News outlets reported on the FTC investigation last week, but the FTC had not confirmed it until Monday.
"As the chief law enforcement officers of our respective states, we place a priority on protecting user privacy, which has been repeatedly placed at risk because of businesses' failure to properly ensure those protections", reads the statement from the National Association of Attorney Generals. The relationship has not only left Facebook users and others wondering how that personal information was used but also how Cambridge Analytica got their hands on it in the first place.
Facebook has dealt with the FTC on privacy issues in the past.
There was no mention of the British firm accused of using the data, Cambridge Analytica, which worked on US President Donald Trump's 2016 campaign.
The U.S. House Energy and Commerce Committee and U.S. Senate Commerce Committee have already formally asked Zuckerberg to appear at a congressional hearing. That means Facebook could be facing a $2 trillion penalty from the FTC for these violations - perhaps enough to bankrupt the company.
The announcement from Acting Director Tom Pahl said the agency responds when any company does not live up to its promises to protect privacy. He also said sorry in full-page advertisements in British and USA newspapers.
Meanwhile, the chief law enforcement officers for 37 USA states and territories are demanding to know when Facebook learned of the breach.
The ads ran in prominent positions in six British nationals, including the best-selling Mail on Sunday, The Sunday Times and The Observer - which helped break the story - as well as the New York Times, Washington Post and the Wall Street Journal.
His apologies have failed to quell discontent.
"When you sign up for Messenger or Facebook Lite on Android, or log into Messenger on an Android device, you are given the option to continuously upload your contacts as well as your call and text history", the company said. Chuck Grassley, Iowa Republican and chairman of the Judiciary Committee, called on Facebook founder Mark Zuckerberg to explain his company's actions at an April 10 hearing.
Advertisers and users are also unhappy. The social network will investigate apps that had access to large quantities of data before the changes in 2014, restrict developers' ability to access the data, and add a tool in the top of all users' Newsfeed to show apps they had used and to revoke permission for apps to use their data. "Facebook now uses its platform ... to manipulate users into making the decisions that Facebook and its business partners want them to make".