Will government regulate Facebook?

Facebook founder and CEO Mark Zuckerberg greets Sen. Ron Johnson (R-Wisc.) in a Senate hearing room. (Photo credit: Chase Gunter/FCW)

At an April 10 joint hearing of the Senate Committees on the Judiciary and on Commerce, Science and Transportation, Facebook CEO Mark Zuckerberg took an apologetic tone and acknowledged that the social media juggernaut did not do enough to protect users' data.

"We didn't take a broad enough view of our responsibility, and that was a big mistake," he testified. "It will take some time to work through all of the changes we need to make, but I'm committed to getting it right."

Senators on both sides of the aisle suggested that self-policing may no longer be sufficient, but 'the next steps for regulating the tech giant and its brethren remain unclear. 

The five-plus hour hearing, which drew a packed audience and nearly half the Senate, comes in the wake of reports that the analytics firm Cambridge Analytica collected Facebook data on more than 87 million users under misleading pretenses. Facebook did not notify the users whose information was compromised, which Zuckerberg called "a mistake," adding that this was the only third-party privacy violation of which he was aware.

Zuckerberg insisted users now have "complete control" over their data, calling this Facebook's "most important principle."

Sen. John Thune (R-S.D.), however, declared that the environment of self-regulation tech companies have enjoyed to date "may be changing."

Sen. Amy Klobuchar (D-Minn.) asked Zuckerberg if he would support a rule requiring Facebook to notify users about a breach within 72 hours. "That makes sense to me," he responded, but added the specifics would need to be worked out.

When asked how he thought his platform could better protect the data of its more than two billion users, Zuckerberg offered several proposals centered on self-regulation — namely, an investigation of every app used on Facebook, more-regular reviews of apps, deploying AI tools to combat fake accounts and false information, and employing more than 20,000 security workers by the end of 2018.

He also testified that "every advertiser" on Facebook will have to have their identity and location confirmed before running political or issue ads on the site, and that the company will label the ads and advertisers will have to show who paid for them.

Those proposals failed to satisfy several senators. Among the biggest sticking points were the complex, lengthy privacy agreements and the lack of clarity about what happens to information posted to Facebook.

"We've seen the apology tours before," said Sen. Richard Blumenthal (D-Conn.), who pointed to past apologies made by Zuckerberg as well as regulatory efforts to improve Facebook's privacy policies.

"I think legislation is necessary," Blumenthal said. "The rules of the road have to be the result of congressional action."

Several Republicans also expressed a willingness to write regulations for major tech companies. 

Sen. Lindsey Graham (R-S.C.) pointed out that because Facebook lacks a direct competitor, 'government may need to step in. Judiciary Chairman Chuck Grassley (R-Iowa) said policies for data privacy and security "must keep pace" with the technological developments and "be tethered to consumer needs and expectations."

"Consumers ought to have clearer information, not opaque policies and complex click-to-consent pages," Grassley said.

"I don't want to regulate Facebook, but by God, I will," said Sen. John Kennedy (R-La.). "There are going to be a whole bunch of bills to regulate Facebook, and it's up to you whether they're passed or not."

However, what these regulations might look like remains unclear. One legislative proposal that both Facebook and Twitter have publicly backed is the Honest Ads Act, which would require sites with 50 million or more unique U.S. visitors per month to disclose information about any ads purchased on their sites in excess of $500. The bill has yet to make it out of committee.

On the same day as the hearing, Sens. Blumenthal and Ed Markey (D-Mass.) introduced the Customer Online Notification for Stopping Edge-provider Network Transgressions Act, which would require sites like Facebook and Google to obtain opt-in consent before using or sharing users' personal data. The CONSENT Act would also require such sites to notify users about all personal information they collect, and to as notify users in the event of a breach.