Facebook is changing the way its shares data with third-party applications, Mark Zuckerberg announced Wednesday in his first public statement since the Observer reported that the personal data of about 50 million Americans had been harvested and improperly shared with a political consultancy.

The Facebook CEO broke his five-day silence on the scandal that has enveloped his company this week in a Facebook post acknowledging that the policies that allowed the misuse of data were “a breach of trust between Facebook and the people who share their data with us and expect us to protect it”.

“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” Zuckerberg wrote. He noted that the company has already changed some of the rules that enabled the breach, but added: “We also made mistakes, there’s more to do, and we need to step up and do it”.

Facebook’s chief operating officer, Sheryl Sandberg, shared Zuckerberg’s post and added her own comment: “We know that this was a major violation of peoples’ trust, and I deeply regret that we didn’t do enough to deal with it.”

The CEO also pledged to investigate and audit apps that accessed large amounts of data from Facebook users prior to changes in its platform in 2014, and said that it will inform users if their personally identifiable information was misused by app developers. This would include the tens of millions of people whose information was shared with Cambridge Analytica.

The crisis stems from Facebook policies that allowed third-party app developers to extract personal data about users and their friends from 2007 to 2014. Facebook greatly reduced the amount of data that was available to third parties in 2014, but not before a Cambridge University researcher named Aleksandr Kogan had used an app to extract the information of more than 50 million people, and then transferred it to Cambridge Analytica for commercial and political use.

On Saturday, Facebook’s deputy general counsel, Paul Grewal, appeared to defend the lax policies that allowed data harvesting from unwitting friends, writing in a statement: “Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent.”

But after five days of outrage from the public, and calls for investigations and regulation from lawmakers in the US and UK, the company appears to be acknowledging that blaming users for not understanding its byzantine terms of service will not suffice.