Myrtle Beach, South Carolina Correspondent

I buy Facebook ads for a living, so let me begin with a confession that will sound like a defense and is not meant as one: everything Cambridge Analytica did with the data, I could have done with the tools Facebook sells to anyone with a credit card. Not the harvesting, which was a researcher abusing an app permission that Facebook should have closed years before it did. But the targeting, the lookalike audiences, the psychographic slicing, the ability to put a different message in front of a worried mother in Horry County than in front of a retired veteran two streets over, that is the product. That is what I sell to beach shops and restaurants and the occasional dentist. The scandal of the past four weeks is not that a political consulting firm used Facebook to manipulate voters. It is that the public found out what Facebook is, and the senators who questioned Mr. Zuckerberg on Tuesday made it very clear that they had not known either.

So the question of whether the platforms face meaningful consequences depends on what you mean by consequences, and I want to separate the three kinds, because they are moving at different speeds. The first is reputational, and it is real and it is already fading. The stock dropped fifteen percent in the two weeks after the story broke and recovered most of it during the hearings, because investors watched ten hours of testimony and concluded that nobody in Congress understood the business well enough to damage it. Senator Hatch asked how the company makes money if it does not charge users, and Mr. Zuckerberg said, senator, we run ads, and that exchange told every analyst on Wall Street everything they needed to know about the regulatory threat. The #DeleteFacebook campaign got Elon Musk and some headlines. It did not move the daily user numbers, because the people who are angry at Facebook are also the people who use it to find out what their friends are angry about. I have watched the engagement on my clients’ pages this month. It has not dropped. The audience is outraged and still logged in.

The second kind of consequence is regulatory, and here I think my fellow correspondents are going to be more optimistic than I am. The Federal Trade Commission is investigating whether the company violated the consent decree it signed in 2011 after the last privacy scandal, and if it finds a violation the fine could be large, in theory very large, because the decree allows penalties per violation per day. That is the one American consequence that has teeth, and it will take a year or more to arrive. Congress will hold more hearings and will not pass a law this year, because the only members who understand the problem are the ones who do not want to regulate it and the members who want to regulate it demonstrated on Tuesday that they could not describe it. The European regulation that takes effect next month is a different story, and I will leave it to the correspondent from a country that has to live with it, but I will say that every one of my clients who has a European customer on their email list is scrambling to comply with a law that was written before anyone had heard of Cambridge Analytica, and that is the thing that will actually change how the platforms handle data: not an American hearing, but a European fine schedule.

The third kind of consequence is the one I think matters most and nobody is naming, which is that the platforms are going to regulate themselves, badly, in ways that hurt small advertisers and barely touch the big ones. Facebook has already announced that it will restrict the data available to app developers, require verification for political advertisers, and shut off some of the third-party data partnerships that let advertisers match offline records to profiles. Every one of those changes makes the targeting worse for a beach shop with a four-hundred-dollar budget and barely dents a campaign with four hundred million. The small businesses I work with are going to pay more for less reach, because the company that was caught letting a political firm abuse its data has decided that the way to look responsible is to make it harder for a restaurant to find people who like seafood. That is not a consequence for the platform. It is a consequence of the platform, passed down the line to the people with the least power to object.

On the political influence side, I will say what I think the evidence actually supports, which is less than the coverage. Cambridge Analytica took money from a campaign, told the campaign it had a psychological targeting system, and by most accounts delivered a product that the campaign’s own digital people considered useless and that its parent company could not demonstrate worked. The firm was selling a story about manipulation to clients, and the story has now been sold to the public as fact. The real influence operation on Facebook in 2016 was run from St. Petersburg with a budget that would not cover a mid-size car dealership’s annual spend, and it worked not because of psychographics but because the platform’s own engagement machinery amplifies whatever makes people angry. That is the problem. It is not a problem that any data regulation solves, because the data is not the mechanism. The algorithm is, and nobody in Washington asked about the algorithm.

So my answer is that the platforms face a reputational consequence that is already fading, a regulatory consequence that is real in Europe and slow in America and will land as a fine rather than a structural change, and a self-imposed consequence that will fall mostly on the small advertisers who had nothing to do with any of it. The thing the scandal revealed, that the product is the user and the business is attention, will not change, because the users have decided they can live with it, and the senators have decided they do not understand it. I will go back to buying ads on Monday. The targeting will be a little worse. The platform will be fine. The people who were manipulated, to the extent anyone was, will go on being manipulated by a machine that nobody built to manipulate them and nobody has any idea how to turn off.

