For Mark Zuckerberg and Facebook, this week was a trial by fire.
Over the course of two days (April 10-11), senators on the Senate Judiciary and Commerce Committees, as well as representatives from the U.S. House Energy and Commerce Committees, grilled Facebook’s (FB) 33-year-old CEO on a number of matters, including the recent Cambridge Analytica scandal, the company’s role in the 2016 U.S. presidential election, and its position on government regulation regarding user privacy.
And while Zuckerberg’s testimony was widely viewed as a successful defense of the company he started in 2004 — Facebook’s stock was up 4.5% at market close the first day of hearings — there were many questions Zuckerberg left unanswered.
Update: Facebook’s response
Facebook has responded to Rep. Debbie Dingell (D-Michigan) on how many Facebook “like” and “share” buttons there are on non-Facebook web pages, as well as “how many chunks of Facebook pixel code are there on a non-Facebook webpage.”
Getting back to you, @RepDebDingell. Over the last week on sites that use Facebook services: the Like button appeared on 8.4M websites covering 2.6B webpages, the Share button on 931K websites covering 275M webpages, and there were 2.2M Facebook pixels installed on websites.
— Facebook (@facebook) April 16, 2018
Things not addressed during the Senate hearing:
Zuckerberg promised Sen. Chuck Grassley (R-Iowa) he would get back to him with “all the examples of apps” Facebook has banned as a result of an audit covering “tens of thousands of apps.” “If we find that they’re doing anything improper, we’ll ban them from Facebook, and we will tell everyone affected.”
Zuckerberg told Grassley he does not have the “exact figure” of how many times Facebook required an audit to “ensure the deletion of improperly transferred data,” but added he would have his team follow-up with him.
Zuckerberg told Sen. Dianne Feinstein (D-Calif.) his team will get back to her about the “tens of thousands of fake accounts” and whether they could be “specifically” attributed back to Russian intelligence.
Zuckerberg told Sen. Maria Cantwell (D-Wa.) he would get back to her on whether any Facebook employees worked with Cambridge Analytica.
Zuckerberg told Sen. Roger Wicker (R-Miss.) he would get back to him about whether Facebook tracks user activity once a user logs off Facebook. Zuckerberg also promises to circle back with methodology about how it discloses to users this type of tracking.
Zuckerberg told Sen. Lindsey Graham (R-SC) he will have his team circle back with him about some proposed regulations. “We can have this discussion across the different categories where I think that this discussion needs to happen.”
Sen. Amy Klobuchar (D-Minn.) asked whether the 87 million users affected by Cambridge Analytica were concentrated in certain states. Zuckerberg said his team will circle back with her office about further details.
Klobuchar also asked whether Zuckerberg would support a rule requiring Facebook to notify users of a breach within 72 hours? “Senator, that makes sense to me, and I think we should have our team follow up with yours to discuss the details around that more,” Zuckerberg replied.
Sen. Roy Blunt (R-Missouri) asked whether Facebook tracks offline data — data that’s tracking that’s not necessarily linked to Facebook but linked to one — some device they went to Facebook on. Zuckerberg said he’s not sure of the answer to that question, he wants to get it right and he wants his team to follow up afterwards.
Sen. Ted Cruz (R-Texas) asked whether Zuckerberg is aware of any ad or page taken down from Planned Parenthood. “Senator, I’m not,” Zuckerberg said.
Cruz asked whether Zuckerberg is aware of any ad or page taken down from moveon.org? “I’m not specifically aware of those…,” Zuckerberg says.
Cruz asked whether Zuckerberg is aware of any ad or page taken down from any Democratic candidate running for office? “I’m not specifically aware,” Zuckerberg concedes. “I mean, I’m not sure.”
Cruz asked whether any of the 15,000-20,000 people engaged in content review have ever financially supported a Republican candidate for office. “Senator, I do not know that,” said Zuckerberg.
