• by Wendy Davis  @wendyndavis, March 19, 2018

Cambridge Analytica's reported harvesting of data about Facebook users highlights the "dangers of monetizing consumers' private information," Senator Ron Wyden (D-Oregon) said Monday in a letter to CEO Mark Zuckerberg.

"With little oversight -- and no meaningful intervention from Facebook -- Cambridge Analytica was able to use Facebook-developed and marketed tools to weaponize detailed psychological profiles against tens of millions of Americans," the lawmaker wrote.

Wyden's letter comes in response to news reports that President Trump's political marketing consultancy, Cambridge Analytica, gleaned ad-targeting data from 50 million Facebook users. Cambridge Analytica reportedly harvested the data by the personality-quiz app thisisyourdigitallife, created by Global Science Research's Aleksandr Kogan. That app was downloaded by 270,000 users, but was able to gather information about many of those users' Facebook contacts, depending on their privacy settings.

"The troubling reporting on the ease with which Cambridge Analytica was able to exploit Facebook's default privacy settings for profit and political gain throws into question not only the prudence and desirability of Facebook's business practices and the dangers of monetizing consumers' private information, but also raises serious concerns about the role Facebook played in facilitating and permitting the covert collection and misuse of consumer information," Wyden wrote.

The lawmaker noted that Facebook's privacy controls allowed users to prevent this type of data collection, but that the setting wasn't advertised to users or turned on by default. "As a result, the vast majority of the tens of millions of users whose data was collected ... likely had no knowledge that their information was being harvested by third parties," he writes.

Facebook banned Kogan, Cambridge Analytica and others associated with the data harvesting from the platform on Friday. Facebook also said on Friday that it learned about the data harvesting in 2015, and removed Hogan's app from the platform at the time. The company added that it received certifications from Cambridge Analytica, Hogan and others in 2015 that the data harvested through the app was destroyed.

Wyden is asking Facebook to answer a host of questions, including why it failed to suspend Cambridge Analytica in 2015. Other questions include whether Facebook has attempted to identify and notify the 50 million users who were impacted by the data harvesting, and whether Cambridge Analytica or its clients used data gleaned from Hogan's app for targeted advertising.

Wyden is also asking Zuckerberg for copies of privacy assessments prepared by an auditor in accordance with the Facebook's 2012 settlement with the Federal Trade Commission. That settlement's provisions require the company to institute a comprehensive privacy policy and to submit to audits for 20 years. It also requires Facebook to obtain users' express consent before sharing their information more broadly than its privacy policy allowed when users uploaded the data.

The consent decree resolved an FTC complaint alleging that Facebook repeatedly shared users' data more broadly than they authorized. Among other allegations, the FTC claimed in its complaint that Facebook wrongly allowed app developers to access profile information they didn't need.

Facebook said Monday that it has hired digital forensics firm Stroz Friedberg to audit Cambridge Analytica in order to determine whether the company actually destroyed the data. "If this data still exists, it would be a grave violation of Facebook’s policies and an unacceptable violation of trust and the commitments these groups made," the company stated.

The company added that it currently reviews apps for potential privacy violations before approving them. "Hogan's app would not be permitted access to detailed friends’ data today," Facebook stated.