When the Cambridge Analytica scandal erupted earlier this year, many hopes that we had seen the worst extent to which Facebook had harvested and profited from our data. A new report, however, reveals that the rabbit hole goes deeper than we thought!

What your phone maker knows about you

Facebook isn’t just collecting your data to serve up ads or to sell it to Cambridge Analytica to organize polarizing data-fueled political campaigns. It also sells your data to phone makers – and there’s nothing you can do about it.

The New York Times recently revealed that Facebook has been sharing user data with at least 60 different device producers, including popular giants like Apple, Blackberry, Samsung, Amazon and Microsoft. The report claims that Facebook has been sharing these details for more than a decade and that they have been doing so not only without user consent, but even despite user refusal to share their data.

Because Facebook considers those device makers its “partners” and not third parties, it allows itself to share your data with them regardless of what your privacy settings are.

Facebook also shares your friends’ data with those device makers.

Facebook shares this data despite its agreement with the Federal Trade Commission. In 2011, the FTC charged Facebook with 8 complaints. In response, Facebook pledged to no longer override its users’ privacy settings and to only share data with third parties when it had its users’ consent.

In the aftermath of the Cambridge Analytica scandal, Facebook claimed that it had cut off third-party access to friends’ data in 2014. However, Facebook does not internally consider device makers to be third parties, so it did not disclose the fact that it was sharing the same exact data with those companies. In at least one case, it also shared friends of friends’ data. During Facebook CEO Mark Zuckerberg’s congressional hearings in March, he had testified that “Every piece of content that you share on Facebook you own. You have complete control over who sees it and how you share it.”

A New York Times reporter tested a Blackberry phone to see what sort of data he was able to retrieve. The phone gathered detailed personal data on 556 of the reporter’s friends and information on a total of 294,258 friends of the reporter’s friends.

Where your data goes

Privacy advocates often point out that once your data has been collected, it can be used in all sorts of different ways beyond the original intent. Many people tolerate the harvesting of their data by Facebook, Google and other data companies because they assume it’s only used to serve up ads or to improve their services. As the violations of the public’s trust pile up, however, it is becoming clear that this is not the case.

It is not yet clear how device makers are collecting data from Facebook. If it relies on the use of Facebook’s apps on your phone, the solution is an easy and relatively painless one – delete Facebook’s apps from your phone. Using Facebook as a strictly in-browser service is perfectly viable, especially if you don’t rely on its instant messenger service.

If Facebook sends device makers your data regardless of how you use their services and despite your privacy settings, the only way to stop the flow of data may be to stop using Facebook.