For Facebook (FB), the question about 2019 isn’t whether the year will be excruciating for the social network; it’s how excruciating it will get.

Two toxic storylines that unfolded throughout 2018—Facebook’s careless treatment of users’ data and ineffectual responses to abuses of its system—won’t go away in 2019. And depending on how angry regulators and legislators get about them, they could impose serious costs on the company.

Facebook, meet FTC

Facebook’s most serious threat comes from a settlement it signed with the Federal Trade Commission in 2012 after it had engaged in a bout of settings changes that exposed some private data and left enraged users threatening to quit (sound familiar?).

Under that deal with that regulatory agency, the firm pledged to institute a comprehensive privacy-protection program and to obtain people’s upfront permission before making any of their user data more public.

Then the Cambridge Analytica data heist happened: A personality-quiz app that some 300,000 Facebook users installed wound up collecting the data of about 87 million of their friends and funneling it to that now-shuttered research firm. That’s taken a hammer to those promises and led Stifel analyst Scott Devitt to headline a late-October note to clients “Facebook: digital tobacco.”

Cambridge Analytica now puts the FTC in a position to take a hammer to Facebook—if it determines the company violated the terms of its deal. That settlement left Facebook exposed to fines of $16,000 per violation, a cost that subsequent adjustments have raised to $41,484.

Multiply that by the 70 million-plus U.S. users whose data was compromised by the personality-quiz app at stake in the Cambridge scandal, and you’re looking at $2.9 trillion and change.

In early December, Columbia University law professor Tim Wu estimated the odds of some sort of enforcement action at 80%. Two weeks later, after The New York Times reported on Facebook’s sloppy oversight of leaky data-sharing partnerships, he amended that estimate in an e-mail: “Now 95%.”

Other government offices will take a bite, too

But some action doesn’t mean strong action. Hal Singer, an economist and professor at Georgetown University’s business school, worried that the FTC would continue to exhibit symptoms of regulatory capture—when an agency listens too closely to the firms it oversees. “The FTC sure behaves that way,” he commented.

Facebook’s harshest critics would like to see the FTC not just fine Facebook but also impose a structural remedy—as in, forcing the company to undo its acquisitions of Instagram and WhatsApp and spin them off as revived competitors.

That still seems unlikely. Dipayan Ghosh, a fellow at Harvard University’s Kennedy School of Government and earlier a privacy and public-policy adviser at Facebook, predicted “a new set of stringent commitments forced on the company that builds significantly off of its existing consent order.”

But the European Union has a say too, and the EU has already shown itself far more willing to whack U.S. tech giants with punishments far harsher than anything the FTC has handed down lately. So far, however, Facebook’s only been hit with a £500,000 fine by a U.K. regulator, the maximum possible under pre-2018 regulations.

Facebook founder and CEO Mark Zuckerberg’s next visit to Congress—that’s a matter of “when,” not “if”—will also probably feature pointed questions about a structural cure.

That interrogation is likely to come from both sides of the aisle. While many incoming Democratic House representatives campaigned on providing a check to corporate power, incoming Sen. Josh Hawley (R.-Mo.) has voiced similar critiques of social-media giants.

For Republicans skeptical of complicated regulatory frameworks, injecting competition into the market by forcing Facebook to spin off Instagram may have a refreshing simplicity to it.

"It's not clear to me that the current system is good for innovation,” conservative pundit Bill Kristol said at a late-November event introducing a set of tech-policy proposals featuring serious curbs on the power of social networks. He compared their dominance to that of Ma Bell-era AT&T.

Don’t forget that states and cities, some of which actually have comprehensive privacy rules of their own, can take action independent of Washington. On Dec. 19, Washington, D.C., attorney general Karl Racine sued Facebook for violating District privacy laws. He’s likely to have company: In March, 37 state and territory attorneys general signed a letter to Zuckerberg asking for answers about the Cambridge Analytica case.

Some things Facebook could do

If Facebook spends next year responding to these criticisms by warming up the same lame defenses that persuaded few people this year—bland pledges to do better, unaccompanied by meaningful changes in policy—things will only get worse for the company.

It needs to embrace transparency instead of regarding it as a medicine only administered in tightly controlled doses. (One start: finally shipping the promised “Clear History” tool to edit and delete Facebook’s data about your activity on other sites.) The company needs to hold somebody accountable—somehow, nobody seems to have gotten fired for these mistakes. And it needs to drop its growth-hacking habit of preying on everybody’s fear of missing out with incessant, nagging notifications.

If Zuckerberg is serious about focusing on “time well spent,” his company needs to accept that this means less time overall on Facebook. That would be good for the company in the long run—and good for everybody else sooner.

More from Rob:

Facebook wants to give you a way to fight having your posts taken down

Google Maps will now help you find Lime scooters

Microsoft is asking the government to regulate the company’s facial recognition technology

Email Rob at rob@robpegoraro.com; follow him on Twitter at @robpegoraro.