Vodafone has apologised to an Auckland woman after information from her Facebook page, including her full name, was used in its advertising without permission.

Kesha Robertson, 24, was backpacking in South America when her father emailed her to say he had seen a screen-grab from her Facebook profile, which showed her name and a photo of Machu Picchu, in a newspaper advert.

She had assumed the information was private because her Facebook profile could only be accessed by friends, and was "shocked" to learn Vodafone had helped itself to it.

"At first I was kind of stoked because my photo was in the paper, but then I thought about it and I thought actually they probably should have asked me or at least told me that they were going to do it," she said.

"It may be legal, but it's certainly not ethical. It is well within their financial means to buy stock imaging."

Ms Robertson said while she knew about the privacy concerns surrounding Facebook she had no idea companies like Vodafone used information from profiles without permission.

Vodafone spokesman Matt East said Ms Robertson's information was taken by a Facebook friend of hers who worked in Vodafone's creative team, but had since left.

The creative team would take images off their friend's Facebook profiles as well as their own to be used in advertisements, he said.

If a person was featured in an image they had to be a Vodafone employee, but it was permissible to use images which did not contain people from non-employee profiles, he said.

Images were then sent to an advertising company who used Photoshop to replace real names with "dummy names" before the adverts were published.

Mr East said in the case of Mrs Robertson, advertising company 99 had mistakenly used the pre-Photoshopped version of the advert which still had her name in it.

"It was just a human error mistake... it wasn't changed as it should have been. Obviously we're going to investigate and put things in place to make sure this doesn't happen again."

Vodafone contacted Ms Robertson last week and offered her a full apology as well as a new iPhone.

Mr East said Vodafone no longer used Facebook information of non-employees.

"It's not really worth the hassle if you get a mistake like this. It's easier to use our own stuff or create it from scratch."

Privacy lawyer John Edwards said while Vodafone could argue Ms Robertson had made information public by posting it on Facebook, they probably breached her intellectual property rights.

"She would have a claim on the basis of the use of her intellectual property because somebody has used for commercial gain her intellectual property," he said.

"It's a dumb thing for a commercial enterprise to do."