Interactive

The biggest risk to Facebook — and the digital-ad business overall — would be a wide-ranging privacy-protection law on the order of the 2010 Dodd-Frank Act in the banking sector. That established the Consumer Financial Protection Bureau, designed to keep predatory lenders in check, along with a host of new regulations.

Donald Trump’s presidential campaign has boasted often that it made better use of Facebook’s advertising tools than Hillary Clinton’s campaign did. An internal Facebook white paper, published days after the election, shows the company’s data scientists agree. "Trump’s FB campaigns were more complex than Clinton’s and better leveraged Facebook’s ability to optimize for outcomes," the author of the internal paper wrote, citing revenue of $44 million for Trump and $28 million for Clinton in that period.

No federal law spells out what companies trading in personal information can do with user data. No federal agency has clear jurisdiction over writing rules for internet companies. And public concern about personal data falling into the wrong hands has only recently swelled. Now lawmakers are feeling the heat.

By now, most consumers understand that data collection is a core part of advertising-based businesses such as Facebook, Google and Snapchat. The practice can often be a boon to consumers: The more people share with the companies, the better they are able to serve up ads, search results, product recommendations and music and movie suggestions tailored to an individual's liking. Yet many remain unaware of the type of data collected and what companies ultimately do with it. While the answers often lie in privacy policies and terms of service agreements, few take the time to look them over.

Facebook is curbing the information that it exchanges with companies that collect and sell consumer data for advertisers. The measures affect a group of so-called data brokers such as Acxiom Corp. and Oracle Data Cloud, formerly known as DataLogix, that gather shopping and other information on consumers that Facebook for years has incorporated into the ad-targeting system that is at the core of its business.

The contemporary internet was built on a bargain: Show us who you really are and the digital world will be free to search or share. People detailed their interests and obsessions on Facebook and Google, generating a river of data that could be collected and harnessed for advertising. The companies became very rich. Users seemed happy. Privacy was deemed obsolete, like bloodletting and milkmen. Now, the consumer surveillance model underlying Facebook and Google’s free services is under siege from users, regulators and legislators on both sides of the Atlantic.

Alexander Tayler, the acting CEO of Cambridge Analytica, defended the firm saying, "As anyone who is familiar with our staff and work can testify, we in no way resemble the politically motivated and unethical company that some have sought to portray. Our staff are a talented, diverse and vibrant group of people." Tayler served as the company's chief data officer in 2015 when Facebook first raised concerns that Cambridge had gained access to the user data via British academic Aleksandr Kogan, in violation of the social network's terms of service.

The political action committee founded by John R. Bolton, President Trump’s incoming national security adviser, was one of the earliest customers of Cambridge Analytica, which it hired specifically to develop psychological profiles of voters with data harvested from tens of millions of Facebook profiles, according to former Cambridge employees and company documents. Bolton’s political committee, known as The John Bolton Super PAC, first hired Cambridge in August 2014, months after the political data firm was founded and while it was still harvesting the Facebook data.

The data on millions of Facebook users that a firm wrongfully swiped from the social network probably has spread to other groups, databases and the dark Web, experts said, making Facebook’s pledge to safeguard its users’ privacyhard to enforce. Paul-Olivier Dehaye, a privacy expert and co-founder of PersonalData.IO suspects the data has already proliferated far beyond Cambridge Analytica’s reach. “It is the whole nature of this ecosystem,” Dehaye said. “This data travels.

Former Federal Trade Commission consumer protection enforcers say Facebook's response to the Cambridge Analytica scandal won't be enough to keep federal investigators at bay. "Just because they make changes moving forward doesn’t mean they can’t be investigated or sued for what they did before," said Jessica Rich, who stepped down as the head of the FTC's Consumer Protection Bureau in 2017.