By Byron Tau and Deepa Seetharaman
Updated March 19, 2018 9:41 p.m. ET
Facebook Inc. confronted an intensifying crisis as political leaders in the U.S. and Europe called for aggressive inquiries into whether the technology giant failed to stop improper access and handling of user data, scrutiny that sent the company’s stock to its biggest decline in four years.
The uproar pushed Facebook’s stock down 6.8% to $172.56 Monday, wiping out about $36 billion in market value as the episode reignited concerns over how Facebook, Alphabet Inc.’s GOOGL -3.03% Google and other internet firms handle user data that is at the core of advertising businesses that have made them among the richest companies on Earth.
The backlash has raised anew the prospect of tighter regulation of the social-network company and other big internet firms that already are under scrutiny for how Russia manipulated their platforms before and after the 2016 presidential election. Internally, Facebook executives and employees have fiercely debated how to respond to the additional scrutiny.
The latest controversy centers on whether Cambridge Analytica, which helped the Trump campaign in 2016, collected and used without permission data from the accounts of millions of users obtained through a Facebook app developed by an academic at the University of Cambridge. Facebook on Friday said it suspended Cambridge Analytica—along with an associated firm, the academic and another individual—as it investigates reports that the firm kept user records for years after saying it had destroyed them. Cambridge Analytica has said it complied with Facebook’s rules.
Republican and Democratic lawmakers called for tech-company leaders, including Facebook Chief Executive Mark Zuckerberg, to appear before Congress to explain how they protect user data from being exploited by third-party companies for advertising and other targeting purposes.
“Facebook, Google, and Twitter have amassed unprecedented amounts of personal data and use this data when selling advertising, including political advertisements,” said Sens. Amy Klobuchar (D., Minn.) and John Kennedy (R., La.) in a joint statement on Monday. “The lack of oversight on how data is stored and how political advertisements are sold raises concerns about the integrity of American elections as well as privacy rights.”
Sens. Klobuchar and Kennedy are members of the Judiciary Committee and have asked the panel’s chairman, Chuck Grassley (R., Iowa), to hold hearings. A spokesman for Mr. Grassley said no decision had been made to whether to hold such a hearing as the panel was “currently gathering information and taking steps to inform any action by the committee.”
They join others on Capitol Hill and in Europe calling for additional scrutiny of tech companies and Cambridge’s practices. Other senior members of Congress are calling for either additional investigations or renewed steps to curb abuse in digital advertising.
Ron Wyden (D., Ore.), wrote a letter to Mr. Zuckerberg demanding answers to a series of questions about media reports on how Cambridge Analytica used the Facebook data. Mr. Wyden said the incident calls into question a number of issues, including “the prudence and desirability of Facebook’s business practices and the dangers of monetizing consumers’ private information.”
Sen. John Thune (R., S.D.), chairman of the Senate Commerce Committee, which has jurisdiction over some technology issues, said he was planning to send a request to Facebook for more information. Facebook has a “responsibility to make sure that that data is used in an appropriate way,” Mr. Thune said.
Meanwhile, the European Parliament’s president, Antonio Tajani, on Monday said “allegations of misuse of Facebook user data is an unacceptable violation of our citizens’ privacy rights” and vowed that Parliament will investigate fully.
The EU’s justice chief, Věra Jourová, said she expected “companies to take more responsibility when handling our personal data.” She said she would seek clarifications from Facebook and would discuss the matter with U.S. government officials on her scheduled trip to the U.S. this week.
Facebook executives have struggled to find responses that didn’t fuel more recrimination—repeating a pattern that has played out over the company’s response to a string of crises over the past 18 months. Pivotal Research analyst Brian Wieser said the weekend’s episode was another sign of “systemic problems” within the company. Mr. Wieser has a “sell” rating on the stock.
Several executives took to Twitter over the weekend to argue that Cambridge’s use of data, if confirmed, would be an abuse but wouldn’t constitute a data breach because the records were gathered through proper channels.
Andrew Bosworth, a senior Facebook executive, wrote in a Facebook post on Monday that Cambridge’s actions amounted to a breach of trust. “Much of the critique that has emerged over the weekend is valid and I am following it closely and listening,” he said.
Facebook Chief Security Officer Alex Stamos on Saturday deleted several tweets arguing against the use of the “data breach” term, later saying his remarks were factually correct but he “should have done a better job weighing in.” Mr. Stamos said he thought it was important for Facebook executives to talk about these complex issues publicly, but “I don’t know how to do that in this media environment.”
Mr. Stamos has been at the center of Facebook’s response to the Russian manipulation efforts, and he and other security officials have argued internally that Facebook should publicly disclose more about that activity. Mr. Stamos has indicated that he plans to leave Facebook in August, people familiar with the situation said on Monday.
Facebook began in 2007 letting outsiders access its “social graph”—the friend connections, interests and “likes” that linked its user base together. A range of organizations were allowed to use the information, including political campaigns. President Barack Obama’s 2012 re-election campaign, for example, created a voter-outreach app that analyzed users’ Facebook connections and encouraged users to reach out to potential Obama supporters among them.
By 2015, Facebook had largely stopped access to users’ friend connections, though political campaigns could still find would-be supporters by buying ads and using Facebook’s targeting tools.
Facebook has said it had learned in 2015 that Aleksandr Kogan, a psychology professor at the University of Cambridge, broke its data policies when he shared user data gleaned from his personality-prediction app, “thisisyourdigitallife,” with parties that included Cambridge Analytica.
At the time, Facebook’s platform rules allowed Mr. Kogan to glean information about those who downloaded the app—as well as many data points about their friends. Facebook has since restricted access to friend data.
Facebook said when it learned in 2015 that Mr. Kogan’s company shared data with Cambridge Analytica in violation of its terms of service, it obtained legal agreements to delete the information from the firm and Mr. Kogan, along with a man named Christopher Wylie, who worked with Cambridge Analytica. Facebook now is investigating whether the parties kept the data anyway.
A Cambridge Analytica spokesman said in a statement that its political division didn’t use Facebook data collected by Mr. Kogan’s company. The firm said that it deleted all data it received after it became clear that Mr. Kogan violated Facebook’s policies. Mr. Kogan didn’t respond to a request to comment and Mr. Wylie couldn’t reached to comment.
About 270,000 people downloaded the app, giving Mr. Kogan access to information such as the cities they lived in, the content they had liked, or information about their friends, Facebook has said. According to a report in the New York Times, as many as 50 million Facebook users were swept up in the data collection.
On Monday, Facebook said it hired a digital forensics firm, Stroz Friedberg, to do a “comprehensive audit” of Cambridge Analytica, which agreed to give “complete access” to its servers and systems.
Facebook also asked Mr. Kogan and Mr. Wylie to agree to an audit; the company said that Mr. Kogan provided a verbal agreement, while Mr. Wylie declined. Facebook said the audits were part of a broader review conducted by the company to determine whether the parties deleted the user data as they certified some years ago.
“If this data still exists, it would be a grave violation of Facebook’s policies and an unacceptable violation of trust and the commitments these groups made,” Facebook said.
—Natalia Drozdiak in Brussels and Sam Schechner in Paris contributed to this article.