Facebook has acknowledged that private messages featured in the data involved in the Cambridge Analytic crisis.
The social networking firm has admitted that only a tiny percentage of the 305,000 people who installed a personal data-harvesting app had agreed to have their personal details accessed.
However, the umbrella figure is slightly misleading, because the haul would also have featured people in conversation with others.
A spokeswoman for Facebook has also confirmed that the company made a significant amendment in 2015.
She explained: "Prior to 2015, Facebook's platform policy allowed developers to request permission to access inbox content but only if the person explicitly gave consent for this to happen.
"According to our records, only a very small number of people - approximately 1,500 - explicitly opted into sharing this information with Kogan's app. The feature was turned off in 2015."
Meanwhile, prior to Facebook founder Mark Zuckerberg's appearance before the US Senate Commerce and Judiciary committees in Washington, the company announced it would start paying bounties to people who flagged up misuses of of members' data.
In a statement, the firm said: "This programme will reward people with first-hand knowledge and proof of cases where a Facebook platform app collects and transfers people's data to another party to be sold, stolen or used for scams or political influence."