Morin said that an updated version of Path had been pushed to the Android Market "a couple weeks ago" which changed the defaults to require users to opt-in and allow their contact lists to be shared with Path, and that the same update had also been submitted to Apple's App Store and was pending approval. Today, that approval has been granted and the update for the iOS version of Path is live.
Morin even wrote a blog post apology to users today, saying that the company learned via customer feedback that the way the app handled contacts was "wrong", and that the team is "deeply sorry if [users] were uncomfortable with how [the] application used your phone contacts.” Of course, it seems like common sense that if you are going to pull user contacts to your servers, that should require an opt-in, and the company shouldn't have needed to learn that through customer feedback. Morin went on to say that from now on, if you grant the app permission, but change your mind, you just need to send an e-mail to the company to have your information removed. Again, it seems as though this process could be made easier, but it is looking like Path is learning on the fly at this point.