×

[UPDATE, 4:03 p.m. ET: Facebook shed about $36.4 billion of market value at the close of trading Monday, after shares tumbled 6.8% for the day. The stock fell as low as 8.1%. The decline dragged down the tech-skewing Nasdaq index and other markets.]

Facebook shares fell more than 4% in premarket trading Monday after reports over the weekend that a data-analytics firm that worked for Donald Trump’s 2016 campaign improperly obtained access to information on more than 50 million users.

According to reports by the New York Times and the U.K.’s Guardian, the consulting company — Cambridge Analytica — had gotten hold of data on 50 million Facebook users, without their knowledge or consent. The reports also said the data had not been deleted despite Facebook’s demands that the firm do so as far back as 2015.

On Saturday, Facebook denied that the Cambridge Analytica situation constituted a “data breach.” It also said that Cambridge Analytica did not use any of the Facebook data in question as part of its work on behalf of Donald Trump’s 2016 presidential campaign.

Even so, the case highlights the fact that the processes Facebook had in place allowed the data to be shared beyond what it had authorized. The company now faces a greater regulatory risk as a result of the disclosure, while third-party ad measurement partners may face more restrictions, according to Pivotal Research analyst Brian Wieser.

“We think this episode is another indication of systemic problems at Facebook,” Wieser wrote in a research note Sunday. However, he added, “the company’s business won’t likely be meaningfully impacted for now because we don’t think advertisers will suddenly change the trajectory of their spending growth on the platform.”

According to Facebook, University of Cambridge professor Aleksandr Kogan lied to Facebook and violated its terms of service by passing on the data from an app that was using the Facebook login feature to Cambridge Analytica.

“Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent,” Paul Grewal, Facebook VP and deputy general counsel, wrote in a statement on the company’s blog site on Saturday. “People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.”

According to Facebook, it currently puts all apps requesting detailed user information through an app review process that requires developers to justify the data they’re looking to collect and how they’re going to use it.

Facebook announced late Friday that it was suspending Strategic Communication Laboratories and its Cambridge Analytica division from using the social platform. Cambridge Analytica, which according to its website “uses data to change audience behavior,” has offices in London, New York, and Washington, D.C. Per the Times, Cambridge Analytica provided various services for Trump’s 2016 election campaign, including “designing target audiences for digital ads and fund-raising appeals” as well as modeling voter turnout in U.S. states to inform TV ad buying.

[UPDATE: Facebook said in a blog post later Monday that it hired digital-forensics firm Stroz Friedberg to conduct an audit of Cambridge Analytica; the company said Cambridge Analytica has agreed to cooperate.]

Kogan created an app, “thisisyourdigitallife,” that offered personality predictions and advertised itself on Facebook as “a research app used by psychologists.” Around 270,000 people downloaded the app, granted access to data such as the city they set on their profile or Facebook content they had liked, as well as some limited information about friends who had privacy settings that allowed that sharing. Hence, through the 270,000 users who opted in to Kogan’s app, he was able to access data on 50 million-plus Facebook users.

“Although Kogan gained access to this information in a legitimate way and through the proper channels that governed all developers on Facebook at that time, he did not subsequently abide by our rules,” Grewal wrote.

Facebook will take “legal action if necessary” against Cambridge Analytica or others involved, Grewal added.