As markets try to figure out how much damage Facebook (FB) will see from what looks like its biggest PR fiasco to date, it's worth keeping in mind that there are two very different questions that collectively decide the outcome:
- How much does the scandal change the extent to which Facebook users choose to engage with its services?
- What kind of impact will the regulatory response to the scandal have on Facebook's ad business?
As much as the news flow over the past couple of days has given Action Alerts Plus holding Facebook's image a fresh black eye, the answer to question No. 1 may very well be "not a whole lot."
For all the new and old misgivings that many consumers have about them, Facebook's core services are free and remain widely seen as an valuable utility for staying in touch with family and friends.
And much like other utility services, the fact that some consumers don't love Facebook doesn't necessarily mean that they'll stop relying on it. At least if it's able to show some remorse over how its services have been misused and take meaningful steps to prevent it from happening again (as noted below, one key step has already been taken).
On the other hand, there is a real risk that the answer to question No. 2 will be less favorable to Mark Zuckerberg & Co. However, it's hardly clear right now just how things will play out on this front.
To recap: A pair of media reports detailed how a personality-test app called "thisisyourdigitallife" -- it was developed by a professor in 2014, and 270,000 people were paid to use it -- not only collected data about the app's users, but also about their 50 million or so Facebook "friends." And how this data was (in violation of Facebook's terms of service) later passed on to Cambridge Analytica, an ad data firm that worked with Donald Trump's 2016 Presidential campaign, to profile and target potential voters.
Notably, Facebook learned in 2015 that the data collected by the app had been shared with Cambridge, and demanded that all parties concerned certify that they've deleted the data. Cambridge insists it no longer has the data, and that it didn't use any of it for its 2016 election work.
However, late on Friday, Facebook disclosed that it recently "received reports that, contrary to the certifications we were given, not all data was deleted." The New York Times says it managed to view "a set of raw data from the profiles Cambridge Analytica obtained."
On Monday, Facebook said it has hired a digital forensics firm to "conduct a comprehensive audit" of Cambridge. But soon afterwards, the company said its auditors "stood down" to let the U.K. Information Commissioner's Office perform its own investigation.
The uproar over the story has been fast and furious. In addition to dominating headlines within the tech press and beyond, the Cambridge controversy has led numerous U.S., U.K. and EU lawmakers to demand probes of Facebook's policies, with some also calling on Mark Zuckerberg to testify about them. Facebook shares fell 6.8% on Monday, leaving them close to their 2018 lows.
Facebook received a fresh PR headache late afternoon on Monday, when the NYT reported that Alex Stamos, Facebook's chief information security officer, plans to leave in August due to "internal disagreements over how the social network should deal with its role in spreading disinformation," and has seen his day-to-day responsibilities handed off to others. Stamos responded by saying he remains "fully engaged" with his work at Facebook, but didn't deny that he's leaving.
As calls emerge to more tightly regulate how Facebook obtains and shares data about its 2 billion-plus users in response to Cambridge's actions, the company will be quick to note that the programming interface (API) that allowed apps to gain access to data about a user's friends (rather than just the app's user) was shut down last year. Facebook will also likely reiterate that users can see what info an app is requesting before deciding to use it, and can later revoke the permissions it has granted an app.
Likewise, Facebook could point out that consumers can also control how their information is used for ad-targeting purposes, as well as whether Facebook data is used to show targeted ads on non-Facebook sites and apps. And that -- according to January comments from COO Sheryl Sandberg -- the company is prepping a revamped Privacy Center promised to "make it much easier for people to manage their data."
Still, it wouldn't be surprising if some lawmakers and regulators push for changes that require Facebook to take additional steps to safeguard any data that its users agree to give developers. There could also be calls for the company to be more proactive about letting users know what data it has collected (and how it's being used), and to more broadly require users to opt in to the sharing and usage of their Facebook data.
That last possibility might be the greatest risk posed to Facebook by its latest controversy. The EU has already unveiled regulations -- they go into effect in May -- that (among other things) require consumers be asked to opt in to any tracking or use of their data for ad targeting, and there might now be a push in the U.S. and elsewhere for similar rules to be implemented. While Facebook has a settings page that lets users control what data of theirs is used for ad targeting, it's buried within its Settings section and has presumably been used by just a small percentage of its users.
That said, Sandberg insisted on Facebook's Jan. 31 earnings call that the company isn't expecting "a big impact" from the EU regulations on its targeting efforts (marketers have already been coming up with effective ways to get users to opt in to targeting). And Facebook could push back against calls for such regulations in the U.S. by noting that unless a marketer is attempting to target an existing customer, its tools don't let ad-buyers know the identities of those who are being shown a targeted ad (they only see aggregate information about demographic groups).
Simply put, while Facebook will quite likely have to contend with new U.S. and foreign regulations thanks to the Cambridge controversy, it's hardly a given right now that the regulations will do massive harm to its ad business. If the company can do an effect job at PR damage control, there's a good chance that Monday's selloff will look excessive.
Particularly since we're talking about a company that still has several major levers to drive future revenue growth, and whose shares now trade for less than 20 times a 2019 GAAP EPS consensus estimate that might well prove conservative.