The data firm credited with helping Donald Trump win the 2016 US election has been suspended from Facebook.
At the centre of the row is University of Cambridge Dr Aleksandr Kogan who, according to Facebook, made a "personality app" that gathered data he then sold to third parties.
Facebook said it had received reports that Cambridge Analytica and others had not destroyed all the data that was obtained, in breach of Facebook policies.
Cambridge Analytica said it complied with Facebook's rules, had deleted the data after it was requested by Facebook, and no longer held or used any of the data taken from the profiles.
The BBC has not yet been able to reach Dr Kogan.
Facebook said the suspension would remain in place “pending further information”.
Cambridge Analytica, which is not connected with the University of Cambridge, recently rose to prominence for its significant role in US President Trump’s election campaign, where it provided intricate data on the thoughts of American voters.
Former presidential advisor Steve Bannon was on its board of directors.
The company also played a role in the Brexit referendum campaign.
Facebook’s deputy legal counsel Paul Grewal wrote at length about the decision in a blog post.
"In 2015, we learned that a psychology professor at the University of Cambridge named Dr Aleksandr Kogan... violated our platform policies..."
Dr Kogan is said to have created an app called “thisisyourdigitallife”. It was accessed by approximately 270,000 people, Facebook said.
"In so doing, they gave their consent for [Dr] Kogan to access information such as the city they set on their profile, or content they had liked, as well as more limited information about friends who had their privacy settings set to allow it.”
Users who downloaded it were told they were taking a personality prediction test that was part of a "research app used by psychologists”.
While that was initially true - Dr Kogan is a psychologist - Facebook said the data was then kept and sold on to third-parties including Cambridge Analytica and its parent company Strategic Communications Laboratories. Another recipient was said to be an employee at Eunoia Technologies.
Mr Grewal claimed: "Although Kogan gained access to this information in a legitimate way and through the proper channels that governed all developers on Facebook at that time, he did not subsequently abide by our rules."
Facebook told the companies which bought the data to delete it immediately, and said it was given assurances the information would be destroyed.
"Several days ago, we received reports that, contrary to the certifications we were given, not all data was deleted," Mr Grewal said.
"We are moving aggressively to determine the accuracy of these claims. If true, this is another unacceptable violation of trust and the commitments they made.”
The firm said it would not rule out legal action over the incidents.
In a statement, Cambridge Analytica said it deleted "all the data it had received" when it was told the information was obtained in breach of Facebook's terms of service.
"For the avoidance of doubt, no data [from Dr Kogan] was used in the work we did in the 2016 US presidential election," it added.
The University of Cambridge said it had no reason to believe Dr Kogan, employed in its psychology department, used university facilities while gathering the data.
A university spokesman said professors were able to have their own business interests - but they must be "held in a personal capacity".
Follow Dave Lee on Twitter @DaveLeeBBC
Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370