The Federal Trade Commission has opened an investigation into Facebook following reports that a data analytics firm that had worked with the Trump campaign had improperly accessed names, “likes” and other personal information about tens of millions of the social site’s users without their knowledge.

The FTC probe – confirmed by a source familiar with the agency’s thinking and not authorized to speak on the record — marks the most substantial political and legal threat yet to Facebook as it grapples with the fallout from Cambridge Analytica and its controversial tactics. And it could result in the U.S. government slapping Facebook with a massive fine.

At issue for the company — and at the heart of the FTC probe — is a settlement they reached with the agency in November 2011, ending an investigation that Facebook deceived users about the privacy protections they are afforded on the site.

Among other requirements, the resulting consent decree mandated that Facebook must notify users and obtain their permission before data about them is shared beyond the privacy settings they have established. It also subjected Facebook to 20 years of privacy checkups to ensure its compliance.

Recently, though, former FTC officials have said that Facebook’s entanglement with Cambridge Analytica may have violated the company’s legal agreement with the federal watchdog agency. Whistleblowers in recent days contend that Cambridge Analytica collected information about users and their friends under a since-ceased policy governing third-party apps on Facebook – then kept that data even after Facebook asked that it be deleted.

About 270,000 users downloaded Cambridge Analytica’s app. But the firm was able to obtain personal information about their friends, who likely had no knowledge that their data was being collected. Roughly 50 million people may have been affected.

If the FTC ultimately finds that Facebook broke that agreement, it could fine the company $40,000 for each violation.

On Tuesday, Rob Sherman, the company’s deputy chief privacy officer, appeared to acknowledge the FTC’s interest. “We remain strongly committed to protecting people’s information. We appreciate the opportunity to answer questions the FTC may have,” he said in a statement. Earlier in the weekend, though, the social network strongly rebuffed allegations that it had run afoul of its 2011 agreement with the FTC.

“We reject any suggestion of violation of the consent decree. We respected the privacy settings that people had in place. Privacy and data protections are fundamental to every decision we make,” a spokesman said in a statement.

Shares of Facebook fell as much as 5.5 percent in morning trading Tuesday, a day after dropping nearly 7 percent on Monday.

The FTC, for its part, said on Tuesday it is “aware of the issues that have been raised but cannot comment on whether we are investigating.”

In doing so, though, an FTC spokeswoman sought to brandish the agency’s enforcement powers. “We take any allegations of violations of our consent decrees very seriously as we did in 2012 in a privacy case involving Google,” she said. That referred to an incident in which the FTC fined Google $22.5 million for misstating its privacy practices, a violation of Google’s own 2011 consent decree with the FTC.

“It makes perfect sense that the FTC is launching an investigation,” said David Vladeck, who served as director of the FTC’s Bureau of Consumer Protection and oversaw the 2011 investigation into Facebook. He said there’s a “strong possibility” that Facebook violated its consent decree while Cambridge Analytica violated federal rules that prohibit unfair, deceptive acts or practices.

An FTC probe only adds to mounting legal and political woes for Facebook. Already, a torrent of Democrats and Republicans on Capitol Hill have demanded that the company’s chief executive, Mark Zuckerberg, testify about the company’s privacy practices as well as the incident involving Cambridge Analytica.

So far, a hearing has not been scheduled. But one key panel — the Senate Commerce Committee — has invited Facebook representatives to brief them on the matter, a spokesman said Tuesday.

Another lawmaker, Democratic Sen. Richard Blumenthal (Conn.), said that Congress should also focus its attention on Cambridge Analytica. He even stressed in a tweet that the Senate Judiciary Committee should go as far as subpoenaing the data analytics firm, if necessary.

“Congress should focus on Facebook – but equally on Cambridge Analytica, engaging in theft and misuse of personal data, dirty tricks, and services for Russians,” Blumenthal added.

In Europe, meanwhile, regulators there have said they would open investigations into Facebook. And a key parliamentary committee in the United Kingdom on Tuesday formally asked Zuckerberg to appear before his panel.

Repeatedly, though, Facebook has not said if it would make Zuckerberg available to answer lawmakers’ questions.