Although nobody should be surprised, Facebook has admitted that it uses the phone number provided by users for two-factor authentication (2FA) to target them with ads.

"We use the information people provide to offer a better, more personalized experience on Facebook, including ads," a Facebook spokesperson said in a statement to TechCrunch. "We are clear about how we use the information we collect, including the contact information that people upload or add to their own accounts. You can manage and delete the contact information you've uploaded at any time."

Facebook is giving users more 2FA alternatives beyond a code sent to your phone, including USB key support, followed by the ability to use third-party authenticator apps in May. The company also came under fire in February for spamming 2FA phone numbers with codes. Facebook said that it was a software bug that cause the issue.

Gizmodo earlier today outlined how Facebook is letting advertisers reach users with contact information collected in surprising ways, based on a paper published by university researchers.

One of the many ways that ads appear to you on Facebook and Instagram is that the social networking giant lets an advertiser upload a list of phone numbers or email addresses it has on file; it will then put an ad in front of accounts associated with that contact information.

Facebook calls this a "custom audience."

The researchers found that when a user gives Facebook a phone number for two-factor authentication or in order to receive alerts about new log-ins to a user's account, that phone number became targetable by an advertiser within a couple of weeks.

The lead author on the paper, Giridhari Venkatadri, said this was the most surprising finding, that Facebook was targeted ads using information "that was not directly provided by the user, or even revealed to the user."

In a recent blof post, Facebook's vice president of ads Rob Goldman discusses how advertising works on Facebook and what you can do if "I don't want my data used to show me ads."

"I think that many users don't fully understand how ad targeting works today: that advertisers can literally specify exactly which users should see their ads by uploading the users' email addresses, phone numbers, names+dates of birth, etc," said Mislove. "In describing this work to colleagues, many computer scientists were surprised by this, and were even more surprised to learn that not only Facebook, but also Google, Pinterest, and Twitter all offer related services. Thus, we think there is a significant need to educate users about how exactly targeted advertising on such platforms works today."

Facebook claims that users already have extensive control over what information is made available to advertisers, but obviously that's not true.