Facebook founder Mark Zuckerberg has admitted that the social network “made mistakes” that led to millions of Facebook users having their data exploited by a political consultancy.
Cambridge Analytica is accused of improperly using the data on behalf of political clients.
In a statement, Mr Zuckerberg said a “breach of trust” had occurred.
In a later interview with CNN he said he was “really sorry”, and pledged to take action against “rogue apps”.
He added that he was “happy” to testify before Congress “if it’s the right thing to do”.
Analysis by Dave Lee, BBC North America technology reporter, at Facebook’s headquarters
I read one thing loud and clear from Mr Zuckerberg’s initial statement: Facebook is not prepared to take the blame for what has happened.
Contrition has never been Mr Zuckerberg’s strong point, and the statement, days in the making, was no different.
No apology to users, investors or staff over how this incident was allowed to happen by the data policies in place at the time.
No explanation as to why, after learning its data was being abused like this in 2014, it opted to give the companies a telling off instead of banning them outright.
No reasoning as to why Facebook failed to inform users their data may have been affected. Technically, it still hasn’t.
Mr Zuckerberg’s words were not an explanation, but a legal and political defence. This company knows it is heading into battle on multiple fronts.
Follow Dave Lee on Twitter @DaveLeeBBC