Facebook’s reign of unpunished rule-breaking is coming to an end

Sorry seems to be the hardest word, they say.

And for tech-superstar-turned-virtual-antichrist Mark Zuckerberg, it certainly seems difficult.

The scandal over the unorthodox use of Facebook user data by political consultancy firm Cambridge Analytica isn’t going away. It’s been nearly a week since the Guardian profiled whistleblower Christopher Wylie, who explains how the company scraped data from 50m Facebook users, without their explicit permission, which was then used to target political ads in the US presidential election.

Read more: The real Cambridge Analytica scandal is how much data we freely give away

There are numerous issues here that have sparked furious debate. Some claim that the revelations of murky political ad targeting somehow invalidate Donald Trump’s election. That’s a wishful exaggeration, but this has raised concerns about the types of campaigns that benefit most from our obsession with social media – namely populist ones, that feed off emotion.

Remember that earlier this month we discovered that a fake news story spreads six times faster on social media than a real one. Clearly we all have some more thinking about echo chambers and confirmation bias to do.

Then there’s the legal angle, with questions justifiably being asked about whether this data was gathered and utilised without permission.

If we click “agree” without reading the fine print, are we at fault for carelessness, even if the “contract” is written in such convoluted and lengthy legalese that no normal person could be expected to understand it? If you “consent” to your data being used by one company, does that imply consent for that firm to sell it to a third party?

Crucially, did Cambridge Analytica and the academic who scraped the data actually break any laws?

All these are important questions that require serious investigation and debate in the coming months.

But what fascinates me most has been Facebook’s response. After days of outrage, Zuckerberg himself finally came forward on Wednesday with a formal statement and an interview with CNN.

He acknowledged that there had been a “breach of trust” and promised that Facebook would do more to fix the very obvious problems with the way the site handles data. And eventually, in a roundabout way, he said “sorry” – for the situation, rather than for his role or Facebook’s, but still a big concession for a man whose company motto was “move fast and break things”.

Why the change of heart? Because this time, it looks like the backlash may be serious.

Recently, the rosy gloss over the way we view tech firms has started to be chipped away. From tax avoidance to rule violations to misuse and abuse of data, the scandals are mounting up.

Tech giants, from Facebook to Google to Amazon, have so far worked on the basis that it doesn’t matter if governments and regulators despise them – in their users’ eyes, they can do no wrong. They provide services that are so cheap and convenient that customers will forgive any breach of ethics.

And that has mostly proved true. Every so often a wave of anti-Facebook sentiment surfaces (usually shared widely on the platform itself), with activists urging users to boycott the site. But it never catches on.

This time feels different. Even the co-founder of WhatsApp has urged users to delete their Facebook accounts. Cambridge Analytica may not have broken the law, but the idea that data on how we interact online could be collected without our permission, sold to a third party, then used to build profiles of us that could potentially impact an election, all without our knowledge, seems to cross some psychological line.

Yes, we should all have been less naive with what we share. Yes, we’ve been happy to hand this data to marketers for years. Yes, some of the outrage now is fuelled by anti-Trump sentiment.

But Zuckerberg is no longer the Golden Child of the internet. Millennials in particular, who came of age online, are changing their minds. Backlash is coming, and tech giants can no longer count on public support to shield them from the consequences of their rule-breaking.

Facebook isn’t going anywhere soon – the power and data it has accumulated make it unbelievably resilient. But it is losing it invincibility. And the fact that Zuckerberg finally said sorry, however indirectly, shows he knows it.

Read more: DEBATE: Will Facebook still be relevant in 10 years?