Zuckerberg says Facebook must protect user data or ‘we don’t deserve to serve you’

Facebook Inc. Chief Executive Mark Zuckerberg acknowledged that his company “made mistakes” in protecting user data obtained by Cambridge Analytica, but said steps already taken and new policies unveiled Wednesday would prevent developers from misappropriating such information in the future.

Part regret, part explanation and part announcement of strategies to come, Zuckerberg’s first comments since the Cambridge Analytica scandal erupted sought to reinforce Facebook’s reputation as a trustworthy social platform despite the unauthorized collection of the personal data of about 50 million users by a data analytics firm with ties to President Trump’s campaign.

“I started Facebook, and at the end of the day I’m responsible for what happens on our platform,” he said in the statement. “We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you.”

Zuckerberg later apologized for the sharing of the data during an interview on CNN on Wednesday evening.

“This was a major breach of trust, and I’m really sorry that this happened,” he said.

In a post on his Facebook page, Zuckerberg said the social media giant had already made efforts in 2014 to “dramatically” limit developers’ access to data in an attempt to prevent “abusive apps.” Those steps, which prevent apps from asking for data about a user’s friends without authorization, would prevent future groups similar to Cambridge Analytica from amassing so much information without users’ knowledge, he said.

Zuckerberg also said the company would investigate all apps that had access to “large amounts of information” prior to the changes made in 2014 and that Facebook would conduct a full audit of any app with “suspicious activity.”

Developers that do not agree to a thorough audit will be banned, as well as developers that misuse personally identifiable information, he said. Affected users, including those whose data were allegedly misused in the Cambridge Analytica incident, will be notified by Facebook, Zuckerberg said.

The Menlo Park, Calif., tech giant also said it would further restrict developers’ access to data with measures such as reducing the data that users hand over to outside apps upon signing in to their name, profile picture and email address.

Developers will be required by Facebook to get approval and sign a contract if they want to ask users for access to posts or other private data. And the social media giant said it would put a tool at the top of its News Feed showing users the apps they’ve used and giving them an “easy way” to revoke those apps’ ability to access data.

“While this specific issue involving Cambridge Analytica should no longer happen with new apps today, that doesn’t change what happened in the past,” Zuckerberg wrote. “We will learn from this experience to secure our platform further and make our community safer for everyone going forward.”

Facebook has found itself on the defensive after the New York Times and British newspaper the Observer reported Cambridge Analytica, which is owned by conservative billionaire Robert Mercer, aimed to use Facebook user data in an attempt to sway voters’ opinions. The company reportedly relied on a personality quiz developed by a Cambridge University researcher and downloaded by about 300,000 people that also gathered data from their friends on the platform.

On Wednesday, Zuckerberg laid out a detailed timeline of events. He said the company learned in 2015 from journalists at the Guardian that the Cambridge researcher who developed the quiz app had improperly shared that data with Cambridge Analytica.

Facebook has said the incident was a violation of the company’s policies but did not constitute a data breach. Zuckerberg said Wednesday that Facebook immediately banned the researcher’s app and demanded that he and Cambridge Analytica “formally certify” they had deleted all the improperly gathered data. He said they provided those documents to Facebook.

Facebook then learned last week from the New York Times, the Guardian and BBC Channel 4 that “Cambridge Analytica may not have deleted the data as they had certified,” Zuckerberg said. He said the data mining firm claims it already deleted the data and has agreed to a forensic audit by a company hired by Facebook.

The blowback has been swift. Facebook’s stock has dropped 8.5% since Friday and the U.S. Federal Trade Commission has reportedly launched an investigation into whether Facebook violated a 2011 consent decree that required the company to obtain user permission for certain changes to privacy settings.

An FTC spokesman said in a statement Wednesday that the agency was “aware of the issues that have been raised but cannot comment on whether we are investigating.”

But Facebook’s potential legal problems continue to mount. Attorneys general from New York and Massachusetts have called for additional investigations and on Tuesday, investors sued Facebook, saying the company’s inability to protect user data led to its stock slump. Sens. Edward J. Markey (D-Mass.) and Amy Klobuchar (D-Minn.) demanded on Twitter that Zuckerberg testify before Congress.

“To truly regain the public’s trust, Facebook must make significant changes so this doesn’t happen again,” Klobuchar tweeted.

On Wednesday, California state Treasurer and gubernatorial candidate John Chiang called for outside oversight during an interview on CNBC, saying that Facebook couldn’t be left “to their own devices” to protect users’ information.

Zuckerberg and Facebook’s chief operating officer, Sheryl Sandberg, had been roundly criticized for their silence in the days since the Cambridge Analytica data misappropriation scandal erupted. In a statement on Facebook released Wednesday, Sandberg said the company knew the incident was “a major violation” of trust.

“I deeply regret that we didn’t do enough to deal with it,” she wrote. “Your trust is at the core of our service. We know that and we will work to earn it.”

At least one analyst said Zuckerberg’s response was a “step in the right direction.”

While the Cambridge Analytica issue will “remain a dark cloud over the Facebook name in the near-term,” Daniel Ives, head of technology research at GBH Insights, said the actions outlined in Zuckerberg’s statement “should help users, advertisers, and investors feel more comfortable that Facebook and Zuckerberg are starting to get their arms around this issue.”

[email protected]

Twitter: @smasunaga

UPDATES:

7 p.m.: This article was updated after Zuckerberg’s appearance on CNN.

5:20 p.m.: This article was updated throughout with more details of Facebook’s plans to restrict developers’ access to data and lawmaker comments.

This article was originally published at 1:10 p.m.