Nobody shakes off outrages over data privacy like Facebook. The company has built a culture and business model on pushing the envelope around data use since its founding.

But that usually triggers a cycle of user anger that peaks with some weeping and gnashing of teeth, and then … nothing much. Promises to do better. Hand-wringing posts from a Facebook executive about wanting to teach the world to sing and buy it a Coke. And sometimes a consent decree with the U.S. Federal Trade Commission.

At the end of the day, however, people are simply too addicted to Facebook to give it up. And whatever people say about their privacy and data, they go right back to sharing anything and everything and playing all sorts of goofy personality quizzes that hoover up all their personal data and sell it to third parties. People say they care about privacy, but their actions tell us otherwise.

The people at the top, CEO Mark Zuckerberg and COO Sheryl Sandberg, count on this indifference. They helped turn Facebook into a power marketing platform with ridiculously refined targeting. Each feature, each new commenting system, each new twist further leverages the mountains of data the platform has amassed.

In the wake of the latest revelations about how Facebook data was harvested by a Russian researcher and given to Cambridge Analytica to fuel its political and marketing targeting, the outrage is again rising. The question now is: Will it actually have any impact on Facebook? Or are things too far gone for Zuckerberg and Sandberg to be able to fix them?

Today, the company announced that it was taking steps to take steps. Facebook has hired a firm to audit the data the Cambridge had gathered. The company reiterated that Cambridge had promised previously it had flushed away that data. “If this data still exists, it would be a grave violation of Facebook’s policies and an unacceptable violation of trust and the commitments these groups made,” the post said.

Still, the early signs from investors are rough. The company’s stock was down $11.89, or 6.42 percent, to $173.25 in mid-day trading on Monday. It is a quick, but limited, vote of no confidence.

The story broke late Friday when Facebook preempted stories that were about to be published by The New York Times and The Guardian of London. Editors at the Times were clearly furious that Facebook had been threatening legal action for some time to block the story, and then turned around and acknowledged it in public to get ahead of publication.

That additional twist of Facebook’s aggressive legal and PR efforts to kill the story aren’t going to help it get too many sympathetic hearings from journalists. But the bigger concern right now is the resurfacing of a movement to quit or delete Facebook accounts.

Over on TechCrunch, author John Biggs said he’s written a script to delete all his content there.

“Facebook is using us,” Biggs wrote. “It is actively giving away our information. It is creating an echo chamber in the name of connection. It surfaces the divisive and destroys the real reason we began using social media in the first place — human connection.”

On Facebook, blogger and influencer Robert Scoble wrestled with the things he loves about social media and the things he fears as he debated whether to follow Biggs’ example.

“But, yet, here we are back on Facebook even though now we know that there’s a dark side to trading our data to corporations,” he wrote. “At least with Facebook we pretty much know the data it has. Our photos, videos, likes, comments, shares, and all the data we’ve filled into it. I’ve done more of that than most. Today the public beating that Facebook is taking from journalists feels justified on one side, but rather unfair on another. I can’t help but wonder if some of the journalistic beating is due to news feed changes that have turned down the distribution of journalism to all of us.”

Meanwhile, there are already signs that the latest revelations will create greater regulatory scrutiny in the U.S. Indeed, the Washington Post reported that some former FTC officials believe the issue with Cambridge may have violated that consent trigger, thus invoking millions in fines.

This all comes after a miserable 18 months for Facebook, perhaps its worst stretch since it was founded. There is a growing anger over the way it was weaponized to spread fake news, the inability to combat racist and hate-filled content, and its dominance (along with Google) of digital ads.

This is even more acute in Europe, where it is facing mounting regulatory threats that could have impact on the way it runs its business.

Zuckerberg and Sandberg have typically found ways to navigate and finesse these moments of controversies. But over those past 18 months, they have consistently stumbled both from a business and PR perspective. Claiming no Russian influence, then slowly finding more and more? Threatening journalists with legal actions?

These are the actions of people in deep denial about the depth of problems they are facing. Given that these two built the heart and soul of this company’s business model and culture, it raises the question of whether they have sufficient distance and perspective to take more radical action, to make more profound changes.

If not, it may be time to consider the unthinkable: replacing both with leaders who can walk the company out of this morass before regulators permanently kneecap it.