Social networking giant Facebook said on Wednesday evening it may have “unintentionally uploaded” the email contacts of up to 1.5 million users on its site, without their permission or knowledge, when they signed up for new accounts since May 2016.

Those contacts were not imparted to anybody and Facebook is erasing them, an company spokesperson told.

“We’ve fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage contacts they share with Facebook in their settings,” the spokesperson said.

Business Insider first reported the news and said a security researcher noticed the tech giant was prompting some users to type in their email passwords when they opened an account to verify their identity.

Facebook said it used to have a step in the account verification process where some users had the option to confirm their email address and voluntarily import their email contacts onto the site. The feature was meant to help them find their friends more effectively and improve ads, according to the company.

That procedure was overhauled in May 2016. While the language, which clarified the progression, was evacuated, the feature itself was not, Facebook said. Hence, email contacts were still being uploaded to the site without users being aware of that fact.

The revealed episode is the most recent in an long list of privacy concerns and controversies saddling the tech giant, which is facing increased government scrutiny.

Facebook faced strong public criticism after it was uncovered that a U.K.- based political counseling firm, Cambridge Analytica, exploited the company’s business of action to impact the U.S. president election in 2016. From that point forward, Facebook has confronted developing investigation from users and even employees as more privacy scandals were unveiled throughout 2018.

As far as it matters for him, CEO Mark Zuckerberg has called for stricter internet regulation and for governments to play a progressively dynamic job.

Read the full statement from a Facebook spokesperson below:

Last month we stopped offering email password verification as an option for people verifying their account when signing up for Facebook for the first time. When we looked into the steps people were going through to verify their accounts we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account. We estimate that up to 1.5 million people’s email contacts may have been uploaded. These contacts were not shared with anyone and we’re deleting them. We’ve fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage the contacts they share with Facebook in their settings