Facebook is facing an existential crisis.

The Cambridge Analytica scandal has done immense damage to the brand, sources across the company believe. It will now take a Herculean effort to restore public trust in Facebook's commitment to privacy and data protection, they said. Outside observers think regulation has suddenly become more likely, and yet CEO Mark Zuckerberg appears missing in action.

The scandal also highlights a problem that is built into the company's DNA: Its business is data exploitation. Facebook makes money by, among other things, harvesting your data and selling it to app developers and advertisers. Preventing those buyers from passing that data to third parties with ulterior motives may ultimately be impossible.

Indeed, the most alarming aspect of Cambridge Analytica's "breach" is that it wasn't a breach at all. It happened almost entirely above board and in line with Facebook policy.

Aleksandr Kogan, a University of Cambridge professor, accessed the data of more than 50 million Facebook users simply by creating a survey filled out by 270,000 people. Facebook provided Kogan with the data of anyone who took the survey, as well as their friends' data. In a statement, Facebook said, "Kogan gained access to this information in a legitimate way and through the proper channels that governed all developers on Facebook at that time."

The one rule Kogan violated, according to Facebook, was passing the user data to third parties, including Cambridge Analytica, the political data firm founded by former Trump aide Steve Bannon and conservative donor Robert Mercer.

But even Facebook sources acknowledged to CNN that it is impossible to completely monitor what developers and advertisers do with the data once it's in their hands. It's like selling cigarettes to someone and telling them not to share the cigarettes with their friends.

The limits of Facebook's ability to enforce compliance with data usage was highlighted by Facebook's own response to Kogan's violation. Facebook says it learned of Kogan's violation in 2015 and was subsequently assured by all parties that the data had been destroyed. But Facebook also says it learned just days ago that "not all data was deleted."

In a statement, Facebook deputy general counsel Paul Grewal said "protecting people's information is at the heart of everything we do." That may be a hard argument for the public to accept given that Facebook's business is providing people's information to outside parties whose ultimate goals are unknowable.

Facebook says that starting in 2014 it gave users greater control over what parts of their information are shared with app developers and advertisers. It also says it has enhanced its app review process to require developers "to justify the data they're looking to collect and how they're going to use it — before they're allowed to even ask people for it."

Still, the sources inside Facebook acknowledge that such measures cannot guarantee that some people won't succeed in mining Facebook data and passing it off to third parties.

On Capitol Hill, the talk of regulation is growing louder. Lawmakers seeking tighter restrictions on big tech feel even more emboldened than they did in the wake of revelations about Russian meddling in the 2016 election, a source on Capitol Hill told CNN.

Democratic Senator Amy Klobuchar has called on Zuckerberg to appear before the Senate Judiciary Committee, on which she serves, to explain "what Facebook knew about misusing data from 50 million Americans in order to target political advertising and manipulate voters."

Meanwhile, Zuckerberg and the rest of the Facebook leadership seem conspicuously absent. Neither the Facebook CEO nor his top deputy, Sheryl Sandberg, have commented publicly on the matter. They have left that task to Grewal, a lawyer. No one has provided an adequate explanation for why Facebook did not disclose Kogan's violation to the more than 50 million users who were affected when the company first learned about it in 2015.

"We are conducting a comprehensive internal and external review and are working to determine the accuracy of the claims that the Facebook data in question still exists. That is where our focus lies as we remain committed to vigorously enforcing our policies to protect people's information," Grewal said in a statement Sunday.

All of this comes as Facebook is already getting questions about the long-term appeal of its platform, at least in the United States. The number of daily active users in the United States — a whopping 184 million — declined for the first time last quarter. Facebook also lost 2.8 million users under the age of 25 last year, and is set to lose another 2 million this year, according to eMarketer.

The Cambridge Analytica scandal is likely to hasten user disenchantment with the network, sources inside Facebook acknowledged. Facebook is increasingly being seen as a platform vulnerable to manipulation by political groups, foreign governments, or worse.

Ultimately, however, the real culprit in the eyes of the American public may not be Cambridge Analytica or the Russians, but rather Facebook itself.