Facebook has confirmed that it receives phone numbers used for security purposes but doesn’t leave them at that. The company takes these phone numbers and uses personal details associated with it to target users with ads.

On Facebook, you can bolster the security of your account using a two factor authentication (2FA). This requires that you tie your account to your phone number. However, the social media giant has been taking this as consent to use your personal information.

Facebook’s confession follows a story after Gizmodo reported on research work carried out by academics at two U.S. universities. The study discovered that the company uses pieces of personal information that individuals did not explicitly provide.

Facebook told TechCrunch that it “repurposes digits handed to it from people wanting to secure their accounts to target them with marketing”. In other words, the notion of keeping your account secure goes hand in hand with targeted ads. Facebook does not make this idea explicitly clear for users that sign up for 2FA.

The Facebook spokesperson simply states that users can avoid this form of ad-based targeting via a non-mobile phone based 2FA, which the company only added back in May.

Considering Facebook’s practices here, it’s likely that its WhatsApp chat platform may also be subject to something like this. The app requires a real phone number for use, though the platform has not started sporting ads just yet.

Facebook has come under fire in recent months for its poor handling of users’ personal information. The Cambridge Analytica scandal saw millions of users’ information being taken from a personality quiz, of which was used to create psychological profiles of U.S. voters.