It took Facebook two-and-a-half years to take action against Cambridge Analytica, Facebook COO Sheryl Sandberg confirmed while speaking Friday morning on NBC’s “Today” show. 

“We thought the data had been deleted, and we should have checked,” she said.

Sandberg said Facebook first learned about the breach in December 2015, but the company failed to tell members or develop a top-level opt-out button.  

A “top-level” opt-out button that allows users to restrict advertisers from using a member’s personal profile data would be a “paid product,” if the company chooses to create one, Sandberg said. And while Facebook already offers a variety of “opt-out” options, there is not one at the “highest level,” she said. 

She also said there is a possibility other data has been accessed improperly — and that’s why Facebook is doing an audit. 

Discussing data privacy, General Data Protection Regulation (GDPR), and Facebook’s efforts with Search Marketing Daily, Gartner Research vice president and distinguished analyst Andrew Frank said: “It isn’t completely clear how they used the data, but it is clear they had access to more data than they should.”

Frank said the circumstances in which Cambridge Analytica acquired the data is a little “murky.”

Facebook’s privacy policies were much different when it collected the data, especially the ability for an app to collect data not only about the app subject that opts in, but all of his friends. That turned it from a few hundred thousand records to hundreds of millions of records, he said. That’s the network problem, which Facebook shutdown.

In a blog post, Frank explained that as Facebook announced plans to shutter its third-party data provider division as part of a wider effort to address the Cambridge Analytica fallout, Adobe embraced the concept of “experience makers” at its most recent conference. Adobe suggested people are buying experiences, not products, and it will require lots of data to consider that shift.