Orange County, California Correspondent

The market answered this question on Wednesday afternoon, and the answer was no. Facebook’s shares, which had fallen about fifteen percent from their March high in the two weeks after the Cambridge Analytica story broke, rose four and a half percent during Mr. Zuckerberg’s first day of testimony and kept rising through the second, adding something on the order of twenty billion dollars to the company’s value while its chief executive sat in front of a hundred legislators who were supposed to be holding him to account. Investors watched the same ten hours the public did and concluded that the regulatory risk was lower after the hearings than before, because the hearings demonstrated that the people with the power to regulate the company did not understand what it did. I follow technology-driven business models for a living, and I have rarely seen a clearer real-time verdict. The reputational consequence was priced in by the end of March. The regulatory consequence was priced out by the end of the week.

Let me describe the business, because the hearings suggested that it needs describing. Facebook has about two billion monthly users and charges none of them. It makes roughly forty billion dollars a year, almost all of it from advertisers who pay to reach those users in slices defined by what the users have revealed about themselves: age, location, interests, relationships, purchases, and the inferences the company draws from all of it. The data that Cambridge Analytica obtained, the profiles of eighty-seven million people harvested through a quiz app in 2014, was a leak from that system, and the company closed the leak in 2015 by cutting off the app permission that allowed it. But the system itself, the collection and the inference and the sale of targeted access, is not a leak. It is the product, and nothing announced in the past four weeks changes it. The company has restricted developer access, tightened its advertising verification, and promised a privacy review of every app on the platform. Those are repairs to the fence. The field is the same.

Now the three places where consequences could actually come from, in the order I rate them. The first is the Federal Trade Commission, which confirmed last month that it is investigating whether the company violated the consent decree it signed in 2011 over its previous privacy practices. That decree carries civil penalties per violation, and if the commission concludes that the Kogan episode and the company’s failure to confirm deletion of the data were violations, the fine could be in the billions. That is the one American consequence with a real number attached, and it will take a year or more, and the company has nearly five hundred billion dollars in market value to absorb it. A fine of even five billion would be a bad quarter. It would not be a structural change.

The second is Europe, where the General Data Protection Regulation takes effect on May 25 and imposes fines of up to four percent of global revenue for mishandling personal data, requires explicit consent for most uses, and gives users rights to access and delete their information. That regulation was written long before this scandal, it applies to every company with European users, and it is the thing that will actually change platform behavior, because four percent of Facebook’s revenue is a number its board understands. The company has already said it will extend the European protections to users everywhere, in some form, which is a tell: the consequence that moved it was not a Senate hearing but a European fine schedule, and the company is harmonizing to the strictest regime because running two is more expensive than running one.

The third is Congress, and here I will be direct. There will be no federal privacy law this year. The Republican majority does not want one, the Democratic minority cannot pass one, and the hearings this week demonstrated that the knowledge required to write one is not present in either chamber. What Congress can do, and what California is about to do, is leave the question to the states. There is a privacy initiative headed for the California ballot in November that would give residents rights similar to the European ones, and the industry is spending heavily to stop it, which tells you they consider it a more credible threat than anything in Washington. If it passes, every platform will have to comply with California’s rules for California’s forty million people, and in practice that means complying everywhere, because the platforms do not run separate systems by state. The meaningful American regulatory consequence, if there is one, will come from Sacramento, not from the committee rooms that embarrassed themselves this week.

On political influence I will add one observation from the business side. Cambridge Analytica sold a product it could not demonstrate worked, to a campaign whose own digital operation found it useless, and the public has now been persuaded that the product was a mind-control device. That is good for Cambridge Analytica’s competitors, who can sell the same promise, and bad for anyone trying to understand what actually happened in 2016, which was a platform whose engagement algorithm amplified whatever was most provocative, regardless of who paid for it. The regulatory conversation is about data. The problem is the algorithm. Nobody in either hearing asked about the algorithm, and the company’s shares rose on the silence.

