Safe Contact Import

Subtitle: Engineering Patterns for Privacy-First Contact Handling and Matching

Contact import powers “Find Your Friends” features—but it also creates massive privacy risks if not built correctly.

Contact import is where most social graph privacy failures begin. The technical implementation of your contact import system directly impacts your compliance posture and user trust.

This article explains how to engineer your contact import system to minimize risk, ensure compliance, and preserve trust, with specific technical guidance for developers and architects.

Core Foundation

This article continues from:
Sending Invitations After Matching

Supporting articles:

• The Consent Playbook
• Don’t Touch That Data

Safe Import Architecture Principles

The foundation of privacy-compliant contact import systems rests on several key architectural principles:

Principle	Application	Implementation Guidance
Minimize access scope	OAuth least-privileged scopes	Request only the specific data fields needed; avoid broad permissions
Manual user selection	No auto-import or auto-selection	Implement explicit selection UI; default to zero selected contacts
In-memory processing	Match without storing unnecessary data	Process contacts client-side when possible; minimize server-side storage
Transparent consent flows	Clear user prompts, previews, choices	Implement multi-step consent processes; document user choices
Retention limits	Auto-delete unused imported data fast	Set aggressive deletion timers; implement automatic purging
Opt-out support	For users and non-users	Create global suppression systems; honor opt-outs across all users

These principles should guide every aspect of your contact import system design, from API integration to database schema to user interface.

Step-by-Step Best Practices

1. Use OAuth with Least-Privilege Scopes

The first step in safe contact import is limiting what data you can access in the first place.

Implementation Guidance:

• Minimal OAuth Scopes

  • Authorize only read-only access to basic contact fields like email addresses
  • Avoid requesting unnecessary metadata like notes, birthdays, physical addresses
  • Use the most restrictive scope that still enables your feature
  • Document why each requested scope is necessary

• Common OAuth Scope Examples:

  • Google: contacts.readonly (not the broader contacts scope)
  • Microsoft: Contacts.Read (not Contacts.ReadWrite)
  • Apple: contacts with purpose string limiting to email addresses
  • Facebook: user_friends (not additional profile data scopes)

• Technical Implementation:

  • Implement proper OAuth flow with PKCE for added security
  • Store access tokens securely with appropriate encryption
  • Refresh tokens only when necessary
  • Implement token revocation when feature is disabled

Security Considerations:

• Implement proper CSRF protection in your OAuth flow
• Use secure, random state parameters
• Store tokens in secure, HTTP-only cookies or equivalent
• Implement proper error handling for OAuth failures

2. Only Import Selected Contacts

Giving users explicit control over which contacts are imported creates both better privacy and better user experience.

Implementation Guidance:

• Selection Interface

  • Default to zero contacts selected
  • Let users manually pick individual contacts
  • No pre-checked “select all” options
  • Provide clear visual feedback about selection state

• Technical Implementation:

  • Implement client-side filtering before transmission
  • Send only selected contacts to your server
  • Include selection timestamp and user action in logs
  • Implement pagination for large contact lists

• User Experience Considerations:

  • Provide search functionality for large contact lists
  • Show selection count prominently
  • Allow batch selection of logical groups (e.g., by domain)
  • Provide clear “Cancel” options at every step

Privacy Benefits:

• Creates clear record of user intent
• Reduces unnecessary data processing
• Improves quality of matches and invitations
• Supports the principle of data minimization

3. Process Contacts In-Memory Whenever Possible

Minimizing persistent storage of contact data significantly reduces privacy risks.

Implementation Guidance:

• Client-Side Processing

  • Fetch contacts client-side when possible
  • Match them against your user database in memory
  • Only persist matches that users explicitly choose to invite or connect with
  • Implement secure, ephemeral storage for temporary processing

• Server-Side Alternatives

  • If server-side processing is necessary, use temporary storage
  • Implement automatic deletion after processing
  • Hash identifiers when possible
  • Document why server-side processing is required

• Technical Implementation:

  • Use secure, memory-only data structures
  • Implement proper garbage collection
  • Avoid writing to disk during processing
  • Use secure comparison methods for matching

Architecture Patterns:

• Consider serverless functions with ephemeral execution environments
• Implement memory-only databases for temporary processing
• Use secure enclaves or similar isolation when available
• Design for stateless processing where possible

4. Confirm Consent Before Matching or Messaging

Explicit consent creates both legal protection and user trust.

Implementation Guidance:

• Consent Mechanism

  • Insert a clear checkbox with specific language:

    □ I confirm I have permission to match or invite these contacts.

  • Make the checkbox unchecked by default
  • Prevent continuation without explicit consent
  • Consider additional consent for specific actions (matching vs. messaging)

• Consent Documentation

  • Log consent actions with timestamps
  • Store the exact text shown to the user
  • Include user IP address and session information
  • Implement tamper-evident logging

• Technical Implementation:

  • Store consent records in a secure, append-only database
  • Implement proper access controls for consent records
  • Create audit trails for consent verification
  • Design for compliance with various consent requirements

Legal Alignment:

• This approach satisfies GDPR requirements for freely given, specific consent
• Creates evidence of user intent for compliance documentation
• Supports the accountability principle
• Helps establish lawful basis for processing

5. Limit Data Retention Aggressively

Implementing strict retention limits is essential for compliance with data minimization principles.

