The attorneys-general are asking how Facebook monitored what these developers did with all the data they collected and whether Facebook had safeguards to prevent misuse. They also asked Zuckerberg for an update on how Facebook will allow users to more easily control the privacy of their accounts.

Cambridge Analytica, a political data-mining firm, is accused of lifting data from about 50 million Facebook users to influence voters in the 2016 election which saw Donald Trump win the US presidency.

News outlets reported on the FTC investigation last week, but the FTC had not confirmed it until Monday. Facebook reached a settlement with the FTC in 2011 offering privacy assurances.

The social networking firm's privacy practices have come under fire after revelations that Cambridge Analytica obtained data on Facebook users, including information on friends of people who had downloaded a psychological quiz app, even though those friends had not given explicit consent on sharing.

Facebook is also facing questions over reports that it collected years of data on contact names, telephone numbers, call lengths and information about text messages from Android users.

Company officials said on Sunday that this information is uploaded to secure servers and comes only from people who gave explicit consent to allow it.

They added that the data is not sold or shared with users' friends or outside apps. They say the data is used "to improve people's experience across Facebook" by helping to connect with others. But the company did not spell out exactly what it used the data for or why it needed it.

AP