NEW YORK (BLOOMBERG) - New York's Attorney-General is opening an investigation into Facebook's unauthorised collection of 1.5 million users' e-mail contacts without their permission.

The e-mail harvest may have exposed hundreds of millions of people to targeted advertising by the embattled social-media company, New York Attorney-General Letitia James said on Thursday (April 25) in a statement.

The practice, which was uncovered by Business Insider last week, was a result of Facebook's e-mail password verification process for new users - a process that is standard for online services like Facebook, Ms James said. Facebook's procedure, however, asked some users to hand over the password to their personal e-mail account.

In some cases, Facebook accessed those user's contacts and uploaded the information "to be used for targeted advertising", she said.

"It is time Facebook is held accountable for how it handles consumers' personal information," Ms James said. "Facebook has repeatedly demonstrated a lack of respect for consumers' information while at the same time profiting from mining that data."

"We're in touch with the New York State Attorney-General's office and are responding to their questions on this matter," a spokesman for Facebook said.

The New York Times reported the investigation on Thursday.

In January, Ms James opened an investigation of Apple Inc under the state's consumer-protection laws for failing to alert users to a bug that allowed some users of its FaceTime video-chat service to listen in on people they contacted even before the person accepted or rejected the call.

Facebook has been working to address concerns by lawmakers and regulators about how it protects users' data.

On Wednesday, Facebook estimated it will cost as much as US$5 billion (S$6.8 billion) to resolve a Federal Trade Commission investigation triggered by Cambridge Analytica, a now-defunct British political consultancy which had ties to Mr Donald Trump's presidential campaign obtained the data of millions of Facebook users without their consent.

Separately, Facebook is in advanced talks with a group of states to resolve investigations into whether the Cambridge Analytica incident violated local consumer-protection laws, people familiar with the matter have said.