Facebook (FB) has dominated the financial news cycle over the past weeks pursuant to its relationship with Cambridge Analytica, a political consulting firm with ties to Steve Bannon. Cambridge did digital work for Donald Trump’s 2016 presidential campaign. Apparently, the firm obtained private Facebook data to target millions of its users for ads promoting Trump:

The New York Times and Observer reported last week that Cambridge obtained private Facebook data — specifically, information on tens of millions of Facebook profiles — from an outside researcher who provided it to them in violation of his own agreement with Facebook.

Meanwhile, Channel 4 News in the UK has posted video in which Cambridge CEO Alexander Nix says his firm conducts dirty tricks such as trying to tape its candidates’ opponents accepting purported bribes or sending “some girls around to the [opposing] candidate’s house.” As a result of these reports, Cambridge announced Tuesday afternoon that it would suspend Nix pending an investigation.

Ties to Cambridge have raised legal and ethical concerns about who has access to consumers’ private data and what it is being used for. FB is down over 15% over the past month, largely due to the Cambridge dust up. Below I will parse through the dust up and explain what it means for FB investors.

The Dust Up Is At The Heart Of Facebook's Business Model

The Cambridge debacle strikes at the hear of Facebook’s business model. It also forces investors, consumers and potentially, lawmakers, to become more thoughtful about it. CEO Mark Zuckerberg’s ability to collect data, analyze it and package it in a way to target advertisers is at the core of Facebook’s business model. In Q4 2017 Facebook generated nearly $13 billion in revenue – 99% of that represented advertising dollars. In the past there may have been some confusion over whether Facebook sold data to third parties. Edward Snowden also brought this to the public’s attention.

I always assumed they did. As a publicly-traded company Facebook almost has a fiduciary responsible to increase shareholder value, as long as it does not run afoul of any laws. My intuition tells me that Cambridge Analytics likely used the Facebook data to [i] search for consumers in vulnerable states like Pennsylvania or Wisconsin, [ii] determine which were likely to vote for Hillary Clinton and [iii] target them with advertisements to potentially sway them to vote for Trump or not to vote at all.

Trump was known for being efficient with his campaign spending, and such targeted ad spending could have helped him get the most for his money. This is all speculation on my part and I have no proof of this. Secondly, it does raise ethical issues over whether a foreign entity like Cambridge should have access to consumers’ data in order to influence a U.S. election.

Could It Hurt User Sentiment?

I personally have friends and family members who are addicted to Facebook. They spend more time interacting with people on Facebook than they spend on the telephone or engaging in face-to-face contact. I cannot imagine the most-loyal Facebook fans leaving the site. However, I also believe many Facebook users would be appalled if they knew their private data was being used to help President Trump win the election. I believe millions of Facebook users were naive as to how their data was being used or potentially sold by the company. Now that the information is in the public eye it is up to them to decide whether or not to delete their accounts.

I personally use the site to post news articles and search for some of my friends from high school or college who I have lost touch with. I rarely engage with the site out of fear the company will use my personal information in a way I do not approve of. I believe the most likely scenario is that consumers will maintain their accounts, but engage less and less with the site. How much value advertisers or investors place on Facebook user engagement could drive the narrative going forward.

Will It Hurt Advertiser Sentiment?

Facebook has over 2 billion monthly active users (“MAUs”). The chance to reach them with targeted ads is almost too attractive too ignore. Advertisers have to decide whether the upside of reaching billions of people with an ad campaign is worth potentially having their brand tarnished by being associated with Cambridge. Companies could do a risk assessment of Zuckerberg and Facebook. However, it could be difficult to know what third-parties Facebook is selling data to, what they are using it for and who they are sharing it with.

Mozilla recently decided to stop advertising on Facebook’s platform. Mozilla was concerned that Facebook had not taken enough precautions to limit developer access to friends’ data. It intimated it would consider returning once Facebook “strengthened its default settings for third party apps.” I also understand Commerzbank (CRZBF) pulled its advertising from the platform. Who is to say others will not follow suit?

Will It Hurt Facebook's Revenue?

I doubt the loss of two or three clients could dent Facebook’s quarterly revenue. For now what matters most are (“MAUs”) MAU growth. At Q4 Facebook had 1.4 billion daily actively users (“DAUs”) and 2.1 billion MAUs. Both metrics grew Y/Y by high single-digits. One of the first things I noticed was that user growth had slowed. The company’s MAUs were not much higher than the 1.94 billion it had at Q1 2017.

The slow down in Facebook’s month-over-month user growth was not lost on Techcrunch editor Josh Constine either:

Facebook now has 1.4 billion daily users, up 2.18% compared to growing 3.8% to 1.37 billion users in Q3. That’s a sizeable slow down, and the lowest quarter-over-quarter percentage daily user growth ever reported by the company.

That could be because CEO Mark Zuckerberg says Facebook made changes including showing fewer viral videos “that reduced time spent on Facebook by roughly 50 million hours every day.” That equates to 2.14 minutes per daily user per day, or 5% of total time spent on Facebook. The viral video changes triggered Facebook’s first-ever decline in daily active users in the US & Canada region, which saw a 700,000 user decline.

The month-over-month slow down was to be expected after Facebook reached a critical mass of users. In my opinion, the biggest risk to advertising on Facebook is that users may not be as engaged as one would like. The MAUs and MAU growth do not necessarily measure [i] user engagement, [ii] how long a subscriber spent on watching a Facebook ad or video or [iii] if a brand is associated with negatively-charged content. I doubt a maker of bath salt would want its brand associated with the “bath-salt challenge” popularized by teens.

The Cambridge debacle raises several questions. “Did Facebook know what Cambridge was doing with its user data? Were customers aware of the level of third-party developer access to users’s data?” If Facebook hid these details from institutions and/or users then what else could it be hiding? The next stage of transparency will likely surround the level of engagement pursuant to Facebook ads. I expect advertiser to push for metrics on how engaged users are and will likely ask for it at a granular level. If Facebook cannot provide it then it could behoove customers to assume the worst – [i] users are not as engaged with the ads as once assumed and/or [ii] user engagement level is on the decline.