Status update: How Facebook is dealing with a year's worth of crises
A full year after the Cambridge Analytica scandal pushed Facebook's data-gathering practices into the spotlight, the social network is still struggling to show it can take users' privacy seriously while maintaining substantial profits -- $22 billion on $56 billion in revenue last year -- that rely on selling user access to advertisers. Investigations that started in the wake of Cambridge continue, and legal challenges have multiplied, accusing Facebook of ignoring its most controversial impacts on society in a push to boost its bottom line.
Here is a running update of Facebook's status on matters of data privacy and its various legal dealings with state, federal and private parties.
Fake account purges
May 16, 2019: 265 fakes removed
Facebook said it has taken down 265 Facebook and Instagram pages, groups or events that were part of an Israel-based campaign to disrupt foreign elections. These fakes were focused on Nigeria, Senegal, Togo, Angola, Niger and Tunisia, with some activity in Southeast Asia as well, Facebook said.
The phony content included 65 Israeli Facebook accounts, 161 pages, dozens of groups and four Instagram accounts, Nathaniel Gleicher, Facebook's head of cybersecurity policy, told the Associated Press.
The fakes posted content about upcoming elections and criticism of politicians, including one post mocking 2018 Congolese presidential candidate Martin Fayulu for crying foul in the elections that vaulted an opponent to victory. Many governments and watchdog groups condemned the elections as rigged and declared Fayulu the rightful winner.
The fakes spent $812,000 on ads and reached more than 2.8 million accounts on Facebook and 920 people on Instagram, while more than 5,500 Facebook accounts joined one of the fake groups, the social media company said.
Facebook linked some of these fakes to the Archimedes Group, a company based in Israel that calls itself a consulting firm involved in "Large Scale Campaigns Worldwide," according to its website. The site says the company has its "own unique field within the social media realm" and tries to "take every advantage available in order to change reality according to our client's wishes."
The Archimedes Group is a repeat offender, Facebook said. As a result, the firm and its subsidiaries have been banned from the platform, according to Facebook's blog post.
Archimedes Group did not immediately reply to a request for comment submitted through its website.
April 1, 2019: 1,100 fakes removed
Ahead of the Indian elections starting April 11, Facebook said it took down more than 1,100 fake pages and accounts based in India and Pakistan. About 100 of these accounts were on both Facebook and Instagram, with a combined follower count of 2.8 million, Facebook said. The accounts posted about Pakistani general interest topics, Kashmir community issues and local and political news, according to Facebook. "Although the people behind this activity attempted to conceal their identities, our investigation found that it was linked to employees of the ISPR (Inter-Service Public Relations) of the Pakistani military," Facebook said.
The company removed 687 accounts linked to Indian IT firm Silver Touch. A "majority" of these accounts had already been suspended by Facebook's AI systems, the company said. More than 300 other pages and accounts were taken down for spamming, Facebook said.
March 27, 2019: 2,600 fakes removed
Facebook said it took down more than 2,600 items on Tuesday, March 27, the latest salvo in the social media giant's efforts to quash "inauthentic behavior" on its platform. That term can encompass a range of activities from spam to trolling.
The 2,632 items included accounts, pages and groups active on Facebook and Instagram, the company said. More than 1,900 were Russian accounts that posted spam, such as ads for remote work, as well as some articles on the conflict in Eastern Ukraine. About 500 accounts were tied to Iran and posted content that looked like media or news reports, while about 200 accounts run from Macedonia and Kosovo posted astrology news, celebrity content and beauty tips.
In its post, Facebook said it was cracking down on this type of activity "because we don't want our services to be used to manipulate people." The company emphasized that it was taking issue with the "behavior" of the accounts--coordinating with each other and misrepresenting who they were--rather than the content they posted.
So far this year, Facebook has taken down accounts linked to the U.K., Romania, Moldova and Indonesia. The social-media giant has come under fire for allowing rampant misinformation and spam on its platform in 2016, a year when the U.K. was voting whether to leave the European Union and Americans were electing a new president.
Still not good with data
WhatsApp hacked
May 13 -- WhatsApp, the Facebook-owned messaging service, was the target of a sophisticated hack that put spyware on the phones of dozens of people, the company confirmed to CBS News late Monday. A spokesman said Facebook was "very concerned" about potential abuse of the platform and said the company was speaking with U.S. law enforcement.
