META Meta Platforms Inc

By John D. McKinnon 

WASHINGTON -- The Federal Trade Commission is probing Facebook Inc. over the use of personal data by an analytics firm tied to President Donald Trump's campaign, a person familiar with the matter said.

The FTC is looking into whether Facebook violated terms of an earlier consent decree when data of up to 50 million of its users was transferred to Cambridge Analytica, this person said.

However, a person close to Facebook said that the agency's probe at this point doesn't appear to be a formal investigation, and the company is expecting to receive a letter from the FTC with questions.

"We remain strongly committed to protecting people's information," said Rob Sherman, Facebook's deputy chief privacy officer, in a statement. "We appreciate the opportunity to answer questions the FTC may have."

The social-media firm's shares fell 6.1% in morning trading to $162.05

The probe was first reported by Bloomberg.

The FTC said in a statement: "We are aware of the issues that have been raised, but cannot comment on whether we are investigating. We take any allegations of violations of our consent decrees very seriously."

The FTC statement went on to cite a 2012 privacy case against Alphabet Inc. unit Google, in which the company was fined $22.5 million for violating terms of its consent decree.

Facebook's consent decree was announced in 2011 and approved in 2012. The social-media giant agreed in its decree to get user consent for collecting personal data and sharing it with others.

Facebook was charged with deceiving consumers by telling them they could keep their information on Facebook private, but then repeatedly allowing it to be shared and made public. The settlement required Facebook to give consumers clear and prominent notice and obtaining their express consent before sharing their information beyond their privacy settings. It also agreed to maintain a comprehensive privacy program to protect consumers' information.

If the FTC eventually finds that Facebook violated its consent decree, the firm could face millions of dollars in fines as well as harm to its reputation with users.

Lawmakers in Washington and in the U.K. also are demanding more information from the company, in the latest in a string of regulatory headaches for Facebook as well as other big tech firms.

Last week, Facebook said it suspended the firm Cambridge Analytica from its platform following reports the firm had violated Facebook policies that govern how third-party developers can deploy user data they obtained from the company.

The firm, which worked for Republican presidential candidates including Mr. Trump and Sen. Ted Cruz of Texas during the 2016 campaign, was financed in part by a major Republican donor. It was founded on the premise of using cutting-edge social science to better target voters in political campaigns.

"Facebook, Google, and Twitter have amassed unprecedented amounts of personal data and use this data when selling advertising, including political advertisements. The lack of oversight on how data is stored and how political advertisements are sold raises concerns about the integrity of American elections as well as privacy rights," said Sens. Amy Klobuchar (D., Minn.) and John Kennedy (R., La.) in a joint statement on Monday.

Facebook said it had learned in 2015 that Aleksandr Kogan, a psychology professor at the University of Cambridge in the U.K., broke its data policies when he shared user data gleaned from his personality-prediction app, "thisisyourdigitallife," to third parties including Cambridge Analytica and Christopher Wylie, who runs a company called Eunoia Technologies Inc.

About 270,000 people downloaded the app, giving Mr. Kogan access to information such as the cities they lived in, the content they had liked, or information about their friends, Facebook Deputy General Counsel Paul Grewal wrote in a blog post. According to a report in the New York Times, as many as 50 million Facebook users were swept up in the data collection.

On Monday, Facebook said it hired a digital forensics firm, Stroz Friedberg, to do a "comprehensive audit" of Cambridge Analytica, which agreed to give "complete access" to its servers and systems.

Facebook also asked Messrs. Kogan and Wylie to agree to an audit. Mr. Kogan provided a verbal agreement, while Mr. Wylie declined. Facebook said the audits were part of a broader review conducted by the company to determine whether the parties deleted the user data as they certified some years ago.

"If this data still exists, it would be a grave violation of Facebook's policies and an unacceptable violation of trust and the commitments these groups made," Facebook said.

A Cambridge Analytica spokesman said in a statement that its political division didn't use Facebook data collected by Mr. Kogan's company. The firm said that it deleted all data it received after it became clear that Mr. Kogan violated Facebook's policies.

A Facebook spokesman said the parties, including Cambridge Analytica, entered legal agreements on the deletion, but Facebook couldn't independently verify that it was scrubbed. The company has since changed its data policies so developers can't easily gather as much data about Facebook users, it said.

Byron Tau and Deepa Seetharaman contributed to this article

Write to John D. McKinnon at john.mckinnon@wsj.com

(END) Dow Jones Newswires

March 20, 2018 12:51 ET (16:51 GMT)

Copyright (c) 2018 Dow Jones & Company, Inc.