So my answer is that the platforms face a reputational consequence that has already been absorbed, a European regulatory consequence that is real and will harmonize their practices worldwide, a possible California consequence that is the only American one with teeth, and a federal consequence that the market has correctly judged to be negligible. The business model is intact. The field is the same. And the clearest sign of that is the one the market gave on Wednesday, which is that the company got more valuable by being questioned, because the questions proved nobody in the room could make it less so.

Long Island, New York Correspondent

The legal fact at the center of this story is one that almost nobody in the hearings mentioned, and it is the one that determines whether anything happens: Facebook is already under a federal order about exactly this. In 2011 the company settled charges from the Federal Trade Commission that it had deceived users about who could see their information, and it signed a consent decree that runs for twenty years and requires it to obtain express consent before sharing data beyond a user’s privacy settings, to maintain a privacy program, and to submit to independent audits. The decree carries civil penalties of something over forty thousand dollars per violation per day. The commission confirmed on March 26 that it is investigating whether the Kogan app episode, in which a researcher collected profiles of eighty-seven million people through a quiz that about two hundred and seventy thousand of them actually took, and the company’s subsequent failure to verify that the data was deleted, violated that order. I spent a decade in a prosecutor’s office and I will tell you that a defendant already on probation who is caught doing the thing the probation was for is in a very different position from a first offender, and the company’s lawyers know it even if the senators did not.

That is the consequence I would watch, and I want to explain why it is more serious than the coverage suggests and less serious than the people hoping for a reckoning want. More serious, because the question is not whether the company behaved badly but whether it breached a specific written obligation, and the record on that is unfavorable: the company learned of the harvesting in 2015, obtained a certification of deletion from Cambridge Analytica that it did not verify, and did not notify the affected users until the newspapers did it for them. If that is not a failure to maintain a privacy program, I am not sure what would be. Less serious, because the commission’s history is of negotiated settlements rather than litigated penalties, and the likely outcome is a fine, large by the commission’s standards and small by the company’s, accompanied by a new round of promises. The per-day penalty arithmetic produces numbers in the billions; the settlement arithmetic produces numbers that a company with forty billion in annual revenue can book as a one-time charge.

Now the hearings, which I watched the way I used to watch a witness who had been prepared too well. Mr. Zuckerberg was polite, repetitive, and almost perfectly uninformative, and he was allowed to be, because the members on both committees had been given five minutes each and most of them spent it on prepared statements. The questions that would have mattered, which are the ones a paralegal would have drafted, were almost never asked: what did the company know in 2015, who decided not to notify users, what did the certification of deletion actually say, and what does the company do today to verify what developers do with data once it leaves the platform. Those are discovery questions, and discovery is not what a congressional hearing is for. A hearing is for members to be seen asking something. The thing I would tell anyone who found the testimony frustrating is that the real questioning is happening at the commission, in writing, with document requests, and that is the process that produces consequences. The hearings produced a stock rally.

On Congress itself, I will be brief and I think my fellow correspondents will agree. There is no federal privacy statute in the United States of the kind that Europe is about to enforce, there is no prospect of one this year, and the hearings demonstrated why: the members who want one cannot describe what it would regulate, and the members who could describe it do not want one. What exists instead is a patchwork, the consent decree for this one company, sector rules for health and finance and children, and state laws that vary widely. That patchwork is going to get a very large new patch on May 25, when the European regulation takes effect and every American company with a European user has to comply with it, and I would expect the practical effect to be that the platforms adopt the European rules worldwide because running two systems is more expensive than running one. That is a consequence, and a meaningful one, and it was imposed by a legislature that is not ours.

On the political influence question, I want to say something from the zoning side of my practice, where I spend my days reading the letters people write when they discover that the code applies to them. Cambridge Analytica is being treated as the villain, and the firm was certainly dishonest, but the thing it did with the data was lawful in the United States at the time, and the thing Facebook did in permitting the collection was arguably lawful too, under terms of service that the users had clicked through without reading. The scandal is not primarily a breach of law. It is a discovery by the public that the law permitted this, and the appropriate response to that discovery is a change in the law, which is the one thing that is not going to happen here. The company will be fined for breaching an order. The practice that the order did not reach will continue.

So my answer is that the platforms face one meaningful American consequence, a consent-decree enforcement action that will produce a large fine and a new set of promises; one meaningful foreign consequence, the European regulation, which will change their practices worldwide because compliance does not respect borders; and no meaningful legislative consequence, because the people who would have to write the law demonstrated this week that they could not. The reputational consequence has already been absorbed by the market. The political consequence, which is the public’s new understanding of what the product is, is real and will last, but it is not a consequence for the platform. It is a consequence for the users, who now know, and who are, by every measure the company publishes, still there.

