Facebook wrote about the issue on Friday in a public online message, just before news media began reporting on the story.
Reports said that Cambridge Analytica was given access to the data. The data company is linked to conservatives and is known for its work on Donald Trump's 2016 presidential campaign. The reports also say the company may not have deleted, or removed, the data.
Democratic U.S. Senator Amy Klobuchar wrote on Twitter that it is clear that companies like Facebook cannot "police themselves." She added that Facebook chief Mark Zuckerberg should speak before the Senate Judiciary committee.
民主党参议员艾米·克劳布查(Amy Klobuchar)在推特上写道，显然像脸书网这样的公司无法“自我监督。”她补充说，脸书网负责人马克·扎克伯格（Mark Zuckerberg）应当接受参议院司法委员会质询。
Facebook announced late Friday it was banning Cambridge Analytica from its service for misusing data.
The reports are the latest threat to Facebook's public image. It has been criticized over Russia's use of Facebook to influence American voters during the 2016 election.
Facebook said researchers and Cambridge Analytica lied to the company and abused its policies. Yet critics are blaming Facebook. They are also demanding answers for users whose information was given to Cambridge Analytica.
Facebook claims the data was misused, not stolen. It says users gave it permission. The company's position has led to a debate about what is considered a "hack" that users must be told about.
How to keep online information safe
Frank Pasquale is a University of Maryland law professor. He has written about Silicon Valley's use of data. He said that Facebook's explanation that data had not been stolen avoided the central issue that data was used in a different way than users expected.
Senator Mark Warner, a Democrat, said the event proves the need for new regulations about internet advertising. He described the industry as the "Wild West." He said that without new regulations, the market will continue to deal with deception and secrecy.
Both The New York Times and London's Observer reported Saturday that private information from more than 50 million Facebook users was wrongly given to Cambridge Analytica. They also reported that the company had not deleted the data, even though Facebook told them to beginning in 2015.
The reports say that about 270,000 Facebook users gave a researcher permission to use their data. The researcher also took the data of all their friends, a move that was permitted based on Facebook's rules until 2015.
The researcher then sold the data to Cambridge Analytica. That move was against Facebook rules, the newspapers said.
Cambridge Analytica worked on Trump's 2016 campaign. However, a Trump campaign official said they used Republican data sources, not Cambridge Analytica, for voter information.
Calls for new regulation
Facebook said in a series of statements over the weekend that researchers and Cambridge Analytica broke Facebook rules. It said it was considering legal action against them.
In answer, Cambridge Analytica said that they had, in fact, deleted the data. It also said the company supplying the data was responsible for obtaining it.
Andrew Bosworth, a Facebook vice president, said the company could make more changes to demonstrate that it values privacy. "We must do better and will," Bosworth wrote on Twitter.
Nuala O'Connor is president of the Center for Democracy & Technology in Washington, D.C. She said Facebook was depending on the honesty of people rather than preparing for the planned misuse of data.
O'Connor also added that Facebook knew about the abuse in 2015 but did not inform users until Friday. "That's a long time," she said.
Massachusetts Attorney General Maura Healy said on Saturday she was launching an investigation into the use of Facebook data.
Healey's office said she wants to understand how the data was used, what policies may have been abused, and what the legal effects are.
I'm Phil Dierking.