Senator Chuck Grassley.

Iowa Senator Chuck Grassley, chair of the Judiciary Committee, led a hearing Tuesday that featured testimony from Facebook founder and CEO Mark Zuckerberg.

The online social network is at the center of a data scandal in which Cambridge Analytica gained access to personal information of 87-million Facebook users. In his opening statement, Grassley raised the possibility of legislation to protect consumers.

“Our policy towards data privacy and security must keep pace with these changes,” Grassley said. “Data privacy should be tethered to consumer needs and expectations.” Grassley also called on Facebook and the operators of other social networks to do more to protect users’ privacy.

“The tech industry has an obligation to respond to widespread and growing concerns over data privacy and security and to restore the public trust. The status quo no longer works,” Grassley said. Later in the hearing, Grassley questioned Zuckerberg directly.

“Why doesn’t Facebook disclose to its users all the ways that data might be used by Facebook and other third parties? And what is Facebook’s responsibility to inform users about that information?” Zuckerberg responded, “Mr. Chairman, I believe it’s important to tell people exactly how the information that they share on Facebook is going to be used.” Zuckerberg said his company and others in the tech industry have “found it challenging” to draft privacy policies that are easy for users to understand.

“And if you make it long and spell out all the detail, then you’re probably going to reduce the percent of people who read it and make it accessible to them,” Zuckerberg said. “So, one of the things that we’ve struggled with over time is to make something that is as simple as possible so people can understand it, as well as giving them controls in line in the product in the context of when they’re trying to actually use them, taking into account that we don’t expect that most people will want to go through and read a full legal document.”

Zuckerberg, who faced nearly five hours of questioning, called legislation that would require Facebook to automatically let users “opt out” of having their data collected or shared “the right principle,” but added “the details matter.”