The US Federal Trade Commission is to investigate Facebook over how data on millions of users was grabbed by Cambridge Analytica.
The social network has been criticised for letting the data analysis firm scoop up data on 50 million users.
The information is believed to have been used to help Donald Trump’s 2016 campaign for US president.
The FTC said its probe would determine whether Facebook had “failed” to protect users’ privacy.
In a statement, Tom Pahl, acting director of the FTC’s Bureau of Consumer Protection said it took “very seriously” the reports about user data going astray.
He said the FTC regularly took “enforcement action” against firms that caused substantial injury to consumers by breaking laws that govern how personal information should be kept safe.
Facebook is required by law to notify users and get their permission before data is shared beyond their preferred privacy settings.
Rob Sherman, deputy chief privacy officer for Facebook, told CNBC it would “appreciate the opportunity to answer questions the FTC may have”.
The data was grabbed via an app that let people take a personality quiz. Although only 270,000 people completed the quiz, the app was able to exploit the way Facebook held data to get at information about millions more.
Facebook says it has changed its rules on user consent to stop others getting at lots of data in the same way.
The growing scandal about the loss of the data wiped more than $55bn (£39bn) off the value of Facebook on US markets. News of the FTC probe prompted a further 5% fall in the value of the company.
Facebook is also facing a probe by UK data protection regulators and the European Commission.
The announcement comes soon after Facebook placed adverts in US and UK newspapers apologising for losing control of the data.
In the ads, Facebook boss Mark Zuckerberg said the company could have done more to stop the data on millions of users going astray.
“This was a breach of trust, and I am sorry,” the back-page ads said.
The company said it was taking steps to ensure the same type of data loss could not happen again.
