Sitting before a joint panel of 44 U.S. senators, Facebook CEO Mark Zuckerberg performed an act of contrition, apologizing for his company's failures to safeguard user data and prevent bad actors from abusing the platform.
Senators had harsh words for the social media executive and Zuckerberg is expected to face another tough hearing before the House on Wednesday.
In the past, Congress' bark has been worse than its bite. Growing concerns about Americans' online privacy and almost daily revelations of widespread abuse of Facebook data suggest the era of big tech's self-regulation could be coming to an end.
Republican chairman of the Senate Commerce Committee, John Thune of South Dakota, raised the specter of new rules governing data privacy in his opening statement, saying that lawmakers on the left and right have "been willing to defer to tech companies' efforts to regulate themselves, but this may be changing."
Since 2014, representatives from Facebook, Twitter and Google have been called before Congress to explain their platforms' use in terrorist recruitment and radicalization, interference in democratic elections, the spread of disinformation and "fake news." Each time, lawmakers teased the idea of new regulations, but ultimately conceded the social media giants knew best how to monitor their platforms and shied away from legislation.
Zuckerberg's latest admission that as many as 87 million users data was shared with the data mining firm, Cambridge Analytica without their permission and his further acknowledgment that all 2 billion users may have had their data scraped using a tool that Facebook discontinued only last week, may have brought the issue to a breaking point.
Sen. Bill Nelson of Florida, the ranking Democrat on the Commerce Committee, followed up with a stern warning to Zuckerberg and other companies that fail to protect their users' data. "If Facebook and other online companies will not or cannot fix the privacy invasions, then we are going to have to," Nelson stated.
Social media companies have bristled in the past at the idea of government regulation. On Tuesday, Zuckerberg appealed to senators to give him more time to patch up the breach of trust with the public.
Asked why Facebook's latest apology to its users was different from the many others the company has had to issue in the past, Zuckerberg acknowledged that he has made "a lot of mistakes" since starting the company at age 19.
"At the end of the day, this is going to be something where people will measure us by our results on this," Zuckerberg said. "It's not that I expect that anything I say here today to necessarily change people's view, but I'm committed to getting this right and I believe that over the coming years, once we fully work these solutions through, people will see real differences."
Time may not be a luxury Facebook has. A number of lawmakers have begun introducing legislation that would rein in companies like Facebook that rely on collecting and sharing user data to make a profit.
"I think the day of reckoning for American privacy has arrived," Sen. Ed Markey, D-Mass., told reporters Tuesday. "Facebook now has to deal with how much people understand about how vulnerable all their information is, how few protections are on the books. So I do think this is a legislating moment."
Earlier in the afternoon, Thune said he would consider legislation regulating Facebook, depending on whether Zuckerberg provides a "satisfactory response" to the latest public concerns about privacy. "If we need to tee something up...we can do that too," he told reporters.
Another Democratic senator, Richard Blumenthal of Connecticut insisted that Zuckerberg's appearance before Congress this week represents a turning point.
"It's high noon for Mark Zuckerberg," he said. "It is a defining moment. It is a moment of reckoning for Facebook."
Both Markey and Blumenthal have introduced legislation that would require companies to get positive consent from users before they collect and share their data. Asked whether the legislation can earn support from Republicans, who have often been wary of government regulations, Blumenthal argued, "Privacy should not be partisan."
The rules would mirror data privacy regulations going into effect in the European Union at the end of May. Under the EU's General Data Protection Regulation (GDPR), companies like Facebook will be forced to comply with higher standards for collecting, storing and sharing user data or face fines and penalties.
During the hearing, Zuckerberg suggested ambiguously that the European Union regulations "get things right," explaining to lawmakers that he is not necessarily against government regulations, but supports "the right regulations." Zuckerberg did not elaborate but said he would world with Congress to write those rules.
In recent months, Zuckerberg has shown a willingness to cooperate with lawmakers on minor regulations. Facebook backed the bipartisan Honest Ads Act, legislation that would require tech companies to disclose the source and amount of money paid by entities that buy political ads on their platforms. The bill is aimed at preventing foreign election interference. Twitter announced Tuesday it would also support the legislation.
Zuckerberg also signaled his support for a privacy rule that would require Facebook to notify users within 72 hours of data privacy breach. Facebook users whose data was improperly shared with Cambridge Analytica were not informed about the privacy breach until more than two years after the fact. Zuckerberg said a 72-hour notification "makes sense."
Not all lawmakers support regulating big tech. Many Republicans were reluctant to tell reporters whether or not they supported new privacy rules that would apply to social media companies.
"I'm not sure Congress should be regulating Facebook. That's always the response when something is not perfected, that well, we just need to regulate it more," said Sen. James Inhofe, R-Okla. Inhofe said he wanted to hear Zuckerberg plans to correct his company's past mistakes, arguing for changes that could be made "outside of more regulation."
With the issue of data privacy, some critics are concerned that Facebook is not in a position to effectively regulate itself, because its fundamental business model is based on collecting and granting access to subsets of user data.
Marc Rotenberg, president of the Electronic Privacy Information Center warned there is very little an individual can do to effectively protect his or her data on social media. "The reality is, when you give your personal data to one of these companies, it's the company that then takes the responsibility for what happens to the data," he explained.
Companies are not always responsible with that data after they collect it. Facebook demonstrated that with Cambridge Analytica, which allegedly kept the data of millions of Facebook users after certifying it had deleted the information.
"That's why you need privacy rules," Rotenberg stressed, adding he believes Congress will implement "meaningful regulations" to protect Americans' data privacy.
Outside the Capitol, activists with the global civil movement, Avaaz were also calling on Congress to rein in Facebook. The group set up rows of cardboard Mark Zuckerbergs wearing a tee-shirt with the message, "Fix Facebook."
Based on their neglect in the past and the success of their business model, Facebook is not likely to fix the problem on its own, explained a spokesperson for Avaaz. "They profited from this, while the public has suffered."
After spending more than four hours testifying before the Senate on Tuesday, Zuckerberg will face another bruising round of questions in the House Wednesday morning.