Facebook isn't just settling with the FTC over the Cambridge Analytica data scandal. The social network has also agreed to pay the US Securities and Exchange Commission $100 million over charges of making "misleading disclosures" over the risk of abusing users' data. The SEC alleged that Facebook knew about the data breach in 2015, but continued to describe possible data breaches to investors in purely "hypothetical" terms. It also didn't have "specific policies or procedures" in effect to make accurate disclosures in light of the results of the investigation.
As with the FTC fine, Facebook didn't have to admit guilt, though it also didn't deny the allegations. The deal also permanently enjoins the company from violating relevant sections of the Securities Act and Securities Exchange Act.
An SEC penalty wasn't expected to be the focus -- numerous leaks had concentrated on the FTC's actions. However, the $100 million payout may reinforce worries from some senators and other critics that Facebook is receiving a light punishment that doesn't reflect the full scale of the company's actions. Millions of people had their data compromised, and the company didn't reveal this until years after the fact.