Last week, Facebook said it may have “unintentionally uploaded” email contacts of up to 1.5 million new users since May 2016, adding that the “contacts were not shared with anyone and we are deleting them,” Reuters reported.
James said on Thursday in a statement that when the individuals’ contacts were taken into account “the total number of people whose information was improperly obtained may be hundreds of millions.”
Facebook said in an emailed statement that it was “in touch with the New York State attorney general’s office and are responding to their questions on this matter.”
James called last week’s disclosure “the latest demonstration that Facebook does not take seriously its role in protecting our personal information.”
“It is time Facebook is held accountable for how it handles consumers’ personal information,” she added.
On Wednesday, Facebook said it had set aside $3 billion to cover a settlement with the US Federal Trade Commission (FTC) over privacy issues.
The FTC has been investigating revelations that Facebook inappropriately shared information belonging to 87 million of its users with the now-defunct British political consulting firm Cambridge Analytica. The probe has focused on whether the sharing of data and other disputes violated a 2011 agreement with the FTC to safeguard user privacy.
The settlement accrual, which Facebook set at $3 billion but said could rise as high as $5 billion, cut the company’s net income in the first quarter to $2.43 billion, or 85 cents per share.
Several Democrats in Congress on Wednesday said a $5 billion fine would amount to a “slap on the wrist” for Facebook.