Downing Street has expressed its concern about the Facebook data breach involving the analytics company that worked with Donald Trump’s campaign team and that affected tens of millions of people.

No 10 weighed in on the row as almost $20bn (£14bn) was wiped off the social network company’s market cap in the first few minutes of trading on the Nasdaq stock exchange, where Facebook opened down more than 3%. By midday, the company’s share price losses had multiplied to more than $40bn, making the day its worst in more than five years.

Theresa May’s spokesman said she backed an investigation by the information commissioner, which was prompted by a whistleblower who told the Observer how Cambridge Analytica had harvested millions of Facebook profiles to influence voters through “psychographic” targeting.

The European parliament president, Antonio Tajani, said on Monday that the institution would investigate fully. Tajani urged the social media company to take more responsibility, saying on Twitter that “allegations of misuse of Facebook user data is an unacceptable violation of our citizens’ privacy rights”.

In the US, a state attorney general has called for investigations, greater accountability and regulation, while the head of the parliamentary committee in the UK investigating fake news accused Cambridge Analytica and Facebook of misleading MPs, with the secretary of state for digital, culture, media and sport warning of an end to the “wild west” of technology firms.

“The allegations are clearly very concerning. It’s essential people can have confidence that their personal data can be protected and used in an appropriate way,” May’s spokesman said.

“So it is absolutely right the information commissioner is investigating this matter and we expect Facebook, Cambridge Analytica and all the organisations involved to cooperate fully.”

In a statement Facebook said: “We have hired a digital forensics firm, Stroz Friedberg, to conduct a comprehensive audit of Cambridge Analytica. Cambridge Analytica has agreed to comply and afford the firm complete access to their servers and systems. We remain committed to vigorously enforcing our policies to protect people’s information.”

Cambridge Analytica said: “In 2014 we received Facebook data and derivatives of Facebook data from another company, GSR, that we engaged in good faith to legally supply data for research. After it subsequently became known that GSR had broken its contract with Cambridge Analytica because it had not adhered to data protection regulation, Cambridge Analytica deleted all the Facebook data and derivatives, in cooperation with Facebook.

The culture secretary, Matt Hancock, told the House of Commons that the revelations were “clearly very worrying” and the government was considering additional powers that the commissioner had proposed, including powers to impose further criminal sanctions and to compel testimony from individuals. Hancock said he was shocked at the speed at which Facebook had barred the whistleblower, Chris Wylie, from its platforms, including WhatsApp.

“I thought it was outrageous,” he said. “Facebook have some serious questions to answer here, and they will tell their side of the story. And to answer it by blocking an account, when we know in this house they do not act fast enough to block other accounts of obviously outrageous behaviour, I’ll tell you what, it shows that when they need to they can block things incredibly quickly and they will need to do a lot more that.”

However, Hancock said he had not seen any evidence that the activities had had an effect on the outcome of any election or referendum.

Labour’s Stephen Kinnock said that if Cambridge Analytica were proved to have been “in flagrant breach of our electoral rules, that would place a pretty huge question mark over the referendum result”.

Damian Collins MP, who chairs the digital, culture, media and sport select committee, said he would call the heads of both companies, Mark Zuckerberg and Alexander Nix, to give further testimony.

“We need to hear from people who can speak about Facebook from a position of authority that requires them to know the truth,” Collins said. “Someone has to take responsibility for this. It’s time for Mark Zuckerberg to stop hiding behind his Facebook page.”

Collins suggested the powers of the information commissioner should be beefed up to add the legal ability to force companies to provide information.

Downing Street said it would consider any formal requests to give new powers to the commissioner, Elizabeth Denham, but added her powers had only recently been reviewed.

“I haven’t seen any formal requests. The information commissioner does have significant powers, which have been enhanced in recent times, but if any formal requests were made to us I’m sure we’d consider it,” the spokesman said.

Hancock told Collins’s committee last week that following Brexit he would like to review legislation governing social media. On Monday the minister expanded on his words, telling the Telegraph that “the wild west for tech companies is over”.

Last month both Facebook representatives and Nix had told the parliamentary inquiry into fake news that the company did not have or use private Facebook data, or any data from Global Science Research (GSR). But in its statement on Friday night, explaining why it had suspended Cambridge Analytica and Wylie, Facebook said it had known in 2015 that profiles were passed to Nix’s company.

“In 2015 we learned that a psychology professor at the University of Cambridge named Dr Aleksandr Kogan lied to us and violated our ‘platform policies’ by passing data from an app that was using Facebook login to SCL/Cambridge Analytica,” the statement said.

Donald Trump’s 2016 presidential election campaign paid Cambridge Analytica more than $6.2m, according to US federal election commission records but is has denied using any Facebook data in the campaign.

In a now-deleted series of tweets, Facebook’s chief security officer, Alex Stamos, argued that the friend list data that Cambridge Analytica had acquired was obtained through an API, a feature that allows programs to interface with Facebook, that was well documented “in our terms of service, platform documentation, the privacy settings and the screen used to login to apps”.On Saturday evening, however, he deleted his tweets, saying: “I should have done a better job weighing in. There are a lot of big problems that the big tech companies need to be better at fixing,. We have collectively been too optimistic about what we build and our impact on the world. Believe it or not, a lot of the people at these companies, from the interns to the CEOs, agree.”