Sen. Sheldon Whitehouse (D-Rhode Island) asked whether researcher Aleksandr Kogan has a Facebook account still. “Senator, I believe the answer is ‘no,’ but I can follow up with you afterwards.”
Sen. Edward Markey (D-Mass.) asked whether Zuckerberg would support a privacy bill of rights for kids where opt-in is standard? “Senator, I look forward to having my team follow up to have my team flesh out the details of it.”
Sen. Mazie Hirono (D-Hawaii) asked whether Facebook plans on cooperating with President Trump’s extreme vetting initiative to target people for deportation or other ICE enforcement? “Senator, I don’t know that we’ve had specific conversations around that,” said Zuckerberg [later said Facebook would not proactively do that].
Hirono asked Zuckerberg whether ICE can even do what they’re talking about? “Senator, I’m not familiar enough with what they’re doing to offer an informed opinion on that.”
Sen. Dean Heller (D-Nevada) asked how many Nevada residents were among the 87 million people who received notifications that were affected by the Cambridge Analytica breach. “Senator, I don’t have this broken out by state right now, but I can have my team follow up with you to get you more information.”
Heller asked how long Facebook keeps users’ data after they’ve deleted their profile for good. “I don’t know the answer to that off the top of my head,” Zuckerberg replied.” I know we try to delete it as quickly as is reasonable. We have a lot of complex systems, and it takes a while to work through all that. But I think we try to move as quickly as possible, and I can follow up and have my team follow up.”
Sen. Gary Peters (D-Michigan) asked Zuckerberg whether Facebook is developing a set of principles that will guide development of its artificial intelligence systems. “Yes, Senator, and I can make sure that our team follows up and gets you information on that.”
Sen. Kamala Harris (D-Calif.) asked whether Zuckerberg whether anyone in Facebook leadership had a conversation not to inform Facebook users affected by Cambridge Analytica breach. “I’m not sure whether there was a conversation about that,” Zuckerberg commented.” But I can tell you the thought process of the company, which was that in 2015, when we heard about this, we banned the developer and we demanded that they delete all of the data and stop using it, and same with Cambridge Analytica.” Harris asked whether Zuckerberg knew when the decision was made not to inform Cambridge Analytica users. “I don’t,” Zuckerberg said.
Sen. Tammy Baldwin (D-Wis.) asked Zuckerberg to identify which other firms also received the same user data Cambridge Analytica received from Kogan. “Yes, there’s one called Eunoia, and there may have been a couple of others as well. And I can follow up with [your team]…,” said Zuckerberg.
Baldwin asked for additional information on how Facebook can be “confident” that it has excluded non-U.S. entities from using targeted ads similar to the Russian-bought ads from the 2016 U.S. presidential election. Replied Zuckerberg: “We’ll follow up on that.”
Sen. Cory Gardner (R-Colo.) asked how long deleted user data may persist in backup copies. “Senator, I don’t know, sitting here, what our current systems are on that,” Zuckerberg said. “But the intent is to get all the content out of the system as quickly as possible.”
Gardner follows-up and asked whether user data can sit in “backup copies.” “Senator, I think that is probably right. I’m not sitting here today having full knowledge of the state of the systems around wiping all of the data out of backups. So I can follow up with you on that afterwards.”
Gardner asked another follow-up: “Has there ever been a failure of that [wiping backup data]?” Replied Zuckerberg: “I don’t know, but if we tell people that we’re going to delete their data, then we need to do that.”
Things not addressed during the U.S. House hearing:
Rep. Greg Walden (R-Ore.) asked about fake pages, but ran out of time.
Rep. Frank Pallone (D-NJ) asked whether Facebook will make the commitment to change all the user default settings to minimize the collection and use of users’ data. Zuckerberg said the issue is complex, and requires more than a one-word answer. Pallonne said he will follow up on this question.
