The social network admitted last week that it had "unintentionally uploaded" the email contacts of 1.5 million new users since May 2016.
The disclosure came after a computer security researcher tweeting under the pseudonym "e-sushi" reported that Facebook was asking some users to enter their email passwords when they opened up new accounts. According to a report by Business Insider, users who entered their email passwords received a pop-up message saying Facebook was "importing" the new user's contacts.
In its statement, the attorney general's office claimed that "the total number of people whose information was improperly obtained may be [in the] hundreds of millions."
"It is time Facebook is held accountable for how it handles consumers' personal information," state Attorney General Letitia James said in a statement. "Facebook has repeatedly demonstrated a lack of respect for consumers' information while at the same time profiting from mining that data."
James added that last week's announcement by Facebook "is the latest demonstration that Facebook does not take seriously its role in protecting our personal information."
"We're in touch with the New York State attorney general’s office and are responding to their questions on this matter," a Facebook spokesperson told Fox News.
James' predecessor as state attorney general, Eric Schneiderman, opened an investigation in March 2018 into whether Facebook had unlawfully allowed users' personal data to be harvested by consulting firm Cambridge Analytica, which did work for Donald Trump's 2016 presidential campaign.
Fox News' Kathleen Foster contributed to this report.