Facebook CEO Mark Zuckerberg testifies before Senate

Facebook CEO Mark Zuckerberg gives his testimony regarding Cambridge Analytica and Facebook's handling of user privacy before Senate committee.

Sen. Chuck Grassley: Committees on the Judiciary and Commerce, Science, and Transportation will come to order. We welcome everyone to today's hearing on Facebook's social media privacy and the use and and abuse of data. Although not unprecedented, this is a unique hearing. The issues we will consider range from data privacy and security to consumer protection and the Federal Trade Commission enforcement, touching on jurisdictions of these two committees. We have 44 members between our two committees, that may not seem like a large group by Facebook standards, but it is significant here for a hearing in the United States Senate. We will do our best to keep things moving efficiently given our circumstances. We will begin with opening statements from the chairman and ranking members of each committee starting with Chairman Thune and then proceed with Mr. Zuckerberg's opening statement. We will then move on to questioning. Each member will have five minutes to question witnesses. I'd like to remind the members of both committees that time limits will be, and must be, strictly enforced given the numbers that we have here today. If you're over time, Chairman Thune and I will make sure to let you know. There will not be a second round as well. Of course there will be the usual follow up written questions for the record. Questioning will alternate between majority and minority and between committees. We will proceed in order based on respective committee seniority. We will anticipate a couple of short breaks later in the afternoon. And so it's my pleasure to recognize the Chairman of the Commerce Committee, Chairman Thune, for his opening statement.

Sen. John Thune: Thank you Chairman Grassley. Today's hearing is extraordinary. It's extraordinary to hold a joint committee hearing. It's even more extraordinary to have a single CEO testify before nearly half of the United States Senate. But then Facebook is pretty extraordinary. More than 2 billion people use Facebook every month. 1.4 Billion people use it every day — more than the population of any country on earth except China and more than four times the population of the United States. It's also more than 1500 times the population of my home state of South Dakota. Plus, roughly 45% of American adults report getting at least some of their news from Facebook. In many respects, Facebook's incredible reach is why we're here today. We're here because of what you, Mr. Zuckerberg, have described as a breach of trust. A quiz app used by approximately 300,000 people led to information about 87 million Facebook users being obtained by the company, Cambridge Analytica. There are plenty of questions about the behavior of Cambridge Analytica and we expect to hold a future hearing on Cambridge and similar firms. But as you said, this is not likely to be an isolated incident — a fact demonstrated by Facebook's suspension of another firm just this past weekend. You've promised that when Facebook discovers other apps that had access to large amounts of user data, you will be ban them and tell those affected. And that's appropriate. But it's unlikely to be enough for the two billion Facebook users. One reason that so many people are worried about this incident is what it says about how Facebook works.

The idea, that for every person who decided to try an app, information about nearly 300 other people was scraped from your services, to put it mildly, disturbing. And the fact that those 87 million people may have technically consented to making their data available doesn't make most people feel any better. The recent revelation that malicious actors were able to utilize Facebook's default privacy settings to match email addresses and phone numbers found on the so-called Dark Web to public Facebook profiles, potentially affecting all Facebook users, only adds fuel to the fire. What binds these two incidents is that they don't appear to be caused by the kind of negligence that allows typical data breaches to happen. Instead they both appear to be the result of people exploiting the very tools that you've created to manipulate users' information. I know Facebook has taken several steps and intends to take more to address these issues. Nevertheless, some have warned that the actions Facebook is taking to ensure that third parties don't obtain data from unsuspecting users, while necessary, will actually serve to enhance Facebook's own ability to market such data exclusively. Most of us understand that whether you're using Facebook, or Google, or some other online services, we are trading certain information about ourselves for free or low-cost services. But for this model to persist, both sides of the bargain need to know the stakes that are involved. Right now I'm not convinced that Facebook's users have the information that they need to make meaningful choices. In the past, many of my colleagues on both sides of the aisle have been willing to defer to tech companies efforts to regulate themselves. But this may be changing.

Just last month, in overwhelming bipartisan fashion, Congress voted to make it easier for prosecutors and victims to go after web sites that knowingly facilitate sex trafficking. This should be a wakeup call for the tech community. We want to hear more, without delay, about what Facebook and other companies plan to do to take greater responsibility for what happens on their platforms. How will you protect users data? How will you inform users about the changes that you are making? And how do you intend to proactively stop harmful conduct instead of being forced to respond to it months or years later? Mr. Zuckerberg, in many ways, you and the company that you created — the story that you've created — represent the American dream. Many are incredibly inspired by what you've done. At the same time, you have an obligation and it's up to you to ensure that that dream doesn't become a privacy nightmare for the scores of people who use Facebook. This hearing is an opportunity to speak to those who believe in Facebook and to those who are deeply skeptical about it. We are listening, America's listening, and quite possibly the world is listening, too.

Sen. Chuck Grassley: Thank you, now ranking member Feinstein.

