[gumby]

> Courtesy of every idiot who (illegally) uploaded their addressbook, with my contacts in it, to the service.

I know your address is PII, but seriously it's illegal to upload that info to FB? The post office does this with your snail mail info, and anybody could pick up a discarded envelope at the dump, or see a forwarded e-mail message with your address in it.

I am not saying that people should be blithely uploading their address books, but is it illegal?

And, come to think of it: does google track the address graph of gmail users? They could do this entirely with envelope information (SMTP MAIL FROM and RCPT TO), though message headers would be a richer trove.

[mistytoe]

> but seriously it's illegal to upload that info to FB?

In Germany, it is.

Relevant quote from the Whatsapp TOS (Whatsapp belongs to Facebook):

> Address Book. You provide us the phone numbers of WhatsApp users and your other contacts in your mobile phone address book on a regular basis. You confirm you are authorized to provide us such numbers to allow us to provide our Services.

Relevant german court order:

http://www.lareda.hessenrecht.hessen.de/lexsoft/default/hess...

It's a bit lengthy (and difficult!) to translate. In summary it's a child custody case about excessive smartphone use in which the court orders the mother, among others things (limiting smartphone usage) to get written consent from all contacts in the child's addressbook. The issue is that in Germany, your contact data is "copyright" be yourself. You don't have to put up with people freely resharing your contacts and theoretically, the child could have been "sued"(+) by anyone in the addressbook who isn't also a Whatsapp user.

(+) There is a "light version" of "sueing someone" in Germany, called "Abmahung", which is frivously used by some law firms.

[detaro]

In Germany it probably is, technically. It's of course unlikely to have consequences for the individual user (I'm only aware of a single court case regarding Whatsapp doing the same, and that wasn't even a privacy case at the core), it's more something people are going to go after the service for. You are sharing private data with a company that you haven't been authorized to share it with, and non-registered users have no agreement with the company of their own which would allow it.