Facebook gave users the weekend to ponder one of the great philosophical questions of all time: When is a post not really a post? On Friday, the social media giant posted a statement on its Facebook for Developers page disclosing that an API bug may have exposed the photos of up to 6.8 million users.

Some of those photos hadn’t even been posted yet—just uploaded. Facebook has had its share of troubles this year, but the involvement of photographs is something fairly new. Indeed, it’s not entirely clear whether current privacy laws would even cover the novel incident at hand.