Gastonia, North Carolina Correspondent

I work in a newsroom that has lost half its staff since 2008, and I want to answer this question from inside that building, because I think the people most qualified to say whether Facebook faces meaningful consequences are the people whose industry Facebook has already consumed, and we are not optimistic. The company did not set out to destroy local newspapers. It set out to keep people on its site, and it discovered that the way to do that was to give them what their friends were sharing, and what their friends were sharing was, increasingly, us, our stories, stripped of our ads and our subscription prompts and repackaged under the company’s logo. The advertising that used to pay for the reporter who covered the county commission went to the company that aggregated the reporter’s work. That is a consequence of the platform’s data practices, in the sense that the data is what lets the company sell the ads, and it happened a decade before anyone had heard of Cambridge Analytica, and nobody held a hearing.

So my first observation about the past four weeks is that the scandal is not the data. The data has been the business all along, and the people who are shocked by it are the people who never asked how a free service that employs thirty thousand people makes forty billion dollars a year. The scandal is the politics. A firm connected to one campaign used harvested profiles to do targeting, the targeting was almost certainly worthless, and the discovery that it existed has been received as proof of a theory about 2016 that half the country already believed. I have read every wire story on this since March 17, which is my job, and I can tell you that the coverage has been shaped less by what Cambridge Analytica did than by what the people writing about it wanted it to mean. That is not a criticism of the story, which is real. It is an observation about why the consequences will be smaller than the coverage implies, because the outrage is partisan, and partisan outrage does not produce bipartisan law.

Here is the thing I keep coming back to, from a copy desk where I see the raw feed before anyone shapes it. In 2012 the Obama campaign built a Facebook app that asked supporters for permission to access their friends’ data, harvested something on the order of a million users’ friend lists, and used them to target persuasion and turnout, and the campaign’s digital team gave interviews about it afterward that the trade press ran as triumphs of innovation. The method was, in its essentials, the one Cambridge Analytica used two years later, with the difference that the 2012 users had been told what the app was for and the 2014 quiz-takers had not. That difference matters, and it is the basis of the legal case against the firm and against Facebook. But the practice, the harvesting of friends’ data through an app permission, was the platform’s design and was celebrated when the right side used it. The members of Congress who were outraged this week were not outraged in 2012, and the ones who are defending the company now would have been outraged then. I do not say that to excuse anyone. I say it because a consequence that depends on which party benefited is not a consequence. It is a season.

Now what actually happens. The Federal Trade Commission has a consent decree from 2011 and an investigation open, and I expect a fine, and I expect it to be the largest the commission has ever levied and a rounding error on the company’s balance sheet. Europe’s regulation takes effect next month and will change the company’s practices worldwide, because that is cheaper than running two systems. Congress will hold more hearings and pass nothing, because the hearings this week made it plain that the members do not know what they would be regulating, and Mr. Zuckerberg’s stock went up while he was being questioned, which is the market’s way of saying it noticed. The reputational hit is real and has already peaked; the delete-Facebook campaign got some celebrities and no measurable change in usage, because the people who are angry at the platform get their news about the platform from the platform.

What I think is the actual consequence, and the one nobody in Washington is discussing, is that the public now knows what we in the newsroom have known for years: that the company is not a neutral pipe, that it decides what people see, and that the deciding is done by a system optimized for engagement rather than truth or balance or anything a newspaper would recognize as an editorial judgment. That knowledge is the consequence, and it is reputational in the deepest sense, because the company’s whole public posture has been that it is a platform and not a publisher. The hearings made that posture harder to hold. Mr. Zuckerberg said several times that the company is responsible for the content on its site, which is a sentence his lawyers will be dealing with for years, because it is the sentence that separates a utility from a newspaper, and newspapers get sued.

I will say where I come out, since I am all over the map and this one is no exception. I think the company behaved badly, I think Cambridge Analytica behaved worse and sold a product that did not work, I think the political targeting panic is overblown and the data business is underexamined, and I think the real damage this platform has done is to the institutions that used to do the job of telling a county what its government was up to, and that damage is permanent and was never on any committee’s agenda. The consequences the question asks about will be a fine, a European rulebook, and a slow erosion of the company’s claim to be a neutral pipe. That is something. It is not accountability. Accountability would be a county commission meeting with a reporter in the room, and there are fewer of those every year, and the company that made that happen was in Washington this week being asked how it makes money.

