Facebook,

Even regulators knew exactly how Facebook gave developers access to data. Max Schrems, then a 23-year- old Austrian law student, wrote 22 complaints to the Irish data protection commissioner in August 2011. One complaint addressed exactly the issue exposed by the Cambridge Analytica revelations. He complained that Facebook had no way to control what developers did with this data and apps could retrieve data of a user’s friends without consent. Mr. Schrems said this violated European data protection law.

When the European regulator, based in Ireland where Facebook has its international headquarters, investigated, it recommended the company make its settings easier to understand. Once Facebook made the information “clearer,” it found the use “satisfactory.”

Facebook made significant changes to its platform in 2015, when it restricted the amount of data apps could access on a user’s friends. Now, Facebook has promised to investigate all apps that harvested significant amounts of data to trace where they ended up.

“We are strongly committed to protecting people’s information,” says a Facebook spokesperson. “As Mark Zuckerberg said this week, we are working hard to tackle past abuse, prevent future abuse and give people more prominent controls.”

But ill-gotten data may already have been incorporated into models, making it hard to identify its progeny. Mr. Zuckerberg also announced changes to protect user data from developers. These changes come years after it first learned of the problem — and did not address how Facebook itself uses the data.

Lawmakers and regulators in Europe and the US, where Facebook signed a privacy deal with the Federal Trade Commission in 2011, are now scrutinizing the problems posed by data- hungry businesses. The question is how to regulate these fast-changing technologies without breaking their business model.

Mr. Zuckerberg said this week that he is not against regulation of the social network — he just wants it to be the “right” kind. The example he used was the bipartisan Honest Ads bill, proposed in the US by senators Mark Warner, Amy Klobuchar and John McCain, which advocates far more transparency around political ads online. Others believe that regulation needs to go further, perhaps even banning political advertising on the network.

Forcing political campaigns to publish all the ads they are running on the same page and Facebook to certify the advertisers will not fracture the company’s financial projections. Political advertising is a small slice of the pie. Even if extended to all advertisers, the act would not significantly hit revenue: sellers of soaps and socks are not shy about publishing their marketing materials.

“The underlying problem is that Facebook’s business model, like Google’s and many others, is based on constant commercial surveillance,” says David Martin, senior legal officer at BEUC, the European consumer rights organization. He believes that enforcement authorities must “keep a close eye” on Facebook “given the massive amounts of personal data the company handles, the nature of its business, its market power, and its poor record.”

Europe looks far more likely to regulate Facebook than the US. The company has already been fined in Europe for importing data from WhatsApp, the messaging group it bought in 2014 and in Belgium last month it was ordered to stop tracking people who did not use Facebook as they browsed the web.

From May, it will have to comply with Brussels’ General Data Protection Regulation ( GDPR) and give users the opportunity to opt in rather than opt out of some data sharing services. The EU is also discussing an e-privacy directive, which, if passed, Mr. Martin believes would have an impact on Facebook’s business, because it would significantly restrict the tracking of users’ behavior online.

Some activists hope Europe will end up setting a global standard for privacy with GDPR. Yet Facebook has already released products in the US that break EU rules. Last year, it said it would use artificial intelligence to identify people who are thinking about committing suicide and report them to first responders for assistance. But European rules do not allow the scanning of posts to establish users’ mental health. Facebook’s Messenger for Kids is also unlikely to debut in Europe, because despite higher privacy protections than on the main app, Europe will restrict the age you can use social media.

Jacob Metcalf, a researcher with US think-tank Data & Society, says regulators must examine whether Facebook and other platforms should be allowed to micro-target users. If there was no way for advertisers to reach very small groups of people, he adds, there would be little point in harvesting so much data. “There are kinds of profiling and micro- targeting that we just shouldn’t tolerate,” he says. “There’s no reason to have a psychological profile of me.”

Facebook’s ability to target users is the secret sauce that has helped it dominate the digital advertising market alongside Google. Google knows what you are looking for, Facebook knows who you are. It can show adverts to people because of their location, their interests, gathered from browsing on and off the network, or because they are on a marketers’ curated e-mail list — allowing advertisers to bring in other data from their own profiles or data brokers.

If regulators did create stricter rules for data collection or targeting, it could cost Facebook which generated $16 billion in net income last year. One analyst praised Mr. Zuckerberg for not pledging bigger changes on privacy that could have cost shareholders.

But Mr. Metcalf points to the falling shares, as investors worry about potential fines and loss of users, as a sign that privacy concerns are costing Facebook.

“There’s been up to $60 billion [ wiped] off its market cap. It has cost Zuck personally a huge amount of wealth,” he says. “So how many of these scandals do there need to be for the platforms overall to decide the marginal benefit they accrue for hoarding so much data about us just isn’t worth the price?”