Facebook says it unintentionally collected the email contacts of 1.5 million new users without their knowledge or permission over the past three years. 

Business Insider reports the contact lists of new users were uploaded to Facebook since May 2016. A company spokesperson reportedly says the data is in the process of being deleted.

It was reportedly discovered when a security researcher noticed Facebook was asking some users to enter their email passwords when they signed up for new accounts. Business Insider reports it discovered that this caused a message to pop up saying Facebook was importing contacts, but that it did not ask permission to do so first.

A Facebook spokesperson reportedly said this happened after a company changed a design feature.

Facebook Privacy Vision Mark Zuckerberg
FILE - In this April 11, 2018, file photo, Facebook CEO Mark Zuckerberg pauses while testifying before a House Energy and Commerce hearing on Capitol Hill in Washington about the use of Facebook data to target American voters in the 2016 election and data privacy. (AP Photo/Andrew Harnik, File)