Sydney, Australia Correspondent

The answer to this question is yes, but not in the United States, and the distinction is the whole story. In six weeks the European Union’s General Data Protection Regulation takes effect, and from that day a company that mishandles the personal data of a European resident can be fined up to four percent of its worldwide revenue, must obtain explicit consent for most uses of that data, must allow users to see and delete what is held about them, and must report breaches within seventy-two hours. That regulation was not written in response to Cambridge Analytica. It was adopted in 2016 after four years of drafting, and the scandal has merely arrived in time to give it a justification that the public understands. Every platform with European users, which is every platform, has spent the past year rebuilding its data practices to comply, and Facebook announced last week that it will extend most of the European protections to users everywhere, because maintaining separate regimes is more expensive than harmonising to the strictest one. That is a meaningful regulatory consequence. It was imposed by Brussels, and the American hearings this week were, by comparison, theatre.

I want to be specific about why the American process produced so little, because I spent years in a federal bureaucracy and I recognise the pattern. The Senate and House committees gave each member a few minutes, the members used them for statements rather than questions, and Mr. Zuckerberg, who had been prepared by a team that anticipated every line of inquiry, answered with apologies and generalities that committed him to nothing. The exchanges that drew the most attention were the ones in which senators revealed that they did not understand the advertising model, and the company’s shares rose throughout, which investors read, correctly, as evidence that the legislature was not equipped to regulate the business. A parliamentary committee in Westminster or Canberra would have had the same witness for a full day, with a chair who controlled the questioning and members who had been briefed by staff with subpoena power, and the transcript would have been usable. The American format is designed to produce clips, and it did.

Australia’s own response is worth a paragraph, because it is more serious than Americans may assume and it predates the scandal. Our competition regulator, the ACCC, was directed in December to conduct a full inquiry into the market power of digital platforms, with particular attention to their effect on news media and advertising, and the preliminary findings are due later this year. Our privacy commissioner opened an investigation into Facebook this month over the roughly three hundred thousand Australian users whose data was swept up through the Kogan app. And our government has, with bipartisan support, been considering whether the platforms should be subject to the same content obligations as broadcasters. None of that will produce a quick result. All of it reflects a view, shared across the Australian political class, that the platforms are too large to be left to self-regulate, and that view was formed before March 17 and has only been confirmed since.

Now the American consequences, which I will assess as an outsider who watches Washington for a living. The Federal Trade Commission’s investigation under its 2011 consent decree is the one with teeth, and it will produce a fine, probably a record one, probably within a year, and probably accompanied by a settlement that commits the company to a new privacy programme that looks very much like the European one it is already building. Congress will pass nothing, because the hearings established that it cannot describe what it would pass, and because the party in the majority does not want a privacy statute and the party in the minority cannot deliver one. The states may act, and California in particular has a ballot initiative in prospect that would give its residents rights resembling the European ones, which the industry is fighting precisely because it would be effective. On present evidence, then, the meaningful American consequences are a federal fine and a possible state law. The federal legislature is a spectator.

On the question of political influence, I would offer a correction to the American debate from the vantage of a country that has its own concerns about foreign interference and has legislated against it. The Cambridge Analytica story is being told as a story about psychographic manipulation, and the evidence that the firm’s product worked, or that it was used in any meaningful way by the campaign that paid for it, is thin to the point of absence. The firm sold a mystique. The influence operations that demonstrably occurred on the platform in 2016 were conducted by a Russian agency using ordinary advertising tools and ordinary accounts, at trivial cost, and succeeded not because of any sophisticated targeting but because the platform’s own engagement mechanics amplified divisive content without regard to its source. A regulation of data practices does nothing about that. What would is a regulation of the amplification itself, and no legislature in the democratic world has yet worked out how to write one without regulating speech, which is why none has.

