META Meta Platforms Inc

By Deepa Seetharaman 

Facebook Inc. Chief Executive Mark Zuckerberg broke his silence five days into a growing uproar about how outsiders handle Facebook's user data, admitting mistakes and pledging an investigation but failing to calm some who thought he should have gone further in his remarks.

The growing controversy has shaken the social-media company, knocking its stock price lower and prompting renewed calls for governments to better regulate technology businesses that hold enormous quantities of information about their users.

Mr. Zuckerberg, in a post Wednesday on Facebook, said the company has already taken many steps to address user privacy in recent years, but he said "we also made mistakes, there's more to do, and we need to step up and do it."

Among the measures he said Facebook will take, the company will investigate and look for any potential abuses of personal data by app developers on its platform that have had access to large amounts of user data. Facebook also will audit any apps that display suspicious activity and notify any users affected, he said.

The investigation requires Facebook to map out how much and what kind of data was requested by app developers between 2007 and 2015, an expensive and far-reaching endeavor. Facebook will start by examining apps that had large user bases of around 100,000 people or more and those apps that pulled extensive data about a smaller group of people, according to people familiar with Facebook. The process could involve analyzing tens of thousands of apps, some of the people said.

Facebook's board issued its own statement late Wednesday, from lead director Sue Desmond-Hellman, saying Mr. Zuckerberg and his No. 2, executive, Chief Operating Officer Sheryl Sandberg, "know how serious this situation is and are working with the rest of Facebook leadership to build stronger user protections. They have built the company and our business and are instrumental to its future."

Sen. Amy Klobuchar (D., Minn.), who has been critical of Facebook's response, said the company's leaders need to do more. "The steps Facebook has laid out to protect its users are a start but Zuckerberg still needs to come testify" before Congress, she said in a post on Twitter. "Facebook should show good faith & support the Honest Ads Act. To truly regain the public's trust, Facebook must make significant changes so this doesn't happen again."

The user-data controversy was the latest setback for Facebook, which has struggled to respond to a barrage of criticism over the past 18 months about a range of issues, including manipulation of its platform by foreign actors, the spread of fabricated news stories and user privacy.

Mr. Zuckerberg's comments come days after the crisis prompted calls for him to testify before legislators in the U.S. and Europe, carved tens of billions of dollars off Facebook's value and raised new questions about the leadership of one of the world's most powerful technology companies.

"Facebook is exhibiting signs of systemic mismanagement, which is a new concern we had not contemplated until recently," Pivotal Research analyst Brian Wieser said in a note Wednesday morning. Mr. Wieser has a "sell" rating on the stock.

Facebook's stock rose slightly Wednesday, after losing about 10% or $50 billion, of its market value over the past few days.

In 2007, Facebook opened its platform to developers, paving the way for dating, job-search and other apps, as well as a new style of political campaigning. The move helped the social network become a fixture in its members' lives, catapulting the company from 58 million users to more than two billion today. It also addressed criticism from people who argued Facebook shouldn't have sole custody over the data generated by users.

In 2014, Facebook severely restricted the data that could be available developers, including dozens of different data points about users' friends. Those changes were implemented in 2015.

The current crisis began with Facebook's statement Friday that it was looking into reports that data-analytics firm Cambridge Analytica, which worked with the Trump campaign in 2016, improperly accessed and retained user data obtained from Aleksandr Kogan, a psychology professor at the University of Cambridge.

Mr. Kogan followed Facebook rules in gathering the data but violated its policies by sharing it with Cambridge Analytica, Facebook said. Cambridge Analytica has said it complied with Facebook's rules.

Mr. Kogan collected the data through a personality-quiz app he built for Facebook that was downloaded by about 270,000 people in 2013. At the time, Facebook's data policies allowed developers to gather personal information about those users' friends.

Facebook said it plans to notify the tens of millions of users whose personal information was collected by Mr. Kogan and shared with Cambridge Analytica. Reports in the New York Times and Britain's Observer said the episode involved information on some 50 million Facebook users.

Mr. Zuckerberg on Wednesday said the transfer was a "breach of trust between Kogan, Cambridge Analytica and Facebook. But it was also a breach of trust between Facebook and the people who share their data with us and expect us to protect it. We need to fix that."

