“Dumb fucks.” That’s how Mark Zuckerberg described users of Facebook for trusting him with their personal data back in 2004. If the last week is anything to go by, he was right.

Since the Observer reported that the personal data of about 50 million Americans had been harvested from Facebook and improperly shared with the political consultancy Cambridge Analytica, it has become increasingly apparent that the social network has been far more lax with its data sharing practices than many users realised.

As the scandal unfurled over the last seven days, Facebook’s lackluster response has highlighted a fundamental challenge for the company: how can it condemn the practice on which its business model depends?

“This is the story we have been waiting for so people will pay attention not just to Facebook but the entire surveillance economy,” said Siva Vaidhyanathan, a professor of media studies at the University of Virginia.

Since Zuckerberg’s “dumb fucks” comment, Facebook has gone to great lengths to convince members of the public that it’s all about “connecting people” and “building a global community”. This pseudo-uplifting marketing speak is much easier for employees and users to stomach than the mission of “guzzling personal data so we can micro-target you with advertising”.

In the wake of the revelations that Cambridge Analytica misappropriated data collected by Dr Aleksandr Kogan under the guise of academic research, Facebook has scrambled to blame these rogue third parties for “platform abuse”. “The entire company is outraged we were deceived,” it said in a statement on Tuesday.

However, in highlighting the apparent deceit, the company has been forced to shine a light on its underlying business model and years of careless data sharing practices.

Sure, the data changed hands between the researcher and Cambridge Analytica in apparent violation of Kogan’s agreement with Facebook, but everything else was above board. The amount of data Cambridge Analytica got hold of and used to deliver targeted advertising based on personality types – including activities, interests, check-ins, location, photos, religion, politics, relationship details – was not unusual in the slightest. This was a feature, not a bug.

‘Extremely friendly to app developers’

There are thousands of other developers, including the makers of the dating app Tinder, games such as FarmVille, as well as consultants to Barack Obama’s 2012 presidential campaign, who slurped huge quantities of data about users and their friends – all thanks to Facebook’s overly permissive “Graph API”, the interface through which third parties could interact with Facebook’s platform.

Facebook opened up in order to attract app developers to join Facebook’s ecosystem at a time when the company was playing catch-up in shifting its business from desktops to smartphones. It was a symbiotic relationship that was critical to Facebook’s growth.

“They wanted to push as much of the conversation, ad revenue and digital activity as possible and made it extremely friendly to app developers,” said Jeff Hauser, of the Center for Economic and Policy Research. “Now they are complaining that the developers abused them. They wanted that. They were encouraging it. They may now regret it but they knowingly unleashed the forces that have led to this lack of trust and loss of privacy.”

The terms were updated in April 2014 to restrict the data new developers could get hold of, including people’s friends’ data, but only after four years of access to the Facebook firehose. Companies that plugged in before April 2014 had another year before access was restricted.

“There are all sorts of companies that are in possession of terabytes of information from before 2015,” said Hauser. “Facebook’s practices don’t bear up to close, informed scrutiny nearly as well as they look from the 30,000ft view, which is how people had been viewing Facebook previously.”

For too long consumers have thought about privacy on Facebook in terms of whether their ex-boyfriends or bosses could see their photos. However, as we fiddle around with our profile privacy settings, the real intrusions have been taking place elsewhere.

“In this sense, Facebook’s ‘privacy settings’ are a grand illusion. Control over post-sharing – people we share to – should really be called ‘publicity settings’,” explains Jonathan Albright, the research director at the Tow Center for Digital Journalism at Columbia University. “Likewise, control over passive sharing – the information people [including third party apps] can take from us – should be called ‘privacy settings’.”

Essentially Facebook gives us privacy “busywork” to make us think we have control, while making it very difficult to truly lock down our accounts.

‘The biggest issue I’ve ever seen’

Facebook is dealing with a PR minefield. The more it talks about its advertising practices, the more the #DeleteFacebook movement grows. Even the co-founder of WhatsApp Brian Acton, who profited from Facebook’s $19bn acquisition of his app, this week said he was deleting his account.

“This is the biggest issue I’ve ever seen any technology company face in my time,” said Roger McNamee, Zuckerberg’s former mentor.

“It’s not like tech hasn’t had a lot of scandals,” he said, mentioning the Theranos fraud case and MiniScribe packing actual bricks into boxes instead of hard drives. “But no one else has played a role in undermining democracy or the persecution of minorities before. This is a whole new ball game in the tech world and it’s really, really horrible.”

Facebook first discovered that Kogan had shared data with Cambridge Analytica when a Guardian journalist contacted the company about it at the end of 2015. It asked Cambridge Analytica to delete the data and revoked Kogan’s apps’ API access. However, Facebook relied on Cambridge Analytica’s word that they had done so.

When the Observer contacted Facebook last week with testimony from a whistleblower stating that Cambridge Analytica had not deleted the data, Facebook’s reaction was to try to get ahead of the story by publishing its own disclosure late on Friday and sending a legal warning to try to prevent publication of its bombshell discoveries.

Then followed five days of virtual silence from the company, as the chorus of calls from critics grew louder, and further details of Facebook’s business dealings emerged.

A second whistleblower, the former Facebook manager Sandy Parakilas, revealed that he found Facebook’s lack of control over the data given to outside developers “utterly horrifying”. He told the Guardian that he had warned senior executives at the company that its lax approach to data protection risked a major breach, but that he was discouraged from investigating further.

At around the same time, it emerged that the co-director of the company that harvested the Facebook data before passing it to Cambridge Analytic is a current employee at Facebook. Joseph Chancellor worked alongside Kogan at Global Science Research, which exfiltrated the data using a personality app under the guise of academic research.

Demand for answers

Politicians on both sides of the Atlantic called for answers. In the US, the Democratic senator Mark Warner called for regulation, describing the online political advertising market as the “wild west”.

“Whether it’s allowing Russians to purchase political ads, or extensive micro-targeting based on ill-gotten user data, it’s clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency,” he said.

The Federal Trade Commission plans to examine whether the social networking site violated a 2011 data privacy agreement with the agency over its data-sharing practices.

In the UK, MPs summoned Facebook’s chief executive, Mark Zuckerberg, to give evidence to a select committee investigating fake news.

“I think they are in a very bad situation because they have long benefitted from the tech illiteracy of the political community,” said Hauser.

The backlash spooked investors, wiping almost $50bn off the valuation of the company in two days, although the stock has since rallied slightly.

On Wednesday, Zuckerberg finally broke his silence in a Facebook post acknowledging that the policies that allowed the misuse of data were a “breach of trust between Facebook and the people who share their data with us and expect us to protect it”.

Facebook’s chief operating officer, Sheryl Sandberg, added her own comment: “We know that this was a major violation of people’s trust, and I deeply regret that we didn’t do enough to deal with it.”

The company will investigate apps that had access to “large amounts of information” before the 2014 changes and audit thousands of apps that show “suspicious activity”. The company will also inform those whose data was “misused”, including people who were directly affected by the Kogan operation.

These actions don’t go far enough, said Vaidhyanathan.

“Facebook has a history of putting on that innocent little boy voice: ‘Oh I didn’t know that I shouldn’t hold the cat by its tail,’” he said. “I think we’re tired of it at this point.”

These problems were pointed out by scholars years ago, said Robyn Caplan, a researcher at Data & Society, but Facebook’s response was slow and insufficient.

“They have been trying to put out a lot of little fires but we need them to build a fire department,” she said.