Testifying in front of the House Committee on Energy and Commerce, Facebook CEO Mark Zuckerberg did not deny that a recently announced audit of third-party app developers could take years.

Rep. Jan Schakowsky (D-IL) tried to get Zuckerberg to name an exact deadline for when Facebook would complete the audit. After initially responding with “many months,” she asked if those many months could turn into years.

“I hope not,” he responded.

Congress called on Zuckerberg to testify following reports that Cambridge Analytica, which was employed by President Donald Trump’s campaign during the 2016 election, had improperly harvested data on more than 50 million Facebook users. Last week, Facebook revealed that after conducting an internal analysis, it now believed the data of up to 87 million users — most of them in the U.S. — had been accessed by Cambridge Analytica. Zuckerberg also revealed today during the testimony that Cambridge Analytica got ahold of his data as well.

Cambridge Analytica reportedly obtained user data from researcher Aleksandr Kogan. Kogan’s company, Global Science Research, paid 300,000 Facebook users to download an app and take a personality quiz that would collect some of their user data. But the app also collected data from the Facebook friends of users who had downloaded the app.

Cambridge Analytica allegedly then used the data to create highly specific profiles of millions of U.S. voters, which made it easier for the company to create better targeted ads.

According to The Guardian and Observer, Facebook found out that Cambridge Analytica had improperly obtained user data in 2015. The company sent a letter to Cambridge Analytica, asking them to delete any data they obtained Global Science Research. But Facebook failed to conduct an audit to ensure that Cambridge Analytica had actually deleted the data.

Toward the end of March, Facebook announced it would be auditing all apps that were given large amounts of access to user data before the company made changes to its app developer program in 2014, as well as any that have exhibited “suspicious behavior” in the past.  The company said it will be alerting any affected users about any abuses discovered during the audit. Going forward, developers will also have to sign a contract in order to access a user’s posts or private data.

“While Facebook has certainly grown, I worry it has not matured. I think it is time to ask whether Facebook may have moved too fast and broken too many things,” Representative Greg Walden (R-OR) said during opening statements before today’s testimony.

During yesterday’s testimony in front of the Senate Judiciary and Commerce Committees, senators asked Zuckerberg whether or not he considers Facebook to be a monopoly, what type of regulation the company would accept, and what the company is doing to prevent “more Cambridge Analyticas” going forward.

The questions asked by the House Committee were on the whole more political than questions asked by senators yesterday. A handful of congresspeople asked Zuckerberg about the alleged censorship of pro-Trump bloggers Diamond and Silk.

Last week, Facebook made an unusually high number of product and privacy announcements, presumably so during his testimony, Zuckerberg could point to specific steps the company was taking to better protect user data.

The company announced that it was limiting the amount of information developers could access from a handful of APIs, and shut off a search tool that allowed malicious actors to scrape public profile information from nearly all of Facebook’s 2 billion users. Facebook also rewrote its data policy to make it more clear to users what data Facebook collects and what it uses it for, and announced that it would now require the administrators of Pages with large follower numbers and those who want to run ads about political issues to have their identities and locations verified by Facebook.

Additionally, the company endorsed a piece of legislation from Senators Amy Klobuchar (D-MN), Mark Warner (D-VA), and John McCain (R-AZ) that would require more disclosure around political ads from Facebook and other social media platforms. During yesterday’s testimony, Senators Ed Markey (D-MA) and Richard Blumenthal (D-CT) introduced another piece of legislation that would establish a privacy bill of rights for consumers. Facebook and other edge providers would have to obtain consent in order to “use, share, or sell users’ personal information.”