Facebook has come under fire from legal officials in both the UK and US over how it protects user information after a whistleblower revealed that a data analytics firm collected millions of Facebook profiles of US voters without permission.

The data was obtained in early 2014 by Cambridge Analytica – a company headed by one of Donald Trump’s former advisers, Steve Bannon, and invested in by billionaire Republican donor, Robert Mercer. This information was then used to create a system that profiled 50m US voters and targeted them with personalised political ads, as reported by both The New York Times and the Guardian.

“We exploited Facebook to harvest millions of people’s profiles,” Christopher Wylie, who helped to found the analytics company, told the Observer. “And built models to exploit what we knew about them and target their inner demons. That was the basis the entire company was built on.”

The data used by Cambridge was collected through an app called thisisyourdigitallife, which was built by Cambridge University academic, Aleksandr Kogan, through his Global Science Research (GSR) company. Through the app, and in collaboration with Cambridge, hundreds of thousands of users were paid to take a personality test and all agreed to have their data collected for academic use. The data collected included

All the data obtained by the Kogan – who has links to a Russian university, as well as the Russian government – and his app was done so legitimately with the required consent and had not been acquired via a data breach.

Despite this, Kogan lied to both Facebook and the people that used the app about how the data would be used. This forced Facebook to remove the app for violation of its platform policies back in 2015 – though it did not warn its users about what had happened – and ask that Cambridge, Kogan, and Wylie all destroy any data they had obtained – which they agreed to do. However, it was recently brought to Facebook’s attention that not all the data had actually been deleted and the social network has suspended all the parties involved, ‘pending further information’.

“This was a scam — and a fraud,” Paul Grewal, a vice president and deputy general counsel at Facebook, told The New York Times. “We will take whatever steps are required to see that the data in question is deleted once and for all — and take action against all offending parties.”

Grewal added in a blog post: “On an ongoing basis, we also do a variety of manual and automated checks to ensure compliance with our policies and a positive experience for users. These include steps such as random audits of existing apps along with the regular and proactive monitoring of the fastest growing apps.”

Both Cambridge and Facebook have faced questions from parliament in the past over the use of people’s data. Cambridge’s CEO, Alexander Nix, saying that does not have any Facebook data, while Facebook claiming that any data the company has was obtained by itself and not via its social network.

On the back of the controversy, Cambridge is now being investigated by both the Electoral Commission and the Information Commissioner’s Office in the UK, and as part of special counsel Robert Mueller’s probe into alleged Russian influence in Trump’s presidential campaign. Meanwhile, both the senator of Minnesota, Amy Klobuchar, and Conservative MP Damian Collins would like to call on Facebook CEO Mark Zuckerberg or another Facebook executive to testify on both sides of the Atlantic.

The news of Cambridge’s dishonesty and illegal activities puts Facebook deeper into question over its role in the US presidential election – and other major votes such as the Brexit referendum in the UK – and also heaps more pressure on the Trump administration as they continue to be adamant that they never colluded with Russia during the presidential campaign period.