On Friday, Facebook announced that it had suspended Strategic Communication Laboratories (SCL) and its political data analytics company, Cambridge Analytica, for violating its Terms of Service, by collecting and sharing the personal information of up to 50 million users without their consent. The incident is demonstrative of ways that Facebook’s core business model — delivering individualized ads to users — can be exploited, while raising uncomfortable questions about how such data might have been used to influence the 2016 presidential campaign.

Cambridge Analytica is owned in part by hedge fund billionaire Robert Mercer, and first aided Senator Ted Cruz’s presidential campaign in 2015, before helping the Trump campaign in 2016. It promised to target voters’ “unconscious psychological biases,” by using massive amounts of data develop personality profiles, which could then be used to create extremely specific ads. According to Vox, the Trump campaign brought Cambridge Analytica on in June 2016 to help with its digital operations, headed up by Donald Trump’s son-in-law, Jared Kushner. The campaign later named Steve Bannon — a former vice president of Cambridge Analytica — as campaign manager. Cambridge Analytica employee Christopher Wylie recently passed information to The Observer and described the company’s work as a “grossly unethical experiment,” and said that they exploited Facebook to harvest the personal information of millions of people and “built models to exploit what we knew about them and target their inner demons.”

A Cambridge Analytica employee described the company’s work as a “grossly unethical experiment”

The suspension of the two companies came a day before a pair of reports in the The New York Times and The Observer about how Cambridge Analytica obtained and used the personal information of 50 million users to design voter profiles to target political advertising during the 2016 election. Facebook confirmed that the data came from University of Cambridge psychology professor Dr. Aleksandr Kogan, who created an app called “thisisyourdigitallife,” in 2015, which 270,000 people downloaded. The app gave Kogan permission to access information from the users’ accounts, as well as information about their friends.

Facebook says that “Kogan gained access to this information in a legitimate way and through the proper channels that governed all developers on Facebook at that time,” but then passed the information to SCL / Cambridge Analytica. Former Cambridge employees revealed to the Times that the firms collected information on more than 50 million users without their consent, which the company used as the foundation of “its work on President Trump’s campaign in 2016.”

Upon discovering that the information was being misused, Facebook removed the app and asked for the information to be destroyed in 2016 when it discovered that Kogan had handed the information over to SCL / Cambridge Analytica, orders that both companies say that they complied with. But The Observer says that “Facebook did not pursue a response when the letter initially went unanswered for weeks because Wylie was traveling, nor did it follow up with forensic checks on his computers or storage.” Facebook also did not notify users whose data was used by the company, and disputed the description of the incident as a “breach.”

Facebook reportedly did not follow up to confirm that the data had been deleted

Furthermore, while Cambridge Analytica says that it destroyed the information in question, The New York Times reports that it “still possesses most of all of the trove.” Cambridge Analytica released a statement yesterday saying that it had deleted all of the data, and that it’s working with Facebook to resolve the issue.

The company has been under scrutiny from government officials and regulators over its role in the US presidential election, as well as the UK’s Brexit campaign to leave the European Union in 2015. In December 2017, The Wall Street Journal reported that special counsel Robert Mueller asked that the company to turn over documents pertaining to the Trump campaign as part of his investigation into the role that Russia played during the 2016 presidential election, while the House Intelligence Committee interviewed Cambridge Analytica Chief Executive Alexander Nix. Following Facebook’s suspension of the two companies, Massachusetts attorney general Maura Healey announced on Twitter (via The Hill) that her office was launching an investigation, while other lawmakers said that they would like to see Facebook CEO Mark Zuckerberg testify before congressional committees.

The revelations come after a rocky year for the social media company, which confirmed that political ads from companies backed by the Russian government ran on the site, which were seen by more than 10 million people. Facebook says that the information obtained by Kogan was accessed “in a legitimate way and through the proper channels that governed all developers on Facebook at that time,” and that it has “made significant improvements in our ability to detect and prevent violations by app developers,” in the last five years, requiring developers to justify the use of the data that they collect. But this incident highlights a key feature of Facebook, to utilize personal information to deliver specific advertising to individuals, and only goes to underscore a critical weakness in the American electorate: that this information can not only be used to manipulate an election, but it can be obtained relatively easily, with few checks.