Federal Trade Commission opens investigation into breach.
The Federal Trade Commission has opened an investigation into whether Facebook violated an agreement with the agency on data privacy, after reports that information on 50 million users was improperly obtained by the political consulting firm Cambridge Analytica, according to a person with knowledge of the inquiry.
The investigation, started in recent days, adds to the mounting pressure against Facebook about its handling of the data. Cambridge Analytica used the information to help President Donald Trump’s presidential campaign profile voters during the 2016 election.
The scrutiny of the company now extends from state capitals to Europe. Attorneys general in Massachusetts and New York are investigating Facebook’s handling of personal data, and the British Parliament has called for a hearing with Mark Zuckerberg, the company’s chief executive. Several senators have also called for him to appear in Washington.
Adding to concerns about the company is the impending departure of Alex Stamos, Facebook’s chief security officer. That change, reported Monday by The New York Times, reflects heightened leadership tension at the company.
The buildup of news has already hurt Facebook’s stock. The company’s shares were down more than 5 percent in midday trading Tuesday, after falling sharply Monday as well.
The FTC investigation is connected to a settlement the agency reached with Facebook in 2011. The agency had accused the company of deceiving customers “by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public,” according to a statement at the time.
Among several violations, the FTC found that Facebook told users that third-party apps on the social media site, like games, would not be allowed to access data. But the apps, the agency found, were able to obtain almost all personal information about a user.
The data on the 50 million users was harvested in 2014 by an outside researcher, Alexander Kogan. Kogan, a professor at Cambridge University, paid users small sums to take a personality quiz and download an app, which collected private information from their profiles and from those of their friends. Facebook allowed that sort of data collection at the time.
Then, as The Times reported over the weekend, Kogan gave the information to Cambridge Analytica, a firm founded by Stephen Bannon, the former White House political adviser, and Robert Mercer, the wealthy Republican donor. Passing the information to a third party violated Facebook’s policies, the company said last week.
“We are aware of the issues that have been raised but cannot comment on whether we are investigating,” an FTC spokeswoman said in a statement Tuesday. “We take any allegations of violations of our consent decrees very seriously.”
The investigation was reported by Bloomberg News Tuesday.
Facebook said it expected to receive questions from the FTC related to potential violations of its 2011 consent decree.
“We remain strongly committed to protecting people’s information. We appreciate the opportunity to answer questions the FTC may have,” Facebook’s deputy chief privacy officer, Rob Sherman, said in a statement.
The agency’s action against Facebook in 2011 was considered a landmark in privacy enforcement. The company could face fines of $40,000 a day per violation if the agency finds it violated their settlement.
“There are all sorts obligations under consent decree that may not have been honored here,” said David Vladeck, a former director of consumer protection at the FTC. “This goes to the fundamental question of trust.”
Vladeck said the FTC’s inquiry may just be the start. On Tuesday, the New York attorney general, Eric Schneiderman, announced the state was joining the Massachusetts attorney general, Maura Healey, in an investigation into whether the company failed to protect the privacy of users in those states. The two state attorneys general sent letters to Facebook demanding it hand over information about the company’s interactions with Cambridge Analytica.
“Consumers have a right to know how their information is used — and companies like Facebook have a fundamental responsibility to protect their users’ personal information,” Schneiderman said. “Today’s demand letter is the first step in our joint investigation to get to the bottom of what happened.”
Members of Congress are expected to be briefed soon by Facebook staff members, though so far, no committee leaders have scheduled hearings with the company.
“With all the reports out there now, the conduct at issue here is squarely in the bull’s-eye of what the 2011 consent decree was all about,” said James Cooper, an associate professor at the Antonin Scalia Law School at George Mason University and a former FTC official.
Sens. Amy Klobuchar, D-Minn., and John Kennedy, R-La., have asked the chairman of the Judiciary Committee, Charles Grassley, R-Iowa, to hold a hearing on Facebook’s links to Cambridge Analytica. Republican leaders of the Senate Commerce Committee, organized by John Thune of South Dakota, wrote a letter Monday to Zuckerberg demanding answers.