Human rights groups raised an outcry over the revelations since the spyware, developed by the Israeli intelligence firm NSO Group, has been used in the past to hack journalists, lawyers, human rights activists and dissidents.
NSO Group, which says its software is used to counter terrorism, told CBS News in a statement that it couldn't be held responsible for what its customers did with its products, and that the company itself did not engage in hacking.
WhatsApp has issued a software fix for the issue that enabled the hacking, the spokesperson said.
Password problems
April 18 -- On the day that the highly anticipated Mueller report was released in redacted form in Washington, D.C., Facebook chose to quietly reveal that a prior password flub was much bigger than it initially said. The social-media giant updated a blog post from March 21 to note that "millions" of Instagram users had their passwords stored in plain text on an internal server. It previously said that "tens of thousands" of Instagram users were affected, along with millions of Facebook and Facebook Lite users.
On March 21, Facebook admitted it had stored millions of user passwords in plain text for years. The announcement came after security researcher Brian Krebs posted about the issue online.
The company said it discovered the flub "as part of a routine security review" in February. The non-encrypted passwords were stored on internal company servers and not accessible to outsiders, the company said. It also said there is no evidence that employees "abused or improperly accessed" the data. But the incident reveals a huge oversight for the company amid a slew of bruises and stumbles in the last couple of years.
The security blog KrebsOnSecurity said some 600 million Facebook users may have had their passwords stored in plain text. Facebook said it would likely notify "hundreds of millions" of Facebook Lite users, millions of Facebook users and tens of thousands of Instagram users.
Trying to sell data?
April 16 -- "We don't sell people's data" is a favored Facebook response anytime lawmakers question the vast amounts of information the company gathers on its users. But according to an extensive NBC News investigation, the company often used its users' data as a bargaining chip to bolster its own business.
Facebook allowed Amazon, which spent money to advertise on the platform, extensive access to user data, NBC reported. But it considered cutting off a messaging app that it saw as a rival service because it had gotten too popular, the report reads.
According to the report, "the company came up with several ways to require third-party applications to compensate Facebook for access to its users' data, including direct payment, advertising spending and data-sharing arrangements."
It has been previously reported that Facebook considered selling user data, but ultimately decided against that strategy. In response to the NBC story, Facebook said the documents were incomplete and "cherry-picked" information.
April 3 -- As many as one-quarter of Facebook's users likely had their information exposed on an Amazon server, a cybersecurity research firm said.
More than 540 million records about Facebook users were publicly exposed on Amazon's cloud computing service, according to a report out April 3 from UpGuard. The report said that two third-party Facebook app developers posted the records in plain sight, causing yet another major data breach for the world's biggest social network.
UpGuard said that it alerted the two companies responsible, but no action was taken until the report's release.
Housing discrimination through ads alleged
March 28 -- Facebook settled job-discrimination charges, but so far it hasn't been able to reach a similar settlement over housing. Last August, the U.S. Department of Housing and Urban Development filed an administrative complaint over Facebook's housing ads. On March 28, HUD charged Facebook with violating the Fair Housing Act, which prohibits discrimination in housing based on race, sex, color, national origin, disability, religion or family status.
HUD said the social media giant sold targeted ads that allowed landlords and other advertisers to exclude certain groups, such as parents and immigrants. HUD also claims Facebook allowed advertisers to exclude people who live in certain neighborhoods as well as display ads only to women or to men.
"Using a computer to limit a person's housing choices can be just as discriminatory as slamming a door in someone's face," HUD Secretary Ben Carson in a statement.
Content moderators see small reprieve
May 13 -- Earlier this year, Facebook drew fire over media reports about inadequate pay and difficult working conditions faced by its content moderators, many of whom were legally employed by intermediary companies to do work on Facebook's platform. Now the company has said it's raising the pay for those workers from $15 an hour in some cities to a minimum of $18 nationwide.
Facebook also said it would allow moderators to "temporarily blur graphic images by default before reviewing them." It also require its vendors to provide on-site counseling "during all hours of operations, not just certain hours of each shift."
The company announced a pay raise for certain other contract employees working in New York, Washington, D.C., Seattle and the Bay Area, in order to keep pace with higher costs of living in those areas.
Company consolidates while others talk breakups
Some early supporters of Facebook are now speaking out against the company:
May 9 -- Facebook co-founder Chris Hughes penned a searing New York Times op-ed calling for the breakup of the social media company that he helped start in a Harvard dorm room with Mark Zuckerberg over a decade ago . "Mark's power is unprecedented and un-American," Hughes wrote. "It is time to break up Facebook."
