Reprinted with permission from MediaMatters.

Facebook CEO Mark Zuckerberg is sorry. Specifically, as he told CNN, he’s “really sorry that this happened.”

“I think we let the community down, and I feel really bad and I’m sorry about that,” he told Recode’s Kara Swisher. Facebook Chief Operating Officer Sheryl Sandberg, appearing on CNBC, also offered an apology: “I am so sorry that we let so many people down.”

Zuckerberg and Facebook have a lot to apologize for. In addition to the numerous other problems plaguing Facebook under Zuckerberg’s watch, he allowed Cambridge Analytica to obtain and exploit the Facebook data of 50 million users in multiple countries. When the platform discovered the stolen data, it took the firm’s word that the data had been deleted (it hadn’t). Facebook made no attempts to independently verify that the data was no longer being used, nor did it notify users whose data was exploited. Even after the news broke, it took Zuckerberg and Sandberg six days to face the public and give interviews.

In addition to offering their apologies, both Sandberg and Zuckerberg acknowledged that trust between Facebook and users had been breached. Sandberg said on CNBC, “This is about trust, and earning the trust of the people who use our service is the most important thing we do. And we are very committed to earning it.”

What surprised me most, however, was their acknowledgment that regulation was coming and that perhaps Facebook needs to be checked. Zuckerberg in his CNN interview suggested that regulation of tech companies like Facebook might be necessary. Sandberg went even further: “It’s not a question of if regulation, it’s a question of what type. … We’re open to regulation. We work with lawmakers all over the world.” At first this read to me like another attempt at passing the buck of responsibility onto another entity, and while that might still be partially true, there’s more to it. Facebook is responding to public outrage, including the growing calls for regulation. Facebook executives have concluded they’re not getting out of this mess without regulation, and their best path forward is to try to get the best deal they can get, given the circumstances.

Were Zuckerberg and Sandberg forthcoming enough? No. I don’t think anyone was convinced that Facebook is telling us everything it knows, nor did the company present much of a plan for protecting consumers moving forward. But consumers have the momentum. Facebook will change only as much as its users demand. The fact that Facebook’s leadership is on a full-blown apology tour means that public pressure is starting to work. After months of bad press and user backlash, Facebook is finally acknowledging that some things need to change.

Facebook failed to protect users from a consulting firm so shady that it bragged to a potential client about entrapping candidates for office, potentially breaking U.S. election laws to help Donald Trump win in 2016, and avoiding congressional investigations. Consumers are outraged, many to the point of quitting Facebook entirely. Cambridge Analytica probably isn’t the only problematic company that Facebook allowed to exploit user data, but from an organizing perspective, we couldn’t ask for a better villain. After months of outrage, Facebook is on the defensive. This is the best opportunity we’ll have to force it and other tech platforms to make systemic change.

Here’s a good place to start: Media Matters is calling on Facebook to ban any entity, be it the Trump campaign or any other, that is using a copy of Cambridge Analytica’s data or any other data set acquired by cheating.

Click here and join our call to action.

Header image by Sarah Wasko / Media Matters