Where did Facebook go wrong in the Cambridge Analytica scandal?

Facebook and Cambridge Analytica are at the center of a privacy scandal in which data from more than 50 million Facebook users was obtained without their permission and then used to target ads in the 2016 presidential election. But many are wondering, where exactly did the social media giant go wrong? CBS News contributor and Wired editor-in-chief Nicholas Thompson joined "CBS This Morning" to discuss the unfolding controversy and pinpoint some of Facebook's missteps.

"So the line that's crossed is a researcher works for a company called GSR, call him Dr. K.," Thompson explained. "Dr. K. sets up an app and he collects a bunch of user data from Facebook that he was supposed to keep himself. That's the agreement he signed with Facebook. Instead, he sells that all to Cambridge Analytica."

The data included information such as the city in a user's profile, things they had "liked" on Facebook, and all of the friends in their network.

When the story broke in 2015 that Cambridge Analytica, a political consulting firm that worked for the Trump campaign, had gotten ahold of a huge trove of data from GSR, Thompson says that Facebook should have made "absolutely certain" it had all been deleted.

Tracking the scenario back further, Thompson also says you could make the argument that Facebook first went wrong when it allowed app developers to collect data from users' friends without the friends' knowledge or permission. Facebook "closed that door" in 2014 after the third-party app that gathered the data in the first place, GSR, was launched.

"It (GSR) was grandfathered into the old, open policies. That's how they were able to collect so much data. So, you can blame Facebook for the original policies. You can blame Facebook for not cracking down harder when they first learned about it and you can blame Facebook for having a flat-footed response when this nightmare story broke a couple of days ago," Thompson said.

Cambridge Analytica has denied any wrongdoing and said they never used any of the information that they obtained from Facebook.

But Thompson says, "It's hard to believe anything Cambridge Analytica says after watching the undercover documentary where they talk about manipulating people with Ukrainian girls," referring to a report by Channel 4 News in the U.K. which caught CEO Alexander Nix on hidden cameras. "This is a company that does not appear to have truth as one of its top priorities. So they've said that they deleted the data. However, people have told reporters, including at 'Wired,' insiders who have had access to their computers, that the data was not deleted."

In a statement Cambridge Analytica said that it "deleted all the Facebook data and derivatives, in cooperation with Facebook." Facebook says it is "in the process of conducting a comprehensive internal and external review as we work to determine the accuracy of the claims that the Facebook data in question still exists."