Ms. Sandberg, added an apology. "I deeply regret that we didn't do enough to deal with it. We have a responsibility to protect your data -- and if we can't, then we don't deserve to serve you," she wrote in a separate post.

Over the weekend and early this week, senior Facebook officials spent much of the time trying to nail down what happened with Cambridge Analytica and contemplating whether and how Mr. Zuckerberg should respond, said people familiar with the matter.

The company also spent those days trying to devise a plan to secure user data collected by developers since Facebook's 2007 decision to provide outsiders access to user data to build apps and service, according to Ms. Sandberg and other people familiar with the company.

On Wednesday, Facebook said it would audit apps that showed suspicious patterns in how they pulled certain types of data. Developers who don't submit to a thorough audit will be banned from Facebook. Developers who misused personal user data also will be banned from Facebook and their users notified.

Facebook will further restrict data access currently available to developers, including removing developers' access to data about users who haven't used their apps in three months.

Some critics said the changes were too little too late. "They were effectively irresponsible years ago -- now they just got caught," said Matt Stoller, a fellow at the Open Markets Institute, a think tank focused on antitrust issues. "The government needs to actually act."

Mr. Zuckerberg's statement comes as Federal Trade Commission is investigating whether Facebook's user-data practices violated terms of a 2011 settlement. Users have aired their anger over social media, using the hashtag #deletefacebook. Late Tuesday, Brian Acton, co-founder of WhatsApp, a messaging app that Facebook bought for $22 billion in 2014, appeared to join them, with a message on his Twitter account saying "It is time. #deletefacebook." Mr. Acton has declined to comment.

The scrutiny has weighed on Facebook staff, with many questioning why Mr. Zuckerberg didn't earlier discuss the company's role publicly, according to current and former employees. At a question-and-answer session for employees Tuesday about the episode, Facebook lawyer Paul Grewal presided. Mr. Zuckerberg and Ms. Sandberg weren't in the room.

Mr. Zuckerberg and Ms. Sandberg and their teams were "working around the clock to get all the facts and take the appropriate action moving forward," a Facebook spokesman said before the executives' statements Wednesday.

Facebook has been under fire for more than a year on a range of issues, but criticism intensified last month when special counsel Robert Mueller secured indictments against a group of Russians for manipulating Facebook and other social platforms to sow discord.

Mr. Zuckerberg had kept a low profile during this period. In the month before Wednesday's statement, Mr. Zuckerberg has posted publicly on his Facebook page, typically his main venue for disseminating his views, only twice: once with photos of his family celebrating Chinese Lunar New Year, the other of them celebrating the Jewish holiday of Purim.

Publicly, Facebook has left it to other senior executives to make its case, often using posts on rival Twitter Inc. -- a strategy that has sometimes backfired.

Executives responded to the current uproar over the weekend by arguing that what happened didn't constitute a data breach -- prompting users, privacy advocates and others to say it was missing the point.

The company stumbled in its dealings with Congress, waiting nearly two weeks last September before deciding to turn over more details of divisive ads that Russian entities paid to run on its platform during the 2016 presidential campaign. It also sent the company's lawyer Colin Stretch rather than Mr. Zuckerberg to testify in Washington.

"Perhaps internally they felt that it didn't rise to the level of direct involvement by the CEO," said Rep. Adam Schiff, a California Democrat, "but I think they realize now that while the platform has immense positive impact in the world, that it has had some significant downsides."

Last month, Facebook's head of advertising, Rob Goldman, drew fire when he defended Facebook's handling of the incident and argued the Russians bought ads to exploit social divisions, not primarily to sway the 2016 election -- a point that some in Washington interpreted as contradicting the indictment.

Internally, Mr. Zuckerberg has appeared to take the criticism in stride. During an employee question-and-answer session last month, Mr. Zuckerberg said Mr. Goldman's comments didn't reflect the company's thinking, people familiar with his comments said, but he still backed Facebook's strategy of having a select group of senior executives engage directly with critics, academics and journalists on Twitter and be more transparent about the company's process and thinking.

--Robert McMillan contributed to this article.

Write to Deepa Seetharaman at Deepa.Seetharaman@wsj.com

(END) Dow Jones Newswires

March 21, 2018 19:49 ET (23:49 GMT)

Copyright (c) 2018 Dow Jones & Company, Inc.