Hughes argued that Facebook has become a "powerful monopoly" and likened the company to AT&T's monopoly of the phone business in the 1980s, saying the breakup of the telecommunications giant led to decades of innovation in the industry.
While Facebook is arguing for tougher regulations on the Internet, Hughes suggested regulators separate Instagram and WhatsApp from the core Facebook operations. Shareholders could initially hold stock in the three new public companies, but Hughes argued Zuckerberg and other executives should divest their management shares.
Hughes also said regulators should bar Facebook from any acquisitions for several years.
Feb 4 -- Roger McNamee, an early backer who says the investment has earned him millions, now holds that the social network is "terrible for America." In his book "Zucked," published in January, McNamee calls for breaking up the company (a position that's been echoed up by several 2020 presidential contenders).
At the same time, Facebook is making moves that would make a breakup of the company more difficult, according to privacy advocates. The company announced it would consolidate Facebook Messenger, WhatsApp and Instagram under one messaging system, in what it describes as a pivot to one-on-one and private messaging. However, privacy advocates are skeptical of the company's motivations.
"I think they're doing it to try to fend off regulation in both the competition and privacy areas," Christine Bannan, consumer protection counsel at the Electronic Privacy Information Center, previously told CBS News.
Facebook also faces an executive brain drain as part of the pivot. Its chief product officer, Chris Cox, and the head of WhatsApp, Chris Daniels, both announced their departure in the wake of Facebook's refocus on private messaging.
Co-founder: Zuckerberg is kind, but too powerful
May 10 -- Facebook co-founder Chris Hughes said he's been friends with Mark Zuckerberg for over a decade. But now Hughes is speaking out against Zuckerberg and the company he helped create.
"Mark is a good, kind person," Hughes told "CBS This Morning" on Friday about his old friend. "He has too much power."
Hughes wrote in a New York Times opinion piece Thursday he's angry that, in his view, Zuckerberg's "focus on growth led him to sacrifice security and civility for clicks." Hughes said Friday that Facebook was a monopoly that needed to be broken up.
"Just like we've done with Standard Oil, AT&T, we say, 'This is a monopoly, the market is frozen, there is no competition and there is no accountability,'" Hughes said. "And the government needs to step in and break it up."
Hughes said users have virtually no place to go on social media except Facebook and more competition would help hold the company accountable.
May 2 -- Facebook continues to remove personalities from its platform. On Thursday it banned Alex Jones, Milo Yiannopoulos, Laura Loomer, Paul Joseph Watson, Paul Nehlen, Louis Farrakhan and InfoWars for violating its policies against "dangerous individuals and organizations."
The ban includes the removal of Pages and Groups representing the users. It also extends to Facebook's other services and platforms, including Instagram.
In a statement, the company said: "We've always banned individuals or organizations that promote or engage in violence and hate, regardless of ideology. The process for evaluating potential violators is extensive and it is what led us to our decision to remove these accounts today."
April 8 -- Facebook has banned a handful of Canadian far-right activists from its platform, including Faith Goldy, Kevin Goudreau and a handful of others who have been described as white supremacists. Canadian government officials praised the move.
Immigration Minister Ahmed Hussen drew a line between Facebook-enabled hate speech and the shootings in Pittsburgh and in Christchurch, New Zealand, which were carried out by white terrorists.
"We've seen hate speech fuel the attack against Pittsburgh, at the synagogue. We've seen more recently in Christchurch worshipers gunned down. This is real and it has consequences. And we're very glad that Facebook has taken the actions that it has," he said at a press conference.
March 27 -- Facebook is banning white separatism and white nationalism from its network, the company said. It's the most sweeping move against supremacist ideologies the company has taken.
"Today we're announcing a ban on praise, support and representation of white nationalism and separatism on Facebook and Instagram, which we'll start enforcing next week. It's clear that these concepts are deeply linked to organized hate groups and have no place on our services," Facebook announced in a blog post.
The announcement comes two weeks after a white nationalist sympathizer in New Zealand carried out a mass shooting that killed more than 50 people, which he live-streamed on the platform. The social media giant has come under fire for enabling the spread of hate speech and Nazi and separatist ideologies.
