The Securities and Exchange Commission (SEC) is investigating if Facebook Inc. (NASDAQ:FB) adequately warned investors that developers and other third parties may have obtained users’ data without their permission, The Wall Street Journal reported Thursday.
Facebook now faces tough questions from securities regulators on what it knew and when about Cambridge Analytica’s use of social-media data.
The Journal reported that the SEC has requested information from Facebook seeking to understand how much the company knew about Cambridge Analytica’s use of the data.
“The agency also wants to know how the company analyzed the risk it faced from developers sharing data with others in violation of Facebook’s policies,” reported the Journal.
Revelations about the illegitimate harvesting of personal data on tens of millions of Americans have focused on the social media giant’s failure to address privacy risks.
The SEC is probing whether Facebook should have disclosed to shareholders its knowledge of the Cambridge Analytica violation in 2015, when it learned that Aleksandr Kogan, a professor at the University of Cambridge, had improperly shared data in 2014 for as many as 87 million Facebook users with Cambridge Analytica.
Facebook said it told Kogan and Cambridge Analytica in 2015 to delete the data, and that it believed they had. The company said it learned in 2018 that it was possible not all of the data were destroyed.
Cambridge Analytica was hired by Donald Trump for his 2016 US presidential election campaign.
The Cambridge Analytica incident didn’t come to light until March, when the New York Times and the Guardian newspapers finally revealed Kogan’s role in harvesting data for Cambridge Analytica.
Heat from Justice Department and the Federal Trade Commission
The Justice Department and the Federal Trade Commission are also probing the data leak. The FTC is probing whether Facebook violated terms of an earlier consent decree requiring the company to get user consent for collecting personal data and sharing it with others.
The FTC previously settled a complaint against Facebook in 2011 for falling short of privacy promises to its users. Among other issues, the FTC found Facebook allowed third-party applications to access more user data than they needed to operate.
As part of the settlement, Facebook was ordered to get the "express consent" of users "before sharing their information beyond their privacy settings." The FTC is now looking into whether Facebook violated the settlement.
The Wall Street Journal noted that the SEC could close the Facebook investigation, which is in its early stages, without taking enforcement action against the firm.