So my assessment is that the platforms face a meaningful regulatory consequence from Europe, which will reshape their data practices worldwide; a meaningful enforcement consequence from the American trade regulator, which will cost money without changing the model; a possible consequence from California; and no legislative consequence from the American Congress, which demonstrated this week that it is not capable of producing one. The reputational consequence is real, has already peaked, and has not moved the user numbers. And the problem the scandal actually exposed, which is the amplification machinery rather than the data, is one that no government has yet found the vocabulary to regulate, and that will outlast every fine. Clarity over fashion: the fashionable view is that Facebook is finally being held to account. The clear view is that Brussels has done the holding, Washington has done the watching, and the machine is running as before.

Owatonna, Minnesota Correspondent

I have been a private investor for a long time, and I want to approach this question the way an investor would, which is to ask not whether the company did something wrong, which it did, but whether anything that has happened in the past four weeks changes the thing that makes it worth what it is worth. The thing is a network. Two billion people are on Facebook because two billion people are on Facebook; the value of the service to any one user is the presence of everyone else, and no competitor can offer that, because the users are the product and the users cannot be copied. That is a monopoly in the oldest sense, the sense the railroads had before 1887, and it is the reason the stock recovered during the hearings while the chief executive was being scolded: nobody who understood the business believed that a scolding could reduce the number of people who need to be where their friends are.

Let me say what the past four weeks did and did not reveal. They did not reveal that Facebook collects data; everyone who had thought about the company for five minutes knew that. They revealed that the company had, for a period ending in 2015, allowed app developers to collect not only a user’s own data but the data of all that user’s friends, without the friends’ knowledge, and that a researcher used this permission to harvest profiles on eighty-seven million people and sold them to a political consultancy that promised more than it could deliver. The company closed the permission three years ago. It did not notify the affected users, did not verify the deletion it was promised, and did not disclose any of this until two newspapers did. That is a governance failure and a candor failure, and it is the sort of thing that in a regulated industry would produce an enforcement action, and it will, because the Federal Trade Commission has a consent decree from the last time and has opened an investigation under it. The fine will be large by the commission’s standards. It will be a quarter’s worth of earnings for the company, and investors will take it as the cost of a lesson.

Now the historical comparison, because I think it is the only useful way to see where this goes. Every network industry in American history has gone through the same sequence: a period of unregulated growth in which the network becomes essential, a scandal in which the public discovers what the network’s owners have been doing with their position, a period of hearings in which legislators demonstrate that they do not understand the technology, and then, usually a decade later, a regulatory settlement that accepts the network’s existence and constrains its conduct. The railroads got the Interstate Commerce Commission. The telephone company got the Communications Act. The broadcasters got the Federal Communications Commission and the fairness rules. In every case the settlement came after the companies had grown too large to break up and too essential to ignore, and in every case the companies, once they accepted it, found that regulation protected their position by raising the cost of entry for anyone who might have challenged them. Facebook is at the hearings stage. The settlement is years off. And when it comes, I would expect the company to be, as the telephone company was, its most enthusiastic supporter.

On the immediate consequences, I will defer to my fellow correspondents on the European regulation, which takes effect next month and is the one thing that will change the company’s practices worldwide, and I will note only that an investor sees it as a cost of doing business that every competitor also bears, which means it does not change the relative position of anyone. On Congress, I will say that the ten hours of testimony this week produced no legislation and some memorable exchanges and a four-percent gain in the stock, and that a legislature which cannot describe a business cannot regulate it. On reputation, the delete campaign has produced celebrities and no measurable decline in usage, because the people who are angriest about the platform are the ones most dependent on it for their sense of what is going on.

I want to spend a paragraph on the political influence question, because the investor’s view is clarifying here too. Cambridge Analytica sold a psychographic targeting product to a campaign whose own digital team concluded that it did not work. The firm’s parent company has never demonstrated that the method works. The academic literature on micro-targeting suggests effects that are small and hard to distinguish from ordinary advertising. The story of the past four weeks has therefore been a story about a product that was fraudulent in the ordinary commercial sense, a claim of efficacy that could not be supported, and the public has received it as a story about a product that was dangerously effective. That is the mark of a good marketing campaign, and in this case the firm’s marketing has outlived the firm; it suspended its chief executive after being filmed boasting about entrapment, and it will not survive the year. The thing that actually influenced the election on the platform was the platform’s own feed, which rewards whatever provokes, and no data regulation touches that.

