Facebook has drawn renewed scrutiny over its handling of user data, with reports revealing that phone numbers initially provided for two-factor authentication (2FA) are now used to locate profiles. Since 2011, the platform required phone numbers for 2FA—a security measure to verify login attempts—but users now face privacy settings that allow others to find their profiles via these numbers, with no opt-out option.
Privacy advocate Jeremy Burge highlighted the shift, noting Facebook initially framed phone number registration as solely for security. In 2018, the company added "and more" to the 2FA prompt, signaling expanded data use. Users now encounter privacy settings determining who can find them via their number, with the default set to "everyone." The feature also extends to Instagram, as users are encouraged to sync contact details across platforms.
Burge criticized the practice, calling it a misuse of personal data. "One unique ID that links your identity across every platform," he wrote. Security experts echoed concerns, warning that phone numbers can be hijacked to undermine security. Stanford professor Alex Stamos argued that tech companies must prioritize security in product design, stating, "FB can’t credibly require 2FA for high-risk accounts without segmenting that from search & ads."
Facebook responded by stating users can now enable 2FA without a phone number and claimed the ability to search profiles via phone numbers was removed in April 2018. A spokesperson emphasized that privacy settings now control how contact information is used, though critics remain skeptical.