While Facebook has long banned what it calls white supremacy, it has long put "white nationalism" and "white separatism" in a different bucket, Vice reported earlier this year. Civil rights historians say those ideologies are identical to white supremacy.
Critics have "raised these issues to the highest levels at Facebook (and held) a number of working meetings with their staff as we've tried to get them to the right place," Kristen Clarke, president and executive director of the Lawyers' Committee for Civil Rights Under Law, told the Associated Press.
"This is long overdue as the country continues to deal with the grip of hate and the increase in violent white supremacy," she said. "We need the tech sector to do its part to combat these efforts."
Facebook said it changed its policies after speaking with academics and experts in "race relations" and reviewing what it knew about hate groups.
"Our policies have long prohibited hateful treatment of people based on characteristics such as race, ethnicity or religion - and that has always included white supremacy. We didn't originally apply the same rationale to expressions of white nationalism and separatism because we were thinking about broader concepts of nationalism and separatism - things like American pride and Basque separatism, which are an important part of people's identity," the company said. "Going forward, while people will still be able to demonstrate pride in their ethnic heritage, we will not tolerate praise or support for white nationalism and separatism."
Enforcement is key to effectively suppressing these ideologies, and in that area, Facebook's record has been inconsistent, internet experts say. After the New Zealand shooter's live-stream, more than a million copies of the video were uploaded to the platform en masse, and some of those evaded the company's screening tools. Facebook has also allowed advertisers to target anti-Semites and neo-Nazis on its platform as late as last month.
Governments want answers
Canada's Parliament wants answers
May 8 -- A committee in Canada's Parliament voted unanimously Tuesday evening to take the rare step of issuing a subpoena demanding appearances from Facebook CEO Mark Zuckerberg and COO Sheryl Sandberg. Bob Zimmer, chair of Canada's Standing Committee on Access to Information, Privacy and Ethics, said in a phone call with CBS News that the subpoena can only be enforced if the Facebook executives step foot on Canadian soil.
"We're hoping this shows them we're serious. There are representatives from 10 countries now who want to hear from them," Zimmer said.
The move comes after Zuckerberg ignored repeated requests to address both a Canadian committee investigating disinformation and election meddling on the social media platform, as well as an "International Grand Committee" of legislative investigators from 10 nations set to gather in Ottawa May 28.
"The next escalation would be to submit to the full Parliament a motion to hold them in contempt," Zimmer said.
Banned in Sri Lanka
April 22 -- Following Easter Sunday attacks in Sri Lanka that killed hundreds of people, the country's authorities shut off most social media. Facebook and its WhatsApp and Instagram services were affected, along with YouTube, Snapchat and Viber, according to the NetBlocks observatory, which monitors internet disruptions. Twitter appeared unaffected.
The government announced the social-media crackdown via its official news portal. It cited the spread of "false news reports" online as a justification. Officials likely feared that the spread of inflammatory content could provoke even more bloodshed in Sri Lanka, a Buddhist-majority island nation that has large Hindu, Muslim and Christian minorities and a long history of ethnic and sectarian conflict, the Associated Press reported.
"No social media company has said that they are unable to affix good information and true information to viral information," CNET Senior Producer Dan Patterson told CBS News. When social media companies previously tried to manage viral information in the wake of disasters, the results have been mixed, Patterson noted.
Ivan Sigal, head of the internet and journalism advocacy organization Global Voices, said the country's rapid action was a "telling moment."
"A few years ago we'd be using these platforms to help each other and coordinating assistance. Now we view them as a threat," he wrote on Twitter.
It wasn't the first time Sri Lanka has blocked social media. The government imposed a weeklong ban in March 2018 because of concerns that WhatsApp and other platforms were being used to fan anti-Muslim violence in the country's central region.
But NetBlocks said post-attack blackouts can be ineffective. "What we've seen is that when social media is shut down, it creates a vacuum of information that's readily exploited by other parties," said Alp Toker, executive director of the London-based group. "It can add to the sense of fear and can cause panic."
"That's going to be a problem for people trying to communicate with friends and family," Toker said. He added that some internet users are circumventing the social media blocks by using a virtual private network, which masks a computer's location.
An analysis by Sri Lankan researcher and author Yudhanjaya Wijeratne of thousands of Facebook posts made during last year's ban found that many Sri Lankans simply found ways around it.
Wijeratne has recommended narrower and more "technically challenging" approaches to curbing hate speech, such as better detection and strengthening local laws.
