The changes include restricting third-party app access and deleting phone call and text information that's over a year old.
Facebook also said it will stop a feature that lets users search for a profile using a phone number or personal email.
"Given the scale and sophistication of the activity we've seen, we believe most people on Facebook could have had their public profile scraped in this way," Schroepfer said. "So we have now disabled this feature."