Facebook Inc. estimated that it will cost as much as $5 billion to resolve a U.S. investigation into its privacy practices, as the social-media company moves to put the fallout from the Cambridge Analytica scandal behind it.

Facebook earlier said that it took a $3 billion charge related to the investigation by the Federal Trade Commission(FTC) into whether the company violated a 2011 privacy settlement with the agency.

“We estimate that the range of loss in this matter is $3 billion to $5 billion,” Facebook said. “The matter remains unresolved, and there can be no assurance as to the timing or the terms of any final outcome.”

A settlement with the FTC would resolve one of the biggest liabilities hanging over the company in the wake of news that data on tens of millions of users was obtained by now-defunct consulting firm Cambridge Analytica. An agreement with the agency could also impose changes to the company’s business practices.

Separately, Facebook is in advanced talks with a group of states to resolve investigations into whether the Cambridge Analytica incident violated local consumer-protection laws, according to three people familiar with the matter.

State attorneys general have been negotiating an agreement with Facebook that would require the company to pay an unspecified fine and implement changes to its business practices aimed at improving user privacy, one of the people said. A final agreement could be weeks away, two of the people said. The amount Facebook set aside doesn’t cover a settlement with the states.

The charge related to the FTC case doesn’t guarantee the company will reach a final agreement with the agency. The FTC has the option of pursuing a federal court case to enforce the 2011 consent order if it can’t reach an acceptable agreement. The FTC declined to comment on Facebook’s disclosure. A $3 billion settlement would be a record for the agency in a privacy case.

Under the terms of the 2011 settlement with the FTC, Facebook agreed to get user consent for certain changes to privacy settings. The agreement stemmed from claims that it deceived consumers and forced them to share more personal information than they intended. That complaint arose after the company changed some user settings without notifying its customers.

Millions of Users
In the Cambridge Analytica scandal, the British political consultancy which had ties to Donald Trump’s presidential campaign obtained the data of millions of Facebook users without their consent.


The states that have been investigating Facebook include Pennsylvania, Illinois, Connecticut, New York, New Jersey and Massachusetts, Bloomberg has reported. Representatives of the states either declined to comment or didn’t immediately respond to requests for comment.

While the amount of money at issue in the talks with the states couldn’t be learned, states have a track record of extracting significant penalties from companies for wrongdoing, most notably a sweeping $246 billion settlement with the tobacco industry in the 1990s. In September, Uber paid $148 million to 50 states and the District of Columbia to settle claims related to a large-scale data breach in 2016 that exposed the personal information of more than 25 million of its U.S. users.

More Investigations
Besides the states and the FTC, Facebook is grappling with a criminal investigation by federal prosecutors in New York, a consumer protection lawsuit filed by Karl Racine, the attorney general for Washington, DC, and a privacy suit by the Cook County, Illinois, state attorney, Kimberly Foxx.


Foxx is trying to obtain Facebook documents that could show the company knew about the Cambridge Analaytica scandal earlier than previously thought, according to a person familiar with her case.

“Facebook must fully disclose to the public what happened and take concrete steps to ensure it will never happen again,” Foxx said in an email.

Racine has also been embroiled in a battle to obtain email communications between Facebook employees in Washington and California, who discussed problems about Cambridge Analytica. Facebook attorneys are seeking to keep the document under seal, but Racine is looking to make the email communications public. A spokesman for Racine’s office declined to comment.