Facebook now thinks 87 million had data shared with Cambridge Analytica

Show Caption Hide Caption How Cambridge Analytica, Facebook swayed the 2016 election Here's how a data firm helped Donald Trump get elected as president. We have the FAQs.

SAN FRANCISCO — Facebook said it now thinks up to 87 million people, mostly in the United States, may have had their data improperly shared by political targeting firm Cambridge Analytica.

And many more — most users, in fact — probably had their public information scraped by outside companies, it says.

The new Cambridge Analytica estimate, disclosed in a blog post Wednesday where it detailed changes meant to enhance the privacy of its users' personal information in the wake of a data scandal that has raised doubts over CEO Mark Zuckerberg's leadership, is higher than the estimate of 50 million people reported three weeks ago by The New York Times and The Observer.

The social network's latest disclosures come days before Zuckerberg is set to testify to Congress over Facebook's failure to safeguard its users' personal information.

In an hour-long call with reporters Wednesday afternoon, Zuckerberg acknowledged the frayed trust that has sent some of its 2 billion users to delete or disengage from the app.

"It's clear now we didn't focus enough on preventing abuse and thinking through how people could use these tools for harm," he said. "We didn't take a broad enough view of what our responsibility is, and that was a huge mistake. It was my mistake."

Facebook last month disclosed it knew Cambridge Analytica had obtained personal information from hundreds of thousands of users who had downloaded a personality profile app. It said that the app's developer then passed that information, and details on their Facebook friends, to Cambridge Analytica without the users' knowledge.

But the social network's executives failed to make public that discovery until the eve of two news reports on the extent of the alleged leak, an 11th hour admission that added to complaints Facebook only comes clean on user breaches when forced.

Cambridge Analytica, the British consultancy that once counted former Trump adviser Steve Bannon on its board, claimed it helped Donald Trump win the election. It has denied using any ill-gotten Facebook data in those efforts and repeated that defense Wednesday, saying it had received 30 million "licensed" profiles from the psychology app developer that it did not use in the 2016 White House race. The Trump campaign said it did not use data from Cambridge Analytica.

Cambridge Analytica licensed data from GSR for 30 million individuals, not 87 million. We did not receive more than 30 million records from research company GSR. — Cambridge Analytica (@CamAnalytica) April 4, 2018

For Facebook, fallout has been severe. On the heels of revelations of how Russian operations made extensive use of its ad targeting platform to influence voters in the 2016 election, the disclosures have sparked an investigation from the Federal Trade Commission and demands for answers from attorneys general in 37 states and territories.

Worries about a regulatory backlash shaved tens of billions from Facebook's stock price and called into question the leadership of its CEO, who co-founded Facebook in a dorm room and is now one of America's most globally known business leaders.

"At the end of the day, this is my responsibility. I started this place, I run it, I'm responsible for what happens here," he said in answer to a question on whether he had fired anyone related to the data scandal. (He had not.) "I’m not looking to throw anyone else under the bus for mistakes that we've made."

When asked whether the Facebook board had discussed whether he would step down, he paused and answered: "Not that I'm aware of."

Shares rose 3% after hours Wednesday.

Apps on Facebook get curtailed

The data scandal also prompted users to question what they had unwittingly allowed other companies on Facebook access to, such as long-forgotten apps.

Some of the changes Facebook has made in recent weeks are designed to further lock down how much developers and other third parties can access of users' personal profiles.

Last week, it began to limit advertisers' ability to target users, saying it would no longer allow marketers to use information from third-party data brokers. On Wednesday, it said it was stopping a feature that allowed people to enter in another person's phone number or email address into Facebook search to help find them. It said "malicious actors" used the feature to scrape public profile information by submitting phone numbers and email addresses they already had.

"We believe most people on Facebook could have had their public profile scraped in this way. So we have now disabled this feature," said Chief Technology Officer Mike Schroepfer in a blog post.

More: Facebook deletes more Russian troll farm-affiliated accounts

More: OnPolitics Today: Facebook to face lawmakers who got a lot of money from Facebook

More: I downloaded all my Facebook data. This is what I learned.

It also placed more restrictions on what Facebook apps can access for its groups, events and pages features, such as preventing apps from seeing the members of a group. And for apps that let users bypass setting up a password by using Facebook Login, Facebook is restricting the type of information these apps can ask for, such as religious or political views.

Even before news arose of this massive data-mining operation of Facebook users, CEO Mark Zuckerberg had pledged to spend 2018 attempting to counter various concerns facing the social network. Among them: fabricated news that misled millions, live broadcasts of homicides and terrorism, racist targeting of ads, troubling search results and Russian manipulation.

Election tests

Zuckerberg, after initially calling suggestions that "fake news" on Facebook influenced the election in any way "pretty crazy," later backtracked and apologized. Under pressure from lawmakers' last fall, Facebook executives testified and released increasingly higher estimates on the extent and breadth of Russian manipulation on the platform. Just this Tuesday, Facebook again disclosed it had found more Russian-organized fake accounts and posts on its platform and its Instagram service.

On Wednesday, Zuckerberg again apologized for initially dismissing the worries about faked news.

"It was too flippant and I should never have referred to it as crazy," he said.

Facebook is making these changes as political operatives, whether for commercial gain or ideological wins, have plenty of incentive to try to skirt the company's restrictions to sway voters with focused targeting this year. Elections are taking place in Mexico, Brazil, Pakistan and India, as well as the U.S. midterms. Facebook has 15,000 people working on security and content review; by the end of the year, it will have 20,000.

Some observers are already concerned these efforts will fall short. Facebook says it's focused on paid ads run by federal candidates or political committees, not on combating negative appeals from Russian operatives on hot-button social issues.

USA TODAY reporter Mike Snider reported from McLean, Va.