scandal involving U.K. political data firm Cambridge Analytica highlighted that the company has in fact been vulnerable to manipulation by the outside companies it voluntarily shares information with.
The company’s stock has dropped more than 14% in a little over a week since the news broke that Cambridge Analytica was improperly harvesting data via a third-party company that Facebook willingly gave user data to. Facebook’s CEO Mark Zuckerberg apologized in a statement on the social platform, as well as in a full-page newspaper ad, but the fallout appears to be continuing as the #DeleteFacebook hashtag continues to trend on social media, and high-profile users like Elon Musk delete their company pages.
More Must-Reads from TIME
- Where Trump 2.0 Will Differ From 1.0
- How Elon Musk Became a Kingmaker
- The Power—And Limits—of Peer Support
- The 100 Must-Read Books of 2024
- Column: If Optimism Feels Ridiculous Now, Try Hope
- The Future of Climate Action Is Trade Policy
- FX’s Say Nothing Is the Must-Watch Political Thriller of 2024
- Merle Bombardieri Is Helping People Make the Baby Decision
Contact us at letters@time.com