Do you want to become Facebook friends with the other patients at your therapist’s office? If you don’t, it’s a good idea to avoid giving Facebook your telephone number.
That’s the takeaway from a disturbing news report that looks at how Facebook (FB) finds those “People You May Know” who mysteriously appear in your Facebook feed.
The report, published on news site Fusion, describes how a psychotherapist in a small town began to see her patients pop up as suggestions when she went on Facebook. Worse, one of those patients, a 30-something snowboarder, asked her why a bunch of random 60-something people had shown up in his feed—he guessed (correctly) that they must be connected through the therapist’s office.
This raises obvious privacy implications. As the therapist noted, her patients included people with serious diseases or suicidal tendencies. Would they be comfortable with Facebook suggesting them as friends to the therapist’s other patients?
There’s also the question of how Facebook connected these people in the first place. The most obvious answer, noted by Fusion, is the social media giant used the telephone contacts of the therapist to guess the patients were connected.
Get Data Sheet, Fortune’s technology newsletter.
A Facebook spokesperson would not confirm or deny that the phone number was the source of the common connections, and provided this statement instead:
“Without additional information from the people involved, we’re not able to explain why one person was recommended as a friend to another. People You May Know is based on a variety of factors, including mutual friends, work and education information, networks you’re part of, contacts you’ve imported and many other factors.”
While the company makes a valid point that phone numbers are not the only piece of data used to suggest common friends, in the case of the therapist, it’s hard to point to any other explanation.
One way to avoid such situations, of course, is to avoid giving Facebook your phone number in the first place. I’ve noticed the company has been prodding me to do so on a fairly regular basis over the last year, but I’ve refrained from doing so. (Though I have given it to other sites that are no doubt mining my contact info in the same way Facebook does).
The story about the therapist also reinforces the significance of Facebook’s announcement last week that it will gobble the user data of WhatsApp, a messaging giant it acquired two years ago. The decision means Facebook will end up with more phone numbers (including mine) although it is possible to opt-out from some parts of the data sharing.