Facebook Says Cambridge Analytica Harvested Data of Up to 87 Million Users

The company said that on Monday it would start telling users whether their information may have been shared with Cambridge Analytica.

Andy Stone, a spokesman for Facebook in Washington, said the 87 million figure was an estimate of the total number of users whose data could have been acquired by Cambridge Analytica. He said that the estimate was calculated by adding up all the friends of the people who had logged into the Facebook app from which Cambridge Analytica collected profile data.

“We wanted to put out the maximum number of people who could have been affected,” Mr. Zuckerberg told reporters.

It remains unclear exactly how many users had their personal information accessed by Cambridge Analytica. The firm said Wednesday that it had licensed data for no more than 30 million users of the social network.

Facebook also released a lengthy document describing how it would protect personal data in the future. In that document, Facebook said its search and account recovery systems had been open to abuse by anyone who already had some information about an individual, such as a phone number or email address. The vulnerability extended to much of the platform’s user base before it was closed on Wednesday, Facebook said.

The company also said it would limit the types of data that can be harvested by software used by outside businesses. The changes mean that users will have to give permission before an app can collect information beyond their names and addresses.

The company also said it would no longer allow outsiders to use apps to gather information about the religious or political views of its users. And it will stop using third-party data from companies such as Experian and Acxiom to help supplement its own data for ad targeting.

“It’s clear now that we didn’t focus enough on preventing abuse,” Mr. Zuckerberg said. “We didn’t take a broad enough view of what our responsibility is. That was a huge mistake, and it was my mistake.”

The Federal Trade Commission is investigating whether Facebook violated a 2011 agreement meant to protect users’ privacy. User data is crucial to the company’s business, because it is used to deliver advertising to users.

Mr. Zuckerberg is scheduled to testify about the company’s handling of sensitive user data before the Senate’s Commerce and Judiciary committees on Tuesday and the House Energy and Commerce Committee on Wednesday.

“This hearing will be an important opportunity to shed light on critical consumer data privacy issues,” said Representatives Greg Walden, Republican of Oregon, and Frank Pallone, Democrat of New Jersey, of the House committee.

Senator Chuck Grassley, the Republican chairman of the Judiciary Committee, said, “With all of the data exchanged over Facebook and other platforms, users deserve to know how their information is shared and secured.”

Facebook’s problems stretch back before the reports about Cambridge Analytica, to earlier investigations into how Russian actors infiltrated the platform by placing ads and posts to influence the 2016 election. Mr. Zuckerberg initially dismissed the idea of foreign interference on Facebook as a “crazy idea.”

Since then, the company has been the focus of investigations by law enforcement and congressional committees that are delving into the Russian influence campaign. Facebook now acknowledges that its platform was used to sway voters.

All those troubles have prompted investors to flee the company, and its stock has fallen sharply in recent weeks.

In response, the company has put its executives front and center.

Mr. Zuckerberg typically talks to groups of reporters only after the company releases its quarterly financial reports. But after not responding in public for several days following the Cambridge Analytica disclosure, he has given a series of interviews.

And Ms. Sandberg, Facebook’s chief operating officer and the second most recognizable face at the company, is set to be interviewed this week by Fox News, “PBS NewsHour,” NBC’s “Today” show and Bloomberg. Ms. Sandberg will be interviewed remotely from California.

Facebook said its new openness was meant to show that it takes the intense criticism over its handling of user data seriously.

In Washington, Facebook employees and public relations firms retained by the company have talked to regulators and congressional staff members about new privacy measures, including updates to policies that are intended to make them easier to understand.

On Wednesday, Mr. Zuckerberg provided a preview of what he will tell Congress next week. He said Facebook was “an idealistic and optimistic company.”

But he acknowledged that the company had committed serious errors by not ensuring that robust safeguards were in place for users.

Asked if he should still be leading the company, he said, “Yes. Life is about learning from the mistakes and learning what you need to go forward.”

Terrell McSweeny, a Democratic member of the Federal Trade Commission, said that Mr. Zuckerberg has a big task ahead of him in Washington.

“I think it is important for Zuckerberg to clearly explain how Facebook plans to earn back consumer trust,” Ms. McSweeny said. “Consumers need reassurance that their data are not being misused.”

Correction: April 4, 2018

An earlier version of this article attributed incorrectly an estimate that 50 million Facebook users’ personal information may have been improperly shared during the 2016 election. The estimate was based on documents and former Cambridge Analytica employees and associates. It did not come from Facebook.

Continue reading the main story