Facebook exposed private friend lists to app developers without their knowledge until two weeks ago, despite claiming to have blocked the service three years ago.

The loophole allowed apps to collect the friend lists of anybody who had installed the app, exposing their names and profile photos. Facebook quietly switched the “taggable friends” interface off on April 4, burying the announcement among a series of other privacy measures.