Facebook has urged users to enable phone number-based 2FA, but the numbers are used in a user lookup feature with no opt out and to target ads, sparking outcry
Users are complaining that the phone number Facebook hassled them to use to secure their account with two-factor authentication …
Context & Ripple Effects
The 2FA push is the latest step in Facebook folding phone numbers into its identity graph: back in 2016 it let [[a:915113|Android apps skip SMS verification whenever a requested number matched the one on a user's profile]], making the number a cross-product join key long before it was pitched as a security control.
What changed here is purpose: numbers handed over for account protection are also feeding a no-opt-out user lookup feature and ad targeting. That same lookup surface is what made the platform's phone-number store so scrapeable — months later an unsecured database with 419M+ numbers linked to Facebook accounts surfaced, which Facebook attributed to data gathered before it disabled phone-number search.
First-order effects
- Users who enabled 2FA at Facebook's urging find their security contact doubling as an ad-targeting signal and a lookup key they cannot turn off, converting a trust-building security campaign into a consent controversy.
- Privacy critics gain a concrete case study: data surrendered for one stated purpose (account security) was repurposed for another (ads, lookup) with no opt-out.
Second-order effects
- Security-conscious users are pushed toward authenticator apps and hardware keys over SMS codes, weakening the phone number's status as Facebook's universal identifier.
- The no-opt-out lookup feature functions as a harvesting vector — the same surface implicated in the exposed database of 419M+ phone numbers — handing regulators a ready-made exhibit of secondary use run amok.
Third-order effects
- If the pattern holds, identifiers collected under security pretenses get treated as consent-bound data that cannot flow into ad systems, forcing platforms to wall off authentication credentials from their targeting graphs.
- Facebook's own product moves point the same direction: by late 2019 Messenger had removed phone-number signup entirely, requiring a Facebook account instead — a retreat from phone-as-identity after the lookup backlash.
The trend: Platforms are learning that identifiers collected for security cannot be silently recycled into advertising, making consent architecture the binding constraint on identity-based ad targeting.