RUTHFULLY YOURS

Mr. Zuckerberg’s defense? Facebook was too “trusting.” After the Guardian newspaper reported in 2015 that a Cambridge University researcher had shared data from his personality-quiz app with the political firm Cambridge Analytica , Facebook asked Cambridge Analytica to delete the data. Cambridge Analytica said it had, and Facebook accepted its word.

The incident demonstrated that Facebook’s privacy protections were flimsier than it claimed. In 2011 Facebook settled charges with the Federal Trade Commission (FTC) over mishandling user data, and Facebook agreed to establish stronger privacy protections and obtain periodic third-party audits. But Facebook has now disclosed that tens of thousands of apps may have obtained data on users and their friends beyond what they needed to operate.

This seems to violate the FTC’s consent decree, as Connecticut Senator Richard Blumenthal noted. Mr. Zuckerberg waffled in reply that “it certainly appears that we should have been aware that [the researcher] submitted a term that was in conflict with the rules of the platform.” But he said the third-party audits didn’t turn up problems.

The FTC is now investigating Facebook’s privacy controls, but a few questions: Why didn’t the commission ensure years ago that Facebook had established policies to prevent third-party apps from repurposing data? Was the agency too trusting? The Obama campaign app in 2012 exploited data from users and their friends. This may also have violated the FTC consent decree, especially if it shared the data with other liberal groups. Did political considerations influence the FTC’s lax oversight?

These are important questions since Democrats are pressing for more stringent privacy regulations, which Mr. Zuckerberg said he’s open to. But regulation typically benefits incumbents like Facebook that can afford to spend more on compliance while tripping up small competitors. Before establishing new regulations, the FTC should ensure that tech companies abide by their own policies.

Mr. Zuckerberg was also keelhauled for letting Russians exploit the platform in 2016. Facebook has since identified 470 pages and accounts linked to the Russian-controlled Internet Research Agency, which generated at least 200,000 pieces of content over two years. The Russian outfit also bought 3,000 ads on Facebook and Instagram.

The spread of fake news was partly due to Mr. Zuckerberg’s refusal to exercise editorial control over content or pay for quality news. Employing people to sift out junk is expensive, though the increased regulation that may come if he doesn’t also isn’t cheap.

But Facebook can’t be held entirely responsible for Russia’s interference. Only the Justice Department can see across media channels and has the power to investigate election fraud, as special counsel Robert Mueller’s indictment of 13 Russians in February showed.

The Russians began organizing in 2013 and stole American identities. “Beginning in or around June 2014, and continuing into June 2015, public reporting began to identify operations conducted by the [IRA] in the United States,” the indictment says. The Russian operatives also created fake accounts on Twitter and YouTube. Yet the Obama Administration waited until December 2016 to slap sanctions on Russians for hacking Democratic National Committee emails. It doesn’t appear that social- media interference was ever a priority.

While Facebook has endorsed legislation that would require more disclosure for buyers of political ads, the regulatory burden could make it harder for small companies and blogs to sell ads. This could drive more political advertising to Facebook. And it’s unclear how the legislation would prevent identity fraud.

Democrats are bitter that President Trump won the election and are using Facebook as a scapegoat. Facebook is hardly blameless, but neither is the Obama Administration.