So my answer is that the platforms face a real but affordable enforcement consequence in the United States, a real and structural regulatory consequence from Europe that applies to everyone and therefore changes no one’s position, no legislative consequence from Congress, and a reputational consequence that the user numbers show the public has already forgiven. The network is intact, because networks do not break from scandal; they break from a better network, and there is not one. The long-run consequence, which is years away, is the regulatory settlement every network industry eventually gets, and the company will find, as the railroads did, that it can live comfortably inside it. I would not sell. I would not buy either, because I do not like owning things that depend on my neighbors’ inability to leave. But that is a preference, not a forecast, and the forecast is that the people who cannot leave will not.

Bismarck, North Dakota Correspondent

I am going to say the thing that nobody in Washington said this week because it does not make anyone a victim, which is that eighty-seven million people clicked a box. Not the box for the quiz, which only a few hundred thousand took, but the box years earlier when they joined a free service and agreed to terms that said, in language they did not read, that their information and their friends’ information could be shared with applications. They did not read it because nobody reads it, and they did not read it because the service was free and the thing it did was pleasant and the people they knew were on it. I work in compliance, where my whole job is making sure people know what they have agreed to, and I will tell you that there is no form in the world that will protect a person who has decided the form does not matter. The scandal of the past four weeks is being described as a betrayal. It was a transaction, and the people who are shocked by the terms are the people who did not ask what the price of free was.

Now, having said that, let me say the other half, because straight talk cuts both ways. The company knew in 2015 that a researcher had taken the data of tens of millions of people under false pretenses and sold it to a political firm, and the company’s response was to ask the firm to delete it, take the firm’s word that it had, and tell nobody. That is not a user’s failure to read the terms. That is a company that discovered its product had been stolen and decided the customers did not need to know. In my industry, a company that learned of a leak and chose not to report it would be in front of a regulator inside a month, and the regulator would not care that the leak had been plugged. Facebook is in front of a regulator now, the Federal Trade Commission, which has a consent order from 2011 and has opened an investigation under it, and I expect the company to pay a very large fine for the one thing it unambiguously did wrong, which was not the collecting but the silence.

So what consequences are meaningful? I will go through them the way I would go through a compliance finding, by severity. The most severe is the European regulation that takes effect next month, which I will not pretend to be an expert in but which my employer has spent a year preparing for because we have customers across the water, and which will require every platform to get real consent, keep real records, and pay real fines if it does not. That will change how the platforms behave, worldwide, because they will not run two systems. The second is the American enforcement action, which will produce a fine and a new set of promises and a new round of audits, and which the company will treat as the cost of having been careless. The third is Congress, and here I will say what everyone in North Dakota said after watching the hearings, which is that our senators did not look like people who were about to write a law, and neither did anyone else’s. The fourth is reputation, and I have two teenagers who told me this week that they do not use Facebook anyway, which is the actual reputational threat to the company and has nothing to do with Cambridge Analytica. The company owns the platform they do use. The consequence is already priced in.

On political influence, I want to say something from the Plains that the coastal conversation is missing. The people here are being told that they were manipulated by a British firm using a personality quiz, and they do not believe it, and they are right not to. The firm sold a product that its own clients found useless. The targeting that actually happens on these platforms is the targeting I see in my own feed, which is ordinary advertising that knows I live in Bismarck and bought a truck last year, and which is no more sinister than the coupons the grocery store prints based on what I bought last week. The outrage about political manipulation has a partisan shape; the same practices were praised in 2012 when the other side used them, and the people most alarmed now were not alarmed then. I do not say that to defend the firm, which was run by men who were filmed boasting about entrapment. I say it because a consequence that depends on who was helped is not accountability. It is a grudge, and grudges do not produce law.

What would produce law is something nobody is asking for, which is a plain statement of what a person gives up when they join a free service, in words a person would actually read, with a real choice attached. That is what my industry calls informed consent and it is what the European rule is attempting to require, and it is not what the American debate is about. The American debate is about whether a company helped the wrong candidate. That debate will end when the news cycle does. The question of what people have agreed to will not, because they will go on agreeing, and the company will go on collecting, and the next scandal will be the same as this one with a different firm’s name attached.