Facebook said it was aware of the Sri Lankan government's statement. "People rely on our services to communicate with their loved ones and we are committed to maintaining our services and helping the community and the country during this tragic time," the company said.
-- The Associated Press contributed to this report.
Securities fraud lawsuit brought over Cambridge Analytica
May 1 -- A Facebook investor has filed a lawsuit against Mark Zuckerberg and the members of Facebook's board, accusing them of committing insider trading and securities fraud in their handling of the company's privacy scandals. These actions damaged the company "in the name of short-term profit," charged the suit, which was filed on behalf of Robert Feuer in Delaware Chancery Court.
The lawsuit focuses on the duties Facebook's directors may have had to disclose how the company collected and shared user data. In the months after the Cambridge Analytica story broke, revealing that Facebook had collected data in violation of an agreement it reached with the FTC, Facebook failed to disclose details of its data collection to investors, the lawsuit said.
"This concealment has severely damaged Facebook's reputation and imposed significant costs on Facebook, including costs due to the massive amounts of regulatory interest, inquiries, and investigations commenced in the wake of the Cambridge Analytica scandal. In addition, the Company has suffered a loss of user trust, harm to its core advertising business, and other damages," the lawsuit read.
The suit also accuses Zuckerberg, COO Sheryl Sandberg and former WhatsApp CEO Jan Koum of selling millions of dollars worth of company stock prior to the public disclosure of the Cambridge Analytica problems.
In an emailed statement, a Facebook spokesperson said the lawsuit was "without merit."
Federal probes and penalties
FTC tab: $5 billion, plus oversight
May 2 -- As Facebook approaches a settlement with the Federal Trade Commission over its data-sharing practices, some details are emerging on the nature of the deal. Politico reported today that the FTC is considering putting "a federally approved privacy official at the social network" and creating an "independent" privacy oversight committee, citing an unnamed source.
Oversight would be in addition to the multibillion-dollar fine previously reported elsewhere. All details of the settlement are liable to change until a deal is announced, however.
Facebook did submit to semiannual audits by an outside party as part of its 2011 privacy consent decree with the FTC. Those audits, however, failed to catch the data collection by Cambridge Analytica.
April 24 -- When reporting its earnings for the first quarter of 2019, Facebook revealed that it had set aside $3 billion for the resolution of an FTC probe into the company's data collection practices that opened last year. It estimated the total cost of the probe at $3 billion to $5 billion.
The company's executives declined to comment more on the probe in a call with investors.
A $3 billion fine would be the largest the FTC has ever imposed. It would represent about 13 percent of Facebook's $22 billion in profits in 2018.
March 25 -- It's not just Cambridge Analytica. In addition to that scandal, many of Facebook's data-collection practices have come under scrutiny.
The New York Times reported this month that federal prosecutors are looking into Facebook's data-sharing deals with technology companies. In those agreements, which the Times revealed in December, Facebook gave developers deeper access to users' data than it publicly said it did. The full scope of the investigation is unknown, but a New York grand jury subpoenaed records from two smartphone makers, according to the Times.
Meanwhile, the criminal and civil investigations launched in the wake of Cambridge Analytica remain unresolved. The Department of Justice, Securities and Exchange Commission and Federal Trade Commission are all investigating Facebook's agreements.
In a statement, Facebook confirmed "that there are ongoing federal investigations, including by the Department of Justice. As we've said before, we are cooperating with investigators and take those probes seriously. We've provided public testimony, answered questions, and pledged that we will continue to do so," the company said.
Billion-dollar fines
Separately from its potential criminal liabilities, Facebook is reportedly discussing a multibillion-dollar settlement with the Federal Trade Commission over its Cambridge Analytica deals. The FTC reached an agreement with Facebook in 2012 under which Facebook promised to take safeguards with its users' personal data. Revelations that it had sold millions of users' data without their consent to a purported research, however, put in question whether it was abiding by those terms.
The Washington Post reported last month that the two parties are discussing a fine of several billion, which would be the largest the FTC ever imposed on a tech company. The biggest payment the FTC has ever demanded from a company was $22.5 million, from a 2012 settlement with Google over alleged privacy violations in the Safari browser.
