Mark Zuckerberg, under stern questioning by U.S. lawmakers, said Facebook Inc. collects information on consumers who aren’t registered as users, acknowledging something that’s been reported but not publicly spelled out by the company.

“In general we collect data on people who are not signed up for Facebook for security purposes,” Zuckerberg said Wednesday in a hearing about the social network’s privacy practices in Washington before the House Energy and Commerce Committee.

His questioner, Representative Ben Lujan, a New Mexico Democrat, said the practice creates “shadow profiles.”

“You’ve said everyone controls their data, but you’re collecting data on people that are not even Facebook users who have never signed a consent, a privacy agreement,” Lujan said.

Zuckerberg said the practice was intended to help prevent malicious actors from collecting public information from Facebook users, such as names. “We need to know when somebody is trying to repeatedly access our services,” he said.

Lujan said non-members of Facebook wanting to know what data the company holds are directed by the service to sign up for a page, in order to see what information is being harbored. “We’ve got to fix that,” he said.

Facebook builds “shadow profiles” of people who aren’t users by accessing data from inboxes and smartphone contacts of those who are active users, Gizmodo and other publications have reported.

On Wednesday, Zuckerberg said he was not familiar with the “shadow profiles” term, even though several news reports have described Facebook’s practice that way in the past.

On Twitter, a former Facebook employee in the ads department, Antonio Garcia Martinez, said Zuckerberg’s description of the data’s use was incomplete. “It’s collected for growth reasons as well,” he said, to make sure people have the right friend suggestions when they sign into the service for the first time.