The revelations come as the company is drawing up a new "privacy programme", which includes setting up a privacy committee that is independent from its board, as part of its record $5bn settlement with the US Federal Trade Commission over historic privacy violations.
Before 2018, developers were able to access reams of user data through Facebook's APIs, or integration "hooks" that third parties can use to plug into its system, in order to help them build apps.
However, after the Cambridge Analytica data leak, where a UK data company was accused of improperly accessing Facebook user information and using that in political campaigns, Facebook sought to restrict access to certain types of data, including phone numbers.
Friday's report raises the possibility that criminal groups were able to tap that personal information and continue to circulate it today, as Facebook struggles to keep a lid on the vast swaths of sensitive information it holds.
In November, the company said in a blog post that it had contacted 100 developers who had retained improper access to certain user data after it brought in the restrictions in 2018, and had cut their access to this data.
The exposure is the latest in a string of apparent data failings by the company this year. In March, it emerged that Facebook had improperly stored hundreds of millions of its users' passwords internally in a readable format.
Comparitech said the database could have been gathered by an "illegal scraping operation" prior to 2018, but suggested that Facebook may also "have a security hole that would allow criminals to access user IDs and phone numbers even after access was restricted".
Written by: Hannah Murphy
© Financial Times 2019