Rep. Fred Upton (R-Mich.) asked about a former state representative who was running for state senate, who had posted a “rather positive announcement” which had been rejected because it didn’t follow Facebook’s advertising policies (based on the response). Upton also asked why that happened, when there was no threat involved. Zuckerberg said: “Congressman, I’m not sure either. I’m not familiar with that specific case. It’s quite possible that we made a mistake, and we’ll follow up afterward to — on that.”
Rep. Anna Eshoo (D-Calif.) asked if Zuckerberg was willing to change Facebook’s business model in the interest of protecting individual privacy. Zuckerberg said he was not sure what that means and Eshoo said she would follow up.
Rep. Gene Green (D-Texas) asked about when Facebook users in the United States will get the same rights as those covered by Europe’s General Data Protection Regulation (GDPR), that users will have the right to object to the processing of their personal data for marketing purposes, which include custom micro-target audiences for advertising, and how that will be implemented. Zuckerberg replied that he wasn’t sure of how they were going to implement that yet and would follow up.
Rep. Steve Scalise (R-La.) asked about Facebook’s data mining and how it goes on for security purposes. So my question would be, is that data that is mined for security purposes also used to sell as part of the business model? Zuckerberg replied that Facebook collects “different data for those,” and would follow up.
Scalise also asked how people who made the mistake of censoring Diamond and Silk will be held accountable. Zuckerberg said the situation had developed while he was not there, so he would follow up on that.
Rep. Jan Schakowsky (D-Ill.) asked apart from Eunoia Technologies, how many companies were there in total that Kogan sold data to, and what were their names, as well as the magnitude. Zuckerberg said he would follow up with that information, after they complete the audits.
Schakowsky also asked how Facebook tried to get those firms to delete user data and its derivatives, and whether they were deleted. Zuckerberg replied that they needed to complete the investigation and audit before he could confirm that.
Rep. Cathy McMorris Rodgers (R-Washington) asked what Facebook was doing to ensure that its users were being treated fairly and objectively by content reviewers — bringing up Federal Communications Commission’s Ajit Pai’s allegations that edge providers routinely block or discriminate against content they don’t like. Zuckerberg replied that he would be happy to follow up and go into more detail on that.
Rep. G. K. Butterfield (D, NC) asked how Facebook and the tech industry will be increasing African-American inclusion at all levels within, and whether he will convene a meeting of CEOs to ‘quickly develop a strategy to increase racial diversity in the technology industry.’ Zuckerberg replied that it was a good idea and they should follow up on it.
Butterfield also asked if Facebook planned to add an African American to their leadership team in the foreseeable future, and whether they will continue to work with the Congressional Black Caucus to increase diversity within the company. He also asked for the numbers on retention of employees, disaggregated by race, starting this year. Zuckerberg said they will try to include a lot of important information in the diversity updates, and that he will discuss this with his team after he gets back.
Rep. Leonard Lance (R-NJ) asked Facebook to review the BROWSER legislation and for his support for that legislation. Zuckerberg said he would review and get back to him.
Rep. John Sarbanes (D-Maryland) asked if Facebook notified the Trump and Clinton campaigns of Russian attempts to hack in to those campaigns and requests a response in writing to that question.
Rep. Jerry McNerney (D-Calif.) asked if there were any other information that Facebook has obtained about him and whether Facebook collected it or obtained it from a third party that would not be included in the download. Zuckerberg replied that all his information would be included in your “download your information.” Rep. Mcnerney said he would follow up afterwards.
Rep. Peter Welch (D-Vermont) asked if Facebook would work with the committee to put in place privacy regulation that prioritizes consumer’s right to privacy in the U.S., just as the European Union has done. Zuckerberg replied that he would make sure they work with them to flesh this out.
Rep. Adam Kinzinger (R-Illinois) asked if Facebook was giving Russian intelligence service agencies access to global data that was not in Russia. Zuckerberg replied that he had no specific knowledge of any data that Facebook has ever given to Russia. He added that they would work with law enforcement in different countries and get back to what that might mean with Russia specifically. Zuckerberg ended saying that he had no knowledge of any time that they had given them information.
