The social network’s latest controversy could become a big legal headache.

Backstory: Facebook suspended Cambridge Analytica from its network on Friday for failing to delete data about 270,000 people, acquired from an academic study. Then, on Saturday, the New York Times and the Observer reported that Cambridge Analytica actually had data on over 50 million people because social ties of the original 270,000 were tapped, seemingly without permission.

Facebook says: “People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.”

But: Lawmakers in the US and UK are calling for investigations into the situation. And the Washington Post ($) says that Facebook may have breached Federal Trade Commission privacy rules by letting the data escape, which could lead to “many millions of dollars in fines.”

Bottom line: The finer details of exactly how data made its way from Facebook users to Cambridge Analytica are still to be shaken out. But political powers, many already displeased by Big Tech, hope to get to the bottom of it. It could be troubling and expensive for Zuck.