Three hours into Mark Zuckerberg's second day of hearings on Capitol Hill, a Republican lawmaker offered "a little bit of advice" to the Facebook CEO: Be careful, or we might just have to regulate you.
"Congress is good at two things: doing nothing, and overreacting," Rep. Billy Long, a Republican representing Missouri, told Zuckerberg in a hearing Wednesday. "So far, we've done nothing on Facebook... We're getting ready to overreact."
Zuckerberg was grilled for about 10 hours by nearly 100 legislators in the House and Senate to address the Cambridge Analytica data scandal. Lawmakers in both houses, and on both sides of the aisle, raised concerns about whether Facebook had proven to be incapable of regulating itself. Even Zuckerberg said regulation of his industry is "inevitable."
And yet, after all the spectacle of the hearings, industry watchers continue to believe Congress is unlikely to pass significant new laws regulating Facebook (FB) this year given the complexities of the issue and the de-regulatory mindset of the Republican majority.
"Nothing has changed in my mind over the last two days," says Ari Waldman, director of the Innovation Center for Law and Technology at the New York Law School and author of "Privacy as Trust." "I have zero expectation that this Congress is going to make adequate changes."
The Republican-led Congress has been more focused on stripping away regulations than introducing new ones. Some members of the party, including Long, showed their clear unease with imposing additional regulation during the hearings.
"You're the guy to fix this. We're not," Long told Zuckerberg after issuing his warning about Congressional overreaction. "You need to save your ship."
Shortly before Zuckerberg testified before the Senate Commerce Committee, John Thune, the Republican chairman of the committee, said he knows "there are people who say we ought to regulate these social media platforms, [but] I'm not convinced that's the case."
Related: Why Mark Zuckerberg didn't want to talk about your data
But even in this hesitant camp, lawmakers showed a willingness to do just that. "I don't want to vote to have to regulate Facebook, but by God I will," Sen. John Kennedy, a Republican from Louisiana, said in the hearing Tuesday.
"Legislation in this Congress at this time is difficult, but Zuckerberg's appearance certainly increased its probability," says Roslyn Layton, a visiting scholar at the American Enterprise Institute who served on President Trump's transition team for the Federal Communications Commission. "There is no doubt that consumer protection is a winning issue for both parties this year."
The devil is in the details. Throughout the hearings, members of Congress struggled to understand how Facebook works, let alone to diagnose and agree on the precise problems that should be fixed by regulation.
The hearings came nearly a month after news broke that Cambridge Analytica, a data firm with ties to President Donald Trump's campaign, accessed information from as many as 87 million Facebook users without their knowledge.
The data debacle sparked outrage over consumer privacy, but also reignited broader concerns about Facebook's impact on privacy, civil discourse and domestic institutions around the world.
With that in mind, legislators pitched a mix of policy ideas ranging from giving consumers more control over their data and boosting transparency for online political advertisements to pushing back at Facebook's alleged monopoly power.
Of these, a bill pushing for political advertising transparency appears to have the most momentum right now, with support from Facebook as well as Twitter (TWTR). Facebook recently moved to label all political and issues ads.
Related: Mark Zuckerberg just finished nearly 10 hours of questions from almost 100 lawmakers
On Tuesday, two Democratic senators introduced what they called a "privacy bill of rights" that would require companies like Facebook to get users to opt-in before using, sharing or selling their personal data.
"Many of the solutions you're hearing members of Congress and groups like ours call for are comprehensive privacy solutions. That's challenging," says Chris Lewis, VP of Public Knowledge, a tech advocacy group. "Congress has tried before and hasn't moved forward."
One need only to look to Equifax (EFX) for proof of that. The former CEO of the credit reporting firm was grilled by Congress in October after a massive security breach exposed the sensitive personal information of half the U.S. Months later, Congress has not passed strong privacy protections.
Lewis expects this to be more of a "deliberative" year for Congress on this front, rather than a year that sees much new legislation passed. "No one should get excited that something is going to happen right now," he says.
There's also the possibility that legislation intended to give users more control over their data and privacy could end up benefiting a more established platform like Facebook and handicapping new services trying to build an audience and a business.
"Moving to an opt-in regime would do very little to limit Facebook's business model but would hurt their competitors significantly more," Ashkan Soltani, a former chief technologist at the Federal Trade Commission, wrote on Twitter.
Zuckerberg himself said regulation could hurt its smaller rivals.
"Part of the challenge with regulation, in general, is that when you add more rules that companies need to follow, that's something that a larger company like ours has the resources to do," he said.
Instead, the more imminent regulatory threat to Facebook in the U.S. may not come from sweeping new bills in Congress, but from an old agreement with the FTC.
Multiple legislators also raised the prospect that Facebook's data policies with third-party apps violated a 2011 consent decree with the FTC after a prior privacy complaint. If that is the case, Facebook could be subject to hefty fines. The FTC confirmed last month that it's investigating Facebook.
