Facebook to stop using phone numbers to recommend 'friends'

Facebook is to stop using members' phone numbers in its friends recommendation system in 2020 following concern about privacy implications.

Users can choose to have a code sent to their mobile phones when logging in to make access harder for hackers.

But Facebook admitted it also fed the numbers into targeted advertising and friend recommendation systems.

The company says it will have completed the changes - part of a settlement with US regulators - during 2020.

Most of the social networks now offer two-factor authentication - also known as two-step authentication - to enhance account security.

It makes it harder for attackers to break into an online account because they need both the password and a one-off code sent to the account-holder's mobile phone.

But in 2018, it was revealed that Facebook was also using the phone numbers to target advertising - and to power its People You May Know feature, which recommends potential Facebook friends.

Privacy advocates and security researchers criticised the social network, saying the practice was deceptive and could erode trust in two-factor authentication.

People You May Know is designed to identify people you might want to add to your Facebook friends list.

It uses a variety of signals to work out whether you have met somebody, including:

However, Facebook and Messenger can also collect contact information from your smartphone's address book.

That means Facebook can identify people who have saved your number in their address book, and can encourage you to add them as a friend.

It used the phone numbers people provided for two-factor authentication to make these connections.

Facebook has promised to make privacy changes as part of a $5bn (£3.8bn) settlement with the US Federal Trade Commission (FTC).

It said it had stopped using members' security phone numbers for advertising in June 2019.

It will stop using the numbers for friend suggestions in Cambodia, Ecuador, Ethiopia, Libya and Pakistan in the next few days.

Facebook told the news agency Reuters that the change would take effect globally in 2020.

However, anybody who has already set up two-factor authentication will have to disable it and delete their phone number from the system, and then switch it back on.