Sen. Dianne Feinstein: Thank you very much Mr. Chairman, Chairman Grassley, Chairman Thune, thank you both for holding this hearing. Mr. Zuckerberg thank you for being here. You have a real opportunity this afternoon to lead the industry and demonstrate a meaningful commitment to protecting individual privacy. We have learned over the past few months, and we've learned a great deal that's alarming. We've seen how foreign actors are abusing social media platforms like Facebook to interfere in elections and take millions of Americans' personal information without their knowledge in order to manipulate public opinion and target individual voters.

Specifically, on February 16, Special Counsel Muller issued an indictment against the Russia-based Internet Research Agency and 13 of its employees for interfering operations targeting the United States. Through this 37-page indictment, we learned that the IRA ran a coordinated campaign through 470 Facebook accounts and pages. The campaign included ads and false information to create discord and harm Secretary Clinton's campaign and the content was seen by an estimated 157 million Americans. A month later, on March 17, news broke that Cambridge Analytica exploited the personal information of approximately 50 million Facebook users without their knowledge or permission. And last week we learned that number was even higher. 87 million Facebook users who had their private information taken without their consent. Specifically, using a quiz he created, Professor Kogan collected the personal information of 300,000 Facebook users and then collected data on millions of their friends. It appears the information collected included everything these individuals had on their Facebook pages. And according to some reports, even included private direct messages between users. Professor Kogan is said to have taken data from over 70 million Americans. It has also been reported that he sold this data to Cambridge Analytica for eight hundred thousand dollars. Cambridge Analytica then took this data and created a psychological welfare tool to influence United States elections. In fact the CEO, Alexander Nix, declared that Cambridge Analytica ran all the digital campaign, the television campaign, and its data informed all the strategy for the Trump campaign. The reporting has also speculated that Cambridge Analytica worked with the Internet Research Agency to help Russia identify which American voters to target with its propaganda.

I'm concerned that press reports indicate Facebook learned about this breach in 2015, but appears not to have taken significant steps to address it until this year. So this hearing is important and I appreciate the conversation we had yesterday and I believe that Facebook, through your presence here today and the words you're about to tell us, will indicate how strongly your industry will regulate and or reform the platforms that they control. I believe this is extraordinarily important. You lead a big company with 27,000 employees and we very much look forward to your comments. Thank you Mr. Chairman.

Sen. Chuck Grassley: Thank you Senator Feinstein. The history and growth of Facebook mirrors that of many of our technological giants. Founded by Mr. Zuckerberg in 2004, Facebook has exploded over the past 14 years. Facebook currently has over 2 billion monthly active users across the world, over 25,000 employees, and offices in 13 U.S. cities and various other countries. Like their expanding user base, the data collected on Facebook users has also skyrocketed. They have moved on from schools, likes, and relationships statuses. Today, Facebook has access to dozens of data points, ranging from ads that you've clicked on, events you've attended, and your location based upon your mobile device. It is no secret that Facebook makes money off this data through advertising revenue, although many seem confused by, or are altogether unaware of this fact. Facebook generated 40 billion in revenue in 2017 with about 98% coming from advertising across Facebook and Instagram. Significant data collection is also occurring at Google, Twitter, Apple, and Amazon, and an ever-expanding portfolio of products and services offered by these companies grant endless opportunities to collect increasing amounts of information on their customers. As we get more free or extremely low-cost services, the tradeoff for the American consumer is to provide more personal data. The potential for further growth and innovation based on collection of data is unlimited. However, the potential for abuse is also significant. While the details of the Cambridge analytic situation are still coming to light, there was clearly a breach of consumer trust and the likely improper transfer of data. The Judiciary Committee will hold a separate hearing exploring Cambridge and other data privacy issues. More importantly, though, these events have ignited a larger discussion on consumers' expectations and the future of data privacy in our society.

It is exposed that consumers may not fully understand or appreciate the extent to which their data is collected, protected, transferred, used and misused. Data has been used in advertising and political campaigns for decades. The amount and type of data obtained, however, has seen a very dramatic change. Campaigns including Presidents Bush, Obama, and Trump all use these increasing amounts of data to focus on microtargeting and personalization over numerous social media platforms and especially Facebook. In fact, President Obama's campaign developed an app utilizing the same Facebook feature as Cambridge Analytica to capture the information of not just the app's users but millions of their friends. The digital director for that campaign, for 2012, described the data-scraping app as something that would, "wind up being the most groundbreaking piece of technology developed for this campaign." So the effectiveness of these social media tactics can be debated, but their use over the past years across the political spectrum and their increased significance cannot be ignored. Our policy towards data privacy and security must keep pace with these changes. Data privacy should be tethered to consumer needs and expectations. Now, at a minimum, consumers must have the transparency necessary to make an informed decision about whether to share their data and how it can be used. Consumers ought to have clearer information, not opaque policies and complex click-through consent pages. The tech industry has an obligation to respond to widespread and growing concerns over data privacy and security and to restore the public's trust. The status quo no longer works.

Moreover, Congress must determine if and how we need to strengthen privacy standards to ensure transparency and understanding for the billions of consumers who utilize these products. Senator Nelson.

