Facebook Inc. said it suspended Cambridge Analytica, a data firm that helped President Donald Trump with the 2016 election, after learning that it misled the social-media giant and violated its policy for handling user data.

Facebook said late Friday it been given information that Cambridge Analytica, along with two individuals who don’t work there, improperly kept Facebook user data for years despite telling the social network that it had destroyed those records. Facebook didn’t say how Cambridge Analytica used that data or if it gave the data to the Trump campaign.

Cambridge Analytica didn’t immediately respond to requests for comment late Friday.

Facebook, which didn’t elaborate on the source of its information, said it is suspending Cambridge Analytica, its parent Strategic Communication Laboratories, and the two individuals from buying ads or administering clients’ pages while it investigates the reports.

The move once again spotlights Facebook’s role during the 2016 presidential election and its shortcomings in policing manipulation and misuse of its platform.

Cambridge Analytica was a top vendor to Mr. Trump’s 2016 campaign and has come under scrutiny in special counsel Robert Mueller’s investigation into whether Trump associates colluded with Russia’s efforts to interfere in the U.S. election. Mr. Trump has denied any collusion by his campaign with the Russians, and Moscow has denied meddling in the election.

Facebook said it had learned in 2015 that Aleksandr Kogan, a psychology professor at the University of Cambridge, broke its data policies when he shared user data gleaned from his personality-prediction app, “thisisyourdigitallife,” to third parties including Cambridge Analytica and Christopher Wylie, who runs a company called of Eunoia Technologies Inc.

About 270,000 people downloaded the app, giving Mr. Kogan access to information such as the cities they lived in, the content they had liked, or information about their friends, Facebook Deputy General Counsel Paul Grewal wrote in a blog post.

Mr. Kogan’s data gathering was permitted at the time, but he violated Facebook policy by sharing the data he compiled with outsiders. Facebook in 2015 removed his app and demanded that he and those he shared the data with certify that the data was destroyed, the company said.

Mr. Kogan didn’t immediately respond to requests for comment late Friday. Mr. Wylie couldn’t immediately be located.

A Facebook spokesman said the parties, including Cambridge Analytica, entered legal agreements on the deletion, but Facebook couldn’t independently verify that it was scrubbed. The company has since changed its data policies so developers can’t easily gather as much data about Facebook users, it said.

Facebook said it learned several days ago that not all the data was deleted.

“We are moving aggressively to determine the accuracy of these claims,” Mr. Grewal wrote Friday. “If true, this is another unacceptable violation of trust and the commitments they made.”

Facebook said it has previously taken similar action against other advertisers and developers, although a spokesman declined to describe any examples.

The Trump campaign paid Cambridge Analytica close to $9 million for data, polling and research services, according to Federal Election Commission records and a person familiar with additional payments that weren’t publicly disclosed.

Mr. Mueller in the fall asked Cambridge Analytica to turn over the emails of any of its employees who worked on the Trump campaign, in a sign that the special counsel is probing the campaign’s data operation, The Wall Street Journal reported in December.

Cambridge Analytica Chief Executive Alexander Nix has said he contacted WikiLeaks co-founder Julian Assange through his speaker’s bureau during the 2016 campaign to offer help organizing the Hillary Clinton -related emails the website planned to publish. WikiLeaks last year published a trove of Clinton-related emails that U.S. intelligence agencies later determined had been stolen by Russian intelligence and given to the website. Mr. Assange said he rejected Mr. Nix’s outreach.

Since the 2016 election, Cambridge Analytica largely has departed the American political consulting world. FEC records show it doesn’t have any U.S. political clients, as the data firm has grappled with staff upheaval and complaints from clients that it fell short in delivering services it promised. The firm has defended its work, saying political cycles mean its level of business fluctuates.

— Rebecca Ballhaus contributed to this article.