U.K. to Facebook: Regulations are coming
April 8 -- Britain's government announced a plan to create the world's first independent regulator to protect users from "online harms." In a more than 100-page white paper outlining the plan, which must first be approved by Parliament, the government said the new agency will impose a "duty of care" on social media, search, messaging and even file-sharing platforms, requiring them to ensure a range of illegal or abusive content can't be shared.
It would be the world's first such agency, and internet giants could face enormous fines if they fail to prevent the spread of harmful material, and senior management could face legal consequences if found to be negligent.
In a statement to CBS News, Facebook seemed open to increased regulation.
"We have responsibilities to keep people safe on our services and we share the government's commitment to tackling harmful content online," said Rebecca Stimson, Facebook's Head of U.K. Public Policy. "As Mark Zuckerberg said last month, new regulations are needed so that we have a standardized approach across platforms and private companies aren't making so many important decisions alone."
However, other social media and tech behemoths may be less amenable to the new agency. A spokesperson for an industry lobbying group founded in 2012 by Google, Amazon, eBay, and Facebook, criticized the announcement as vague in a statement to CBS News.
"The scope of the recommendations is extremely wide, and decisions about how we regulate what is and is not allowed online should be made by parliament." said Daniel Dyball, the Internet Association's U.K. executive director.
Celebrity defections
AOC deletes Facebook
April 15 -- Alexandria Ocasio-Cortez said that she's given up on Facebook, citing its negative health impact on small children and the elderly. The freshman Democrat from New York started her election campaign on Facebook and is considered among the most social media savvy people working in Washington, D.C.
" Facebook was my primary digital organizing tool for a very long time. I gave up on it," Ocasio-Cortez said on the Yahoo News podcast Skulduggery. She added that she tries to stay off social media on weekends and sets time limits for her Twitter and Instagram use. (Facebook owns Instagram.)
The past year has seen a steady trickle of Facebook defectors, including high-profile users like Tesla CEO Elon Musk and tech journalist Walt Mossberg. The social network suffered a drop in users in Europe and North America, which it regained by the end of last year.
At least one thing is settled
March 20 -- Facebook settled a lawsuit this week that accused the company of enabling discrimination in housing, job and credit ads, which is against the law. The settlement involves the largest overhaul of Facebook's advertising system since its inception.
That targeted advertising system is the company's major revenue driver. Under the settlement, which took 18 month to reach, Facebook will no longer allow ads for jobs, housing or credit to target users by their gender, ZIP code or age, and will include other protections for characteristics including race, national origin and sexual orientation.
Zuckerberg: Please regulate me
April 1 -- After years of resisting regulation of the tech industry and his company, Facebook CEO Mark Zuckerberg has penned an op-ed asking for more government oversight. In a Washington Post piece on Saturday titled "The Internet needs new rules," Zuckerberg called for government oversight in the areas of harmful speech, election interference, privacy and control over users' data.
Facebook's global scale means "we have a responsibility to keep people safe on our services. That means deciding what counts as terrorist propaganda, hate speech and more," he wrote, "but at our scale we'll always make mistakes and decisions that people disagree with." Referencing Facebook's struggles with disclosing political advertisers, he called for laws creating "common standards for verifying political actors."
"And there are also important questions about how political campaigns use data and targeting. We believe legislation should be updated to reflect the reality of the threats and set standards for the whole industry," he wrote. Zuckerberg also called for expanding Europe's privacy law, known as GDPR, around the world and making it easier for users to move their data from one online platform to another.
"Facebook isn't the only one doing it. Most of these big tech companies understand that regulation is coming and they want to take part in shaping how that regulation actually looks," CNET executive editor Roger Cheng told CBS News. Democratic senators and state attorneys general have been calling for regulations on Facebook since well before the Cambridge Analytica scandal, Cheng said, but the split control of Congress has hampered any actual law-making.
Someone at Facebook knew about Cambridge
March 22 -- Court documents cast into doubt Facebook's narrative that the company was just as much a victim of Cambridge Analytica's unsavory data practices as the 50 million user who the company manipulated. At least some Facebook employees were aware of Cambridge's data practices and warned Facebook about them, court documents filed last week reveal.
The warning supposedly happened in September 2015, whereas Facebook executives maintain that they first learned about Cambridge's data scraping months later, in December 2015. Facebook spokespeople acknowledged the September warning to CBS News, but dismissed it as "speculation."
The revelations came as part of a lawsuit filed by the Washington, D.C. attorney general. The suit claims that Facebook had a misleading privacy policy in the runup to the 2016 elections.