Facebook will not drop a controversial feature that records users' call and text activity made outside the app.
Following revelations of possible shadow profiles, there are new concerns Facebook could use users' data to profile call recipients, regardless of whether or not they had a Facebook account.
A shadow profile is a file containing data pulled from information voluntarily provided by existing users, which can be used to profile others with the same interests or contact lists.
They could theoretically be used to profile someone before they had even signed up to join Facebook.
Facebook said it did not hold shadow profiles of non-users
"Some people also may upload their phone book when they're using Facebook, but we don't use that information to build profiles about people who aren't on Facebook," a spokeswoman said.
But Facebook did not address the question of whether cell data was held in a way that could be used to profile call recipients if they were to sign up.
The collection of call and text metadata was revealed by Wellingtonian software developer Dylan McKay, who tweeted the discovery after downloading his own data.
Facebook justified collecting recipients' names, as well as the time and duration of calls and texts made outside its app, by saying it was an opt-in feature intended to help users find and stay connected with friends and family.
Critics of the practice say it is invasive and unneeded for the service Facebook provides.
Despite a new global-spotlight being placed on privacy, a Facebook spokeswoman said the company intended to continue collecting the data, but would delete records more than a year old.
The feature was only on Android phones, in the Messenger and Facebook Lite apps.
"We've reviewed this feature to confirm that Facebook does not collect the content of messages," the spokeswoman said.
"We will never log people's call and SMS history without permission."
NetSafe chief executive Martin Cocker said if Facebook combined the phone logs of multiple users, they could be used to create profiles of the cellphone users receiving the calls.
Many users now sign up to Facebook using a mobile contact number, making a clear link between the collected cellphone data and new user account.
If the information Facebook gleaned from the new user was anonymised until it was used to create a profile on sign up, that might be okay, Cocker said,.
If it was used ahead of a sign-up to profile the person, that was more questionable.
"It was questions around these [shadow profiles] that even seemed to make Mark Zuckerberg uncomfortable, and that because it's technically clever, but falls with other challenges and concerns," Cocker said.
"Whether Facebook has any right to collect data about people who haven't signed up to Facebook is an interesting question, and I think a lot of people would say no, they don't."
Cocker said the deletion of data after a year was positive, but shorter periods always reduced the risk the data posed to the company.
"In the end, they are making a decision of what's in the best interest of the experience they're trying to create."
Users who wished to stop their phone and text data being recorded can visit Facebook's website to find out how.
A spokesman from the Office of the Privacy Commissioner said Facebook and Android were not breaching privacy law, as long as Facebook was clear about what data they were collecting and what it was used for.
"If users are uncomfortable with this data collection, they can choose to turn access off through the apps' settings, or stop using the apps," he said.
There was not have enough information on shadow profiling to comment on call and text records being used in the same way.
Privacy Foundation deputy chairman Gehan Gunasekara said the Android app feature's collection was no different to any gathered by any telecommunications provider in New Zealand, say Vodafone.
"It is encouraging that Facebook is providing a mechanism for individuals to access their metadata."
What are your thoughts?
Written by Ged Cann. First appeared on Stuff.co.nz.