The agency could fine Facebook up to $40,000 per violation per day — which could add up quickly with millions of users involved — if it finds the social media giant broke its earlier promises to protect user data, they say.

“If I had to bet, they will find violations,” said Jessica Rich, a former head of the FTC’s consumer protection bureau.

“The penalty could potentially be huge,” because each user adversely affected could be considered a violation, said Rich, now vice president of consumer policy and mobilization for Consumer Reports. “The FTC is unlikely to get billions,” Rich said. “It could get hundreds of millions.”

The FTC is probing how data from 50 million Facebook users was obtained by Cambridge Analytica, a British political consulting firm that consulted on President Donald Trump’s campaign, and whether the transfer violated pledges the company made to settle an earlier privacy case. Investigators can also consider whether Facebook misled users or violated rules governing data shipments between Europe and the United States.

“The agency has a fair amount of latitude to turn the screws up,” said David Vladeck, the former head of the FTC’s Bureau of Consumer Protection who signed the consent order which binds Facebook for 20 years.

“This is in my view a serious breach of the FTC’s consent” agreement, Vladeck, now a Georgetown University professor, told Bloomberg TV. “There will be serious consequences from this violation.”

Facebook is struggling to respond to the Cambridge Analytica scandal, which has prompted an outcry from lawmakers, investors and privacy advocates. The crisis comes just a few months after revelations that Russia exploited Facebook’s platform to influence the U.S. presidential election. Congress is seeking to bring Facebook Chief Executive Officer Mark Zuckerberg to Washington for public testimony.

The scandal has caused Facebook to delay the unveiling of new home products and redesign its privacy settings. The stock has lost almost $100 billion in market value and is no longer among the top five most valuable companies in the world. The shares closed up 0.53 percent Wednesday at $153.03.

Facebook’s 2018 net income is projected to rise 20 percent this year to $21.8 billion, according to data compiled by Bloomberg.

2011 Case

In the 2011 case, the agency alleged in an eight-count draft complaint that Facebook had broken its promise that users could keep their information on Facebook private. Facebook had assured users that third-party applications only had access to data required for them to function, while, in fact, the applications had access to almost all of a user’s personal information.

Under the settlement, Facebook agreed to get consent from users before sharing their data with third parties. It also required Facebook to establish a “comprehensive privacy program,” block access to a user’s account within 30 days of it being deleted and barred it from making any deceptive claims about its privacy practices.

Facebook says it didn’t violate the consent decree. It has suspended Cambridge Analytica from its network and said in a blog post that the British company had received user data through an app developer in violation of Facebook policy.

“We remain strongly committed to protecting people’s information,” said Rob Sherman, deputy chief privacy officer at Facebook. “We appreciate the opportunity to answer questions the FTC may have.”

Zuckerberg said in newspaper ads March 25 that a quiz app “leaked” data in 2014. “This was a breach of trust, and I’m sorry we didn’t do more at the time,” he said.

Cambridge Analytica had received data from some 50 million Facebook users as it built a election-consulting company that boasted it could sway voters in contests all over the world. While 270,000 users had authorized an academic to use their data for research purposes, according to reports, the researcher allegedly violated privacy rules when he handed the data off to Cambridge Analytica.

Facebook on Wednesday said it’s moving to untangle its often bewildering array of privacy options, consolidating choices in one place on mobile devices, rather than sending users to some 20 different screens.

Rich, the former FTC consumer chief, said the investigation could take a year and would likely explore whether Facebook should have reacted more vigorously in 2015, when it received assurances from Cambridge Analytica that the data it received had been destroyed. Instead, not all data was deleted, Facebook acknowledged in a March 17 blog post. “There could be a failure of oversight,” said Rich.

Vladeck, the Georgetown professor, see he expects “some sort of an agreement between the FTC and Facebook which will call for very serious financial civil penalties, and a new consent decree that will ratchet up the restrictions on the way Facebook gathers information.”