Rep. Ben Ray Lujan (D-New Mexico) asked about a recent Facebook search feature that allows malicious actors to scrape data on virtually all of Facebook’s 2 billion users. He highlighted that in 2013, Brandon Copley, the CEO of Giftnix, demonstrated that this feature could easily be used to gather information at scale. Zuckerberg replied that he was not specifically familiar with that case, and the feature, which was implemented a couple weeks prior was a search feature that allowed people to look up some information that people had publicly shared on their profiles.
Lujan also asked how many data points Facebook had on each Facebook user on average. Zuckerberg said he would have his team get back to him afterwards. Lujan asked whether Facebook had disclosed to the committee or to anyone all the information Facebook has uncovered about Russian interference on the platform. Zuckerberg said he was working with the right authorities on that.
Rep. Morgan Griffith (R-Virgina) asked about Facebook’s plans with rural broadband. Zuckerberg said he would follow up on this.
Rep. Gus Bilirakis (R-Florida) asked when Facebook will build the tools to identify harmful content like opioid ads. Zuckerberg said that it would be a longer term thing to build that solution, and in the meantime, content reviewers would take them down if flagged. Bilirakis pushed him on a timeline for this, but the Congressman’s allotted time for questioning ran out.
Rep. Yvette Clarke (D-NY) asked if she could get a timeline of how Facebook planned to review ads and big pages. Zuckerberg replied that they would be in place for these elections.
Rep. Bill Johnson (R-Ohio) asked what happened to the content reviewer that took down the Franciscan University ad and did not put it back up until the media started getting involved. Zuckerberg replied that he was not specifically aware of that case, but would get back to him on it.
Rep. David Loebsack (D-Iowa) asked when will changes promised this time be proven to be completed, and how that would happen. Zuckerberg replied that after their investigation, if they find anyone that misused their data, they would tell people.
Rep. Billy Long (R-Missouri) asked about why Diamond and Silk’s content was flagged as unsafe. Zuckerberg replied that nothing was unsafe about it but he wasn’t sure of the specifics of the situation.
Rep. Bill Flores (R-Texas) asked if Zuckerberg thought Facebook and other technology platforms should be ideologically neutral. Zuckerberg replied that they should be a platform for all ideas. Flores asked what data will be used, how it will be processed, where and how it will be stored, what algorithms will be applied to it, who will have access to it, if it will be sold and to whom it might be sold. He ran out of time.
Rep. Scott Peters (D-Calif.) asked about GDPR and what Zuckerberg thought the Europeans got right, and what they got wrong. Zuckerberg replied that GDPR in general was going to be a very positive step for the internet, and it codifies a lot of the things in there, things that Facebook had done for a long time, such as privacy controls that they have offered around the world for years. As for what they got wrong, Zuckerberg said he would follow up on that.
Rep. Richard Hudson (R-NC) asked if Facebook was aware of the national security concerns that would come from allowing those who harm the U.S. to access information such as the geographical location of members of the U.S.’s Armed Services, and whether they were looking at it. Zuckerberg replied that he was not specifically aware of the threat, but in general, there were a number of “national security and election integrity-type issues” that they focus on. He added that with more input from the intelligence community, Facebook could more effectively do that work.
Rep. Buddy Carter (R-Georgia) asked if Zuckerberg was going to meet the Federal Drug Administration Commissioner next week at the Prescription Drug Abuse and Heroin Summit in Atlanta, alongside other CEOs of internet companies, to discuss this problem. Zuckerberg replied he will make sure someone is there.
Yahoo Finance will be following up with each lawmaker to find out if and when Facebook provides answers. Check back regularly.
Aarthi Swaminathan is an intern at Yahoo Finance.
Read more of Yahoo Finance’s coverage from Mark Zuckerberg’s hearings on Capitol Hill this week: