The new investigation was prompted by last week's revelations that Cambridge Analytica, a political data firm in the U.K. that worked for President Donald Trump's 2016 campaign, misused data harvested from 50 million Facebook accounts. Facebook shares fell more than 5 percent following the FTC statement, continuing a drop of more than 23 percent from the peak on Feb. 1.
"Companies who have settled previous FTC actions must also comply with FTC order provisions imposing privacy and data security requirements," Tom Pahl, acting director of the FTC's Bureau of Consumer Protection, said Monday in a release.
"Accordingly, the FTC takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook. Today, the FTC is confirming that it has an open non-public investigation into these practices."
Facebook could face fines of $40,000 per violation of the 2011 consent decree with the FTC, according to Sen. Ed Markey (D-Mass.), which he said could amount to millions in penalties.
Separately, a group of 37 state attorneys general on Monday sent an inquiry to Facebook, asking the company to explain its relationship with Cambridge Analytica and answer "serious questions regarding consumer privacy."
U.K. authorities raided Cambridge Analytica's London headquarters on Friday, reportedly seeking evidence the company improperly influenced Britain's 2016 vote to leave the European Union.
"We remain strongly committed to protecting people's information," Rob Sherman, Facebook's deputy chief privacy officer, said in a statement provided to HuffPost. "We appreciate the opportunity to answer questions the FTC may have."
The FTC said in 2011 that Facebook was "obligated to keep the promises about privacy that it makes to its hundreds of millions of users."
"Facebook's innovation does not have to come at the expense of consumer privacy," Jon Leibowitz, then chairman of the FTC, said at the time. "The FTC action will ensure it will not."