Implementation Guidance:

Data Type	Retention Rule	Technical Implementation
Unselected contacts	Delete immediately after session ends	Client-side only; no server transmission
Selected but unmatched contacts	Delete within 24 hours	Temporary database with TTL; scheduled purge jobs
Invited contacts	Retain for suppression only (hashed)	Hash before storage; document retention purpose
Matched contacts	Retain only relationship data, not full contact	Store only minimal identifiers needed for the relationship

• Never store full imported contact lists unless absolutely necessary

• If full lists must be stored, document the specific purpose and legal basis

• Technical Implementation:

  • Use database TTL features when available
  • Implement scheduled purge jobs with logging
  • Use secure deletion methods
  • Implement retention policy enforcement at the data access layer

• Documentation Requirements:

  • Create a formal retention policy for contact data
  • Document exceptions and their justification
  • Maintain deletion logs
  • Review and update retention practices regularly

Compliance Benefits:

• Supports GDPR’s storage limitation principle
• Reduces exposure in case of data breach
• Simplifies compliance with data subject requests
• Demonstrates privacy by design

6. Provide User and Non-User Controls

Respecting both user and non-user preferences is essential for compliance and trust.

Implementation Guidance:

• User Controls

  • Let users opt out of contact syncing
  • Provide options to delete previously imported contacts
  • Allow disabling of matching features
  • Implement granular privacy settings

• Non-User Controls

  • Let non-users opt out of matching and invitations
  • Implement global suppression lists
  • Honor opt-outs across all users and features
  • Provide clear pathways for non-user rights requests

• Technical Implementation:

  • Maintain suppression hashes for future matches
  • Check all new imports against suppression lists
  • Implement secure, privacy-preserving matching for opt-outs
  • Design database schemas to support global opt-outs

• Process Considerations:

  • Create workflows for handling non-user requests
  • Train support staff on non-user rights
  • Document your approach to non-user controls
  • Regularly test opt-out effectiveness

Legal Necessity:
Both GDPR and CPRA extend rights to individuals whose data you process, regardless of whether they have an account with your service. Honoring these rights is not optional.

Real-World Example: Risk of Poor Import Design

Understanding real-world consequences helps illustrate the importance of proper contact import design.

LinkedIn’s Contact Import Case:

LinkedIn’s early contact importer implementation led to significant legal and reputational consequences:

• Implementation Issues:

  • Full address book scraping without clear disclosure
  • Auto-matching and inviting without full transparency
  • Reminder emails sent without additional consent
  • Unclear opt-out mechanisms for non-users
  • Retention of contact data beyond necessary periods

• Consequences:

  • $13 million class-action settlement
  • Significant reputation damage
  • Required changes to core growth features
  • Ongoing compliance monitoring
  • Negative press coverage

• Key Lessons:

  • Consent-first import prevents years of legal and reputational risk
  • Transparency about data usage is essential
  • One-time messaging should be strictly enforced
  • Non-user rights must be respected
  • Retention limits must be clearly defined and enforced

(Source)

Import Patterns to Avoid

Certain implementation patterns create significant legal and reputational risks:

Pattern	Risk	Better Alternative
Importing all contacts silently	Breach of transparency and consent principles; potential regulatory action	Explicit permission request; clear user selection
Retaining unmatched imports indefinitely	GDPR and CCPA violation; increased breach exposure	Implement automatic deletion; document retention periods
Sharing imported contacts with marketing	Secondary processing breach; purpose limitation violation	Strict purpose limitation; separate consent for marketing
Re-matching blocked contacts	Breach of suppression duty; violation of user expectations	Global suppression list; honor opt-outs across features
Using contacts for “people you may know” without disclosure	Transparency violation; potential privacy harm	Clear disclosure about recommendation sources; opt-out options
Storing unnecessary contact metadata	Data minimization violation; increased breach impact	Filter data before storage; collect only what’s needed

Implementation Guidance:

• Conduct privacy impact assessments for contact import features
• Implement privacy by design principles from the start
• Create clear documentation of design decisions
• Regularly review and update your approach

Summary: Import Carefully, Match Respectfully

Effective contact import systems balance functionality with privacy protection:

Strategy	Outcome	Technical Implementation
OAuth + minimal scope	Less exposure	Least-privilege API integration; field filtering
Manual selection	True consent	User-controlled selection UI; default-off state
In-memory matching	No unnecessary data storage	Ephemeral processing; minimal persistence
Respect opt-outs	Compliance and trust	Global suppression system; cross-user enforcement
Aggressive retention limits	Reduced risk profile	TTL-based storage; automatic purging
Transparent processing	User understanding and trust	Clear UI; progressive disclosure; audit logs

Contact import isn’t just a feature—it’s a relationship handshake. The technical choices you make directly impact both compliance and user trust.

If users feel safe syncing their contacts, your network grows sustainably—and without lawsuits. Privacy-respecting contact import creates a foundation for ethical growth that benefits both your platform and your users.

Up Next

Next, we’ll show how to manage consent, retention, and opt-outs at scale for both users and non-users.

Read Consent, Retention, and Opt-Out at Scale

Or revisit safe invite practices:
Sending Invitations After Matching