The large-scale data harvesting happened through the social networks new members verification system, which asked new users to provide the password for their email account.

According to Business Insider, the publication which broke the story, security researchers found that once a user had entered their email password, a message would inform them that it was “importing” contacts – without asking permission.

This marks the latest in a long line of data privacy incidents for the social media giant. Last month, it was revealed that the passwords of around 600 million users were stored in plain text for several months.

The information gathered by Facebook is believed to have been used by the firm to help build connection ‘maps’ between its users and recommend friends. It is still unclear if email contact data was used to target ads.

According to the social media giant, the issue first arose three years ago following changes to its step-by-step verification process. Prior to changes made in May 2016, users were given the option to upload their email contacts list when registering an account.

Following changes, however, Facebook removed clear language explaining to users that their contacts list would be uploaded to company servers. In many cases, this led to people’s contacts lists being uploaded without their knowledge or consent.

Facebook said it has since changed this policy and a spokesperson confirmed that the company plans to notify the 1.5 million users affected – as well as delete their contacts from its systems.

“Last month we stopped offering email password verification as an option for people verifying their account when signing up for Facebook for the first time,” a spokesperson said. “When we looked into the steps people were going through to verify their accounts, we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account.”

“These contacts were not shared with anyone and we’re deleting them. We’ve fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage the contacts they’ve shared with Facebook in their settings,” the spokesperson added.