The claim came as Facebook confirmed that it scans the links and images sent in private Messenger conversations. The company yesterday also said the data of 87 million, not 50 million, of its users may have been improperly shared with Cambridge Analytica. Oh, and malicious actors had been using a (now removed) tool for finding friends to record people’s public information. “Most people on Facebook could have had their public profile scraped in this way,” Facebook CTO Mike Schroepfer admitted in a blog post.

Given that Facebook’s privacy scandals keep on coming—and the investigations keep piling up—is it reasonable for investors to be buying into the company rather than walking away from it?

There are indeed causes for optimism. First off, if all this stuff comes out now, there are hopefully fewer potential scandals waiting in Facebook’s closet.

More importantly, though, Facebook’s many admissions come in the context of the company making major changes to its systems, so they are more compliant with the European Union’s incoming General Data Protection Regulation (GDPR). It’s a lot easier to fess up to something when you can promote the cure along with the diagnosis. (Zuckerberg also used a Wednesday conference call with reporters to insist that, contrary to a Reuters report, Facebook will extend GDPR-compliant privacy controls to users around the world, not just in the EU.)

If Facebook didn’t make big changes to get in line with the European privacy law, which comes into effect next month, it would have been risking fines of up to 4% of global annual revenues. It remains to be seen whether EU regulators will be satisfied with the changes Facebook has implemented, but it certainly looks like it’s making a serious effort.

The big question now is how much those changes will affect Facebook’s bottom line. They make it harder for third-party apps to get data on Facebook’s users, potentially making the social network a less attractive platform for some developers. They loosen lucrative ties with data brokers, potentially making for less relevant ads on the platform (something that’s worrying Morgan Stanley’s analysts.) These are reversals of policies that made Facebook what it is today—invasive of privacy, but a big money-spinner.

So when Zuckerberg says there hasn’t been a material impact on Facebook’s business yet, that may not be relevant for long. Yes, most people haven’t jumped on board the #DeleteFacebook bandwagon, but it’s what happens next that counts. Once Facebook has worked to regain people’s trust—if indeed that’s possible—it needs to show that it can still thrive while being respectful of users’ data and privacy.

A version of this article first appeared in CEO Daily, Fortune’s newsletter on how to succeed big in business. Subscribe here.