The SEC’s investigation into Facebook’s data policies joins those of the FBI, the FTC and the Justice Department
Facebook has confirmed it is now facing investigations by the US financial regulator and the FBI into its handling of the Cambridge Analytica data scandal.
Those probes join inquiries already in progress by the Justice Department and the Federal Trade Commission.
Separately, Facebook said it had shut down three apps, citing low user numbers.
Political data-mining firm Cambridge Analytica allegedly used improper means to obtain detailed personal data on 87 million Facebook users for Donald Trump’s campaign in the 2016 US presidential election.
The firm has denied wrongdoing, but has since ceased operations, saying the publicity generated by the controversy made it impossible to do business.
“We are cooperating with officials in the US, UK and beyond,” Facebook said. “We’ve provided public testimony, answered questions, and pledged to continue our assistance as their work continues.”
The Securities and Exchange Commission (SEC) is tasked with holding companies to account for the statements they make to investors, and is investigating the way that Facebook’s disclosures around the data row have changed over time.
In April, for instance, Facebook chief executive Mark Zuckerberg told Congress the company had eliminated apps’ broad access to information about users’ friends in 2014, giving developers until May 2015 to comply with the new rules.
But Zuckerberg didn’t mention that Facebook had struck customised deals with dozens of companies that granted them continued access to users’ data after that deadline.
The company detailed those deals for the first time in a more than 700-page document provided to Congress last Friday night at midnight, information that appeared to contradict Zuckerberg’s previous public statements about data restrictions.
Facebook also failed to disclose that it had provided user data to a number of technology firms and device makers in deals intended to help them build Facebook features into their mobile gadgets. Hawkish US politicians have made much of the fact that Chinese firms such as Huawei were on the list of data recipients.
The SEC may also focus on the timing of Facebook’s public statements, such as a five-day delay before Zuckerberg publicly responded to initial reports of the data leak in March.
The FTC has been looking into whether the breach violated a 20-year data protection agreement with the regulator that was signed in 2011 following earlier scandals. Fines for breaching that settlement could amount to billions of dollars.
Facebook knew Cambridge Analytica had obtained the data in 2015, but didn’t report the incident as a data breach, instead asking the firm to delete the information.
Even then, it apparently didn’t insist that the valuable models derived from the information, known as data derivatives, also be erased, meaning the firm apparently retained them until well after the 2016 election.
The Washington Post previously reported that the investigation had been expanded.
Facebook also said it was shutting down a social media app aimed at teenagers called tbh, as well as fitness tracker Moves and Hello, which linked Facebook information with phone contacts.
Facebook bought tbh eight months ago after it attracted 5 millions downloads in its first nine weeks after launch. It encouraged teens to leave anonymous positive messages for one another.
Facebook bought Moves in 2014 and Hello in 2015. All user data for the three apps is to be deleted within 90 days, Facebook said.
The company said the closures were aimed at focusing its operations.
“We need to prioritise our work so we don’t spread ourselves too thin,” Facebook said. “And it’s only by trial and error that we’ll create great social experiences for people.”