After months of negotiations, the Federal Trade Commission fined Facebook a record-setting $5 billion on Friday for privacy violations, according to multiple reports. The penalty comes after an investigation that lasted over a year, and marks the largest in the agency’s history by an order of magnitude. If approved by the Justice Department's civil division, it will also be the first substantive punishment for Facebook in the US, where the tech industry has gone largely unregulated. But Washington has taken a harsher stance toward Silicon Valley lately, and Friday’s announcement marks its most aggressive action yet to curb its privacy overreaches.

Full details of the settlement were unavailable Friday afternoon, and the FTC and Facebook both declined to comment. The Wall Street Journal first reported the news. It's unclear how long it will take for the Justice Department to review the terms. In the meantime, important questions remain unanswered, including whether the FTC has opted to hold Facebook CEO Mark Zuckerberg personally liable for the company’s privacy violations, and what sort of external oversight Facebook must submit to going forward.

The FTC opened its investigation into Facebook’s data practices last March, one week after news broke that Cambridge Analytica, a political consulting firm that worked with the Trump campaign in 2016, had improperly obtained information on tens of millions of Facebook users. The data was purchased from an academic who used a personality profiling app to collect information not just from consenting users but, thanks to Facebook’s lax privacy policies at the time, from all those users’ friends—without their knowledge. Facebook didn’t cut off that access until 2015.

But in 2011, Facebook had promised the FTC that it would not share data with third parties without users’ affirmative consent, as part of a settlement agreement over charges that the company deceived consumers about its privacy practices. It appears that the regulator has found that Facebook violated that consent decree.

"We don’t think a fine matters. We need a structural solution here." Matt Stoller, Open Markets Institute

The reported fine far surpasses the previous largest privacy-related penalty that the FTC has levied, a $22.5 million strike against Google in 2012 over its privacy policies on the Safari browser. But even $5 billion would be a drop in the bucket for Facebook, which generated $15 billion in revenue last quarter alone. When Facebook disclosed in its Q1 earnings report that it had set aside $3 billion to $5 billion to cover the costs of the settlement, its stock price soared.

Some of Facebook’s biggest critics had previously expressed doubt that any amount of money could sufficiently punish a company of Facebook’s size. “They can issue a really big fine, which is just a parking ticket,” Matt Stoller, a fellow at the anti-monopoly think tank Open Markets Institute, recently told WIRED. “We don’t think a fine matters. We need a structural solution here.”

In a letter to the FTC in early May, Senators Richard Blumenthal (D-Connecticut) and Josh Hawley (R-Missouri) argued that the FTC should “compel sweeping changes to end the social network’s pattern of misuse and abuse of personal data.”

“Personal responsibility must be recognized from the top of the corporate board down to the product development teams,” the letter read. “If the FTC finds that any Facebook executive knowingly broke the consent order or violated the law, it must name them in any further action.” Whether the FTC did so remains one of the biggest open questions around this settlement, one made all the more intriguing after the recent disclosure of emails, again in The Wall Street Journal, that appear to indicate that Zuckerberg was aware of the company’s “questionable” privacy practices.

The Cambridge Analytica scandal spurred a rising awareness of data rights in the United States, as Facebook and other tech companies were repeatedly called to answer for broken promises and failures to protect user data. The FTC’s apparent decision comes amid a growing demand for more action to rein in Big Tech. In Congress, lawmakers on both sides of the aisle have called for federal legislation to protect the privacy rights of Americans, while a number of state legislatures already have passed or are considering privacy bills of their own.

READ MORE For more on Facebook's 15 months of Cambridge Analytica hell, read our May cover story.

The concerns over Big Tech aren’t limited to privacy, either. The FTC formed a task force to investigate both future and past mergers in the industry earlier this year and now, along with the Justice Department, is reportedly scrutinizing major companies like Facebook and Google over antitrust concerns. Massachusetts senator and Democratic presidential candidate Elizabeth Warren has proposed splitting up tech platforms that also do business on those platforms and reviewing past mergers, including Facebook’s acquisition of Instagram and WhatsApp. A number of conservative politicians, including President Trump, have accused social media companies of liberal bias and censorship.