Some popular smartphone apps are sending users' data to Facebook, even when app users don't have a Facebook account.
Apps on Android smartphones, including music streaming service Spotify and travel site TripAdvisor, were among apps found to be sending data by researchers at campaign group Privacy International.
The researchers found many of the apps tested were automatically sending data to Facebook as soon as the apps were opened.
For the majority of the apps tested, Facebook was notified when a person began using the app.
Also conveyed was information about the type of smartphone being used, and the user's suspected location based on time zone and language data.
In addition, they found that in some cases not involving Spotify or TripAdvisor, a person's unique Google advertising identifier was being included in the data sent.
That could allow Facebook to build up a detailed picture of the person in question, depending on the number of times it was sent the Google identifier by different apps.
For example, if the unique identifier was sent by a job-searching app and by a Muslim prayer app, the person might be identifiable as a Muslim job seeker.
The tested apps were for Android phones only, not iPhones.
Facebook said: "It's important for people to have access when we receive information about them when they're not using our services, and to have control over whether we associate this information with them."