Facebook says up to 87 million profiles were harvested

The European rules, which go into effect next month, give people more control over how companies use their digital data.

Facebook had not previously disclosed how many accounts had been harvested by Cambridge Analytica, the firm connected to the Trump campaign. It has also been reluctant to disclose how it was used by Russian-backed actors to influence the 2016 presidential election.

Among Facebook’s acknowledgments Wednesday was the disclosure of a vulnerability in its search and account recovery functions that it said could have exposed “most” of its 2 billion users to having their public profile information harvested.

The new effort to appear more transparent about the data leaks — including a rare question-and-answer session with Zuckerberg and reporters — came just before Zuckerberg’s expected testimony next week on Capitol Hill, where he will most likely face criticism over how the company collects and shares the personal data of its users. Sheryl Sandberg, Zuckerberg’s top deputy, has several national television interviews scheduled for later this week.

The company said that on Monday it would start telling users whether their information may have been shared with Cambridge Analytica.

Andy Stone, a spokesman for Facebook in Washington, said the 87 million figure was an estimate of the total number of users whose data could have been acquired by Cambridge Analytica. He said that the estimate was calculated by adding up all the friends of the people who had logged into the Facebook app from which Cambridge Analytica collected profile data.

“We wanted to put out the maximum number of people who could have been affected,” Zuckerberg told reporters.

It remains unclear exactly how many users had their personal information accessed by Cambridge Analytica. The firm said Wednesday that it had licensed data for no more than 30 million users of the social network.

Facebook also released a lengthy document describing how it would gather personal data in the future. In that document, Facebook said its search and account recovery systems had been open to abuse by anyone who already had some information about an individual, such as a phone number or email address. The vulnerability extended to much of the platform’s user base before it was closed on Wednesday, Facebook said.

The company also said it would no longer allow outsiders to use apps to gather information about the religious or political views of its users. And it will stop using third-party data from companies such as Experian and Acxiom to help supplement its own data for ad targeting.

“It’s clear now that we didn’t focus enough on preventing abuse,” Zuckerberg said. “We didn’t take a broad enough view of what our responsibility is. That was a huge mistake, and it was my mistake.”

The Federal Trade Commission is investigating whether Facebook violated a 2011 agreement meant to protect users’ privacy. User data is crucial to the company’s business, because it is used to deliver advertising to users.

Zuckerberg is scheduled to testify about the company’s handling of sensitive user data before the Senate’s Commerce and Judiciary committees on Tuesday and the House Energy and Commerce Committee on Wednesday.

“This hearing will be an important opportunity to shed light on critical consumer data privacy issues,” said Reps. Greg Walden, R-Ore., and Frank Pallone, D-N.J., of the House committee.

Sen. Chuck Grassley, R-Iowa, the chairman of the Judiciary Committee, said, “With all of the data exchanged over Facebook and other platforms, users deserve to know how their information is shared and secured.”

Facebook’s problems stretch back before the reports about Cambridge Analytica, to earlier investigations into how Russian actors infiltrated the platform by placing ads and posts to influence the 2016 election. Zuckerberg initially dismissed the idea of foreign interference on Facebook as a “crazy idea.”

Since then, the company has been the focus of investigations by law enforcement and congressional committees that are delving into the Russian influence campaign. Facebook now acknowledges that its platform was used to sway voters.

All those troubles have prompted investors to flee the company, and its stock has fallen sharply in recent weeks.

In response, the company has put its executives front and center.

Zuckerberg typically talks to groups of reporters only after the company releases its quarterly financial reports. But after not responding in public for several days following the Cambridge Analytica disclosure, he has given a series of interviews.

And Sandberg, Facebook’s chief operating officer and the second most recognizable face at the company, is set to be interviewed this week by Fox News, “PBS NewsHour,” NBC’s “Today” show and Bloomberg. Sandberg will be interviewed remotely from California.

Facebook said its new openness was meant to show that it takes the intense criticism over its handling of user data seriously.

In Washington, Facebook employees and public relations firms retained by the company have talked to regulators and congressional staff members about new privacy measures, including updates to policies that are intended to make them easier to understand.

On Wednesday, Zuckerberg provided a preview of what he will tell Congress next week. He said Facebook was “an idealistic and optimistic company.”

But he acknowledged that the company had committed serious errors by not ensuring that robust safeguards were in place for users.

Asked if he should still be leading the company, he said, “Yes. Life is about learning from the mistakes and learning what you need to go forward.”

Terrell McSweeny, a Democratic member of the Federal Trade Commission, said Zuckerberg has a big task ahead of him in Washington.

“I think it is important for Zuckerberg to clearly explain how Facebook plans to earn back consumer trust,” McSweeny said. “Consumers need reassurance that their data are not being misused.”