Sen. Bill Nelson: Thank you Mr. Chairman. Mr. Zuckerberg, good afternoon. Let me just cut to the chase: If you and other social media companies do not get your act in order, none of us are going to have any privacy anymore. That's what we're facing. We're talking about personally identifiable information that, if not kept by the social media companies from theft, a value that we have in America being our personal privacy, we won't have it anymore. It's the advent of technology and of course all of us are part of it from the moment that we wake up in the morning until we go to bed. We're on those handheld tablets and online companies like Facebook are tracking our activities and collecting information. Facebook has a responsibility to protect this personal information. We had a good discussion yesterday. We went over all of this. You told me that the company had failed to do so. It's not the first time that Facebook has mishandled its users information. The FTC found that Facebook's privacy policies had deceived users in the past and in the present case we recognize that Cambridge Analytica … How can American consumers trust folks like your company to be caretakers of their most personal and identifiable information? And that's the question. Thank you.

Sen. Chuck Grassley: Thank you my colleagues and Senator Nelson. Our witness today is Mark Zuckerberg, founder, chairman, and chief executive officer of Facebook. Mr. Zuckerberg launched Facebook February, 4 2004 at the age of 19. And at that time he was a student at Harvard University. As I mentioned previously, his company now has over $40 billion of annual revenue and over 2 billion monthly active users. Mr. Zuckerberg, along with his wife, also established the Chan Zuckerberg Initiative to further philanthropic causes. I now turn to you. Welcome to the committee. And whatever your statement is, or if you have a longer one, it will be included in the record. So proceed, sir.

Mark Zuckerberg: Chairman Grassley, Chairman Thune, Ranking Member Feinstein, Ranking Member Nelson, and members of the committee, we face a number of important issues around privacy, safety, and democracy. And you will rightfully have some hard questions for me to answer. Before I talk about the steps we're taking to address them, I want to talk about how we got here. Facebook is an idealistic and optimistic company. For most of our existence. We focused on all the good that connecting people can do. And as Facebook has grown, people everywhere have gotten a powerful new tool for staying connected to the people they love, for making their voices heard, and for building communities and businesses. Just recently we've seen the #MeToo movement and the March for Our Lives organized, at least in part, on Facebook. After Hurricane Harvey, people came together to raise more than $20 million for relief. And more than 70 million small businesses use Facebook to create jobs and grow.

But it's clear now that we didn't do enough to prevent these tools from being used for harm as well. And that goes for fake news, for foreign interference in elections and hate speech, as well as developers and data privacy. We didn't take a broad enough view of our responsibility and that was a big mistake, and it was my mistake, and I'm sorry. I started Facebook, I run it, and I'm responsible for what happens here. So now we have to go through all of our relationships with people and make sure that we're taking a broad enough view of our responsibility. It's not enough to just connect people, we have to make sure that those connections are positive. It's not enough to just give people a voice, we need to make sure that people aren't using it to harm other people or to spread misinformation. And it's not enough to just give people control over their information, we need to make sure that the developers they share it with protect their information, too. Across the board, we have a responsibility to not just build tools, but to make sure that they're used for good. It will take some time to work through all the changes we need to make across the company, but I'm committed to getting this right. This includes the basic responsibility of protecting people's information, which we failed to do with Cambridge Analytica.

So here are a few things that we are doing to address this and to prevent it from happening again. First, we're getting to the bottom of exactly what Cambridge Analytica did and telling everyone affected. What we know now is that Cambridge Analytica improperly accessed some information about millions of Facebook members by buying it from an app developer. This was information that people generally share publicly on their Facebook pages like names, and their profile picture, and the pages they follow. When we first contacted Cambridge Analytica, they told us that they had deleted the data. About a month ago, we heard new reports that suggested that wasn't true. And now we're working with governments in the U.S., the U.K., and around the world to do a full audit of what they've done and to make sure they get rid of any data they may still have. Second, to make sure no other app developers out there are misusing data, we're now investigating every single app that had access to a large amount of information in the past. And if we find that someone improperly used data, we're going to ban them from Facebook and tell everyone affected. Third, to prevent this from ever happening again going forward, we're making sure that developers can't access as much information now. The good news here is that we already made big changes to our platform in 2014 that would have prevented this specific situation with Cambridge Analytica from occurring again today. But there is more to do and you can find more details on the steps we're taking in my written statement.

My top priority has always been our social mission of connecting people, building community, and bringing the world closer together. Advertisers and developers will never take priority over that as long as I'm running Facebook. I started Facebook when I was in college. We've come a long way since then. We now serve more than two billion people around the world and everyday people use our services to stay connected with the people that matter to them most. I believe deeply in what we're doing and I know that when we address these challenges we'll look back and view helping people connect and giving more people a voice as a positive force in the world. I realize the issues we're talking about today aren't just issues for Facebook in our community. There are issues and challenges for all of us as Americans. Thank you for having me here today and I'm ready to take your questions.

Check back on this page — we're updating it live with the hearing.