What's at stake for Facebook's Mark Zuckerberg as he testifies for Day 2

Mike Snider | USA TODAY

As Facebook CEO Mark Zuckerberg makes his first appearances before Congress Tuesday and Wednesday, lawmakers want more information about how the social network allowed the possible misuse of data belonging to 87 million Facebook users — and what steps are being taken to prevent it in the future.

This is the second recent wave of hearings involving Facebook. Executives from Facebook, Google and Twitter testified before Senate and House Intelligence Committees in November 2017 about possible Russian manipulation of U.S. social media during the 2016 election campaigns. Zuckerberg was not among the witnesses then.

In a five hour hearing Tuesday, Zuckerberg fielded questions on why Facebook hadn't done more to protect its consumers' data, accusations it was a "virtual monopoly" and threats to more heavily regulate the huge social network.

Already in the legislative hopper: the "Honest Ads Act," which would require social media companies to disclose who is buying political ads on their services.

More: 6 takeaways from CEO Mark Zuckerberg's Senate testimony on data breaches

More: Mark Zuckerberg went from millionaire to billionaire in one year

Could Facebook face other regulation or penalties? Here's a look at what could be at stake for the social network, which has more than 2.1 billion monthly active users:

•Regulations. If lawmakers are not satisfied with Zuckerberg's apology and promises to improve users' data protection, they could threaten legislation. Just as President Trump has attacked Amazon for being too big, Facebook and Google have become monoliths, too. The two firms are expected to dominate the $90 billion U.S. digital advertising market, capturing more than two-thirds in 2018, estimates research firm eMarketer.

That dominance has already gotten the notice of antitrust regulators in the European Union, where Germany's Federal Cartel Office is looking into possible misuse of its data practices. If Facebook poses a dominant and unrestricted data risk to users, legislators may be compelled to act.

And the May 25 adoption of new EU data rules called the General Data Protection Regulation (GDPR), which gives users the right to have their data destroyed, could add to momentum in the U.S. Congress.

Already on Tuesday, Democratic Senators Ed Markey, D-Mass., and Richard Blumenthal, D-Conn., introduce a consumers' privacy bill of rights to that would require companies such as Facebook get opt-in consent from users to use, share, or sell their personal data.

"The avalanche of privacy violations by Facebook and other online companies has reached a critical threshold, and we need legislation that makes consent the law of the land," Markey said in a statement.

On Tuesday, Zuckerberg would not commit to a proposal that would require the social media giant to automatically let users “opt out” of having their data collected or shared.

More: Web companies should make it easier to make your data portable: FTC's McSweeny

More: Did Zuckerberg just suggest a paid, ad-free version of Facebook?

More: Senators to Zuckerberg: We may need to regulate Facebook to protect privacy

So far, regulators have avoided taking action over technology firms for the fear of thwarting innovation. But as the missteps gain in significance that may require rethinking, says William Kovacic, a professor of law at George Washington University and a former member of the Federal Trade Commission, which he chaired from March 2008 to March 2009.



"A big question in this area has been whether there would be an event that was so dramatic and breathtaking that it was the equivalent of the (1989) Exxon Valdez oil spill or the Deepwater Horizon blowout in the Gulf of Mexico, something so dramatic that it would almost compel some form of legislative response," he said. "It hasn’t happened yet even though there have been some serious data breaches over the last five years or so. The affected firms have done a good job of saying, ‘Trust us. We will fix it. We will take steps to cure the problems, to fix the weaknesses'."

•Public opinion. Worries about how Facebook uses their data could drive some current Facebook frequenters to abandon the social network. Several big-name Facebookers have recently defected including Cher, Elon Musk, Will Ferrell and Steve Wozniak.

And many users are in favor of some government regulation. More than half (55%) of Americans say that government doesn't do enough to regulate tech companies, an Axios-SurveyMonkey poll found in February. That's up from 40% in November 2017.

•Market cap. Facebook has seen its market value plummet in recent weeks. The company has seen its market cap shed more than $80 billion since the start of February. At that point, the company's market cap was $561 billion; at Tuesday's market close, Facebook's market cap was $479.4 billion, according to Bloomberg.

•Penalties. Two weeks ago, the FTC said it had begun investigating whether Facebook violated a 2011 consent decree to protect users' privacy. That settlement requires Facebook to notify users and get explicit permission before sharing their personal information beyond the limits in their privacy settings. Each violation of the agreement would cost Facebook up to $40,000 a day — potentially, a maximum fine in the trillions.

"So if you have a million people who were affected by this that is a million times 40,000 just for starters and as you know they have lots of users. So depending on what took place you can run up a big tab in a hurry," Kovacic said.

Traditionally, the FTC will settle these type of cases because proving consent decree violations is difficult, says Woodrow Hartzog, professor of law and computer science at Northeastern University. But this situation with Facebook could be different, he says. "We can learn a lot from watching what happens after FTC reaches the conclusion of its investigation."

In past major privacy incidences, "people get upset and then the company apologizes and everybody goes about their business," Hartzog said. "I don’t know if this is a noxious enough combination of risky data behavior, combined with a radioactive political environment, combined with people getting fed up with the apologies from companies like Facebook or not."

Follow USA TODAY reporter Mike Snider on Twitter: @MikeSnider.