So my answer is that the platforms face a meaningful consequence from Europe, an affordable consequence from the American regulator, no consequence from Congress, and a reputational consequence that the users themselves have already decided to forgive, because they clicked the box and they will click it again. The company was careless and then silent, and it should pay for the silence. The users were incurious, and they are paying for that already, in the form of a product that knows them better than their neighbors do. Nobody in Washington is going to fix either problem, because fixing the first requires understanding the business and fixing the second requires telling the voters they agreed to it, and neither of those is something a senator does on television.

Jacksonville, Florida Correspondent

I spent time in a state office that measured success in press releases, and I know a press release when I see one, and ten hours of congressional testimony is a press release with a longer run time. I watched a fair amount of it on my phone between dispatch calls, and the thing I kept thinking was that nobody in that room was going to decide anything, that everyone in that room knew it, and that the point of the exercise was for each of them to be seen having asked. The chief executive apologized, which he has done after every scandal since 2007, and the members scolded, and the stock went up, and the next morning the terminal was running the same software it always runs and so, I suspect, was the platform. So I want to answer this question from the dock rather than from the hearing room, which means asking what actually changed for the people who use the thing, and I think the honest answer is: their understanding, and nothing else, and the understanding will not last.

Let me describe the people, because they are the consequence that matters. My son is nine and does not use Facebook and will not; his generation is on the platforms the company bought, and they regard Facebook as the place their grandparents post. The drivers I dispatch use it for the group pages where they find loads and complain about the terminals, and not one of them has left this month, because the group pages are where the loads are. My mother uses it to see pictures of my son, and when I asked her about the scandal she said she assumed they knew everything already and did not see why anyone was surprised. That is three generations of users in one family, and the scandal changed the behavior of none of them, because none of them joined the platform believing it was private, and none of them can leave it without leaving the people who are on it. The delete campaign got a billionaire and some journalists. It did not get a single driver in Duval County, and the drivers are the business.

Now the consequences the question actually asks about, and I will go through them quickly because I think my fellow correspondents will go through them slowly. The Federal Trade Commission has a consent order from 2011 and an investigation open, and I expect a fine, large for the commission and small for the company, for the one thing the company clearly did wrong, which was learning in 2015 that the data had been taken and telling nobody. The European rules that start next month will change the company’s practices everywhere, because one rulebook is cheaper than two, and that is the real regulatory consequence and it was written by people who are not in Congress. Congress will hold more hearings. It will not pass a law, because the hearings showed that the people who would write it cannot describe the thing it would govern, and because the party that could pass one does not want to and the party that wants to cannot. That is the whole American regulatory picture, and it fits on an index card.

On political influence, I will say what I believe, which is that the people being told they were manipulated are being sold a second product by the people who sold the first. Cambridge Analytica told a campaign it had a system for reading voters’ minds, the campaign’s own people found the system useless, the firm’s executives were filmed bragging about things that have nothing to do with data, and the firm is now being described in the press as the thing that decided an election. I have been a claims adjuster. I know what it looks like when a loss is being inflated after the fact. The real thing that happened on the platform in 2016 was a foreign operation using the same cheap tools every car dealership uses, and it worked because the platform shows people whatever makes them angry, and no data rule touches that. The scandal is about data because data can be regulated. The problem is the feed, and the feed cannot be regulated without regulating what people are allowed to see, and nobody in a democracy wants to be the one who writes that rule.

I want to add one thing from the port, because it is where I see the consequence that nobody is discussing. The company has announced it will cut off the third-party data brokers that let advertisers match purchase records to profiles, and that it will restrict what developers can see, and that it will require political advertisers to verify their identity. Every one of those changes makes the platform less useful to small operators, the trucking companies and the drayage outfits and the family restaurants that reach customers for a few dollars a day, and none of them inconveniences a national campaign or a national brand. The platform’s response to being caught serving a big customer badly is to serve its small customers worse. That is a consequence, and it falls on people who were not in the room and did nothing wrong, which is, in my experience, where consequences in this country usually fall.

So my answer is that the platforms face one real American consequence, a fine for the silence; one real foreign consequence, a rulebook from Brussels; no legislative consequence, because the legislature proved it could not write one; and a reputational consequence that the users have already decided does not apply to them, because they never thought the service was private and they cannot leave the people who are on it. The understanding has changed. The behavior has not. And the people who will actually pay for the scandal are the small businesses whose targeting just got worse, which is the consequence that will reach my terminal and will not reach a hearing room. I am not a mascot for the platform or for the people attacking it. I move freight. The freight is moving. So is the data.