For years Facebook Inc. stock has been a must own. The company enjoyed constant growth, regular user engagement and ad revenues that grew even with scandals tied to user data and fake news. But investors should be starting to worry a little.

Regulators have been given the tantalizing prospect of accessing internal documents that could bolster planned investigations into the company. Files leaked to the Wall Street Journal recently exposed troubling internal practices and some of the documents have been handed over to the U.S. Securities and Exchange Commission by a person seeking federal whistleblower protection.

Being bearish on Facebook is an unpopular view. Out of 58 equity analysts tracked by Bloomberg, only three recommend selling Facebook shares, and the average 12-month target is $418, almost $60 above the current price.

But Facebook’s reign as social media king is increasingly under threat from competitors such as ByteDance Ltd’s TikTok and even Apple Inc. The company’s innovations in virtual reality and smart glasses will never replicate the success of its ad business. (The departure of its chief technology officer last week doesn’t conjure much faith in future products, though his successor has a track record in hardware.) The shift toward investing based on environmental, social and governance performance may also hurt the company: ESG-focused funds have blacklisted Facebook for past controversies, and it currently has a riskier ESG score than Alphabet Inc.’s Google, Microsoft Corp. or Apple, according to Sustainanalytics.(2)

The biggest issues for Facebook, however, revolve around regulation, legislation and litigation — and it’s easy to see why the market hasn’t fully absorbed this. These risks are challenging to track. Here’s a breakdown of some key concerns, bearing in mind some may still be a year or two (or more) out.

Regulators are targeting Facebook’s structure. The Federal Trade Commission wants a court order forcing Facebook to sell Instagram and WhatsApp. U.S. lawmakers on both sides of the aisle are pushing for a breakup too. Instagram provides more than a quarter of the social media giant’s revenue, according to Bloomberg News, and is Facebook’s last link to the teens and twenty-somethings who have been gravitating away over the past decade. 

There’s a push to change Facebook’s algorithms and internal systems. Legislators have become serious about pushing for systematic changes to Facebook’s recommendation algorithms, which have been accused of rewarding controversial content, but which also keep users coming back for more. 

For instance, at the heart of two pending European Union and U.K. laws governing online safety are requirements that social media companies such as Facebook adjust their systems to stop algorithms from propagating harmful content. In other words, it may not be enough for the company to take down posts of revenge porn and hate speech in an endless game of whack-a-mole. It may instead have to rewrite the algorithms so that such content doesn’t make it into newsfeeds in the first place. That could hurt its ad business if it impacts engagement.

Facebook has already spent a lot — more than $13 billion — on safety and security efforts since 2016. And it pays for some 40,000 people, many of them contractors, to work on content issues. Europe’s new Digital Services Act, which requires further “risk management” measures, means the company will probably have to invest even more to improve content moderation. 

Litigation is coming from different directions. One recent shareholder lawsuit alleges that Facebook’s board overpaid its $5 billion settlement to the FTC to protect Chief Executive Officer Mark Zuckerberg from liability. Another alleges insider trading by a handful of Facebook’s top executives. The suits were filed by two shareholder groups led by pension funds, including the California State Teachers’ Retirement System. A Facebook spokesman declined to comment. 

More serious: the company may face criminal liabilities for some of the worst behavior on its site. The leaked internal documents include evidence that Facebook neglected to do enough to stop human trafficking, according to the Wall Street Journal’s report. That could make it liable under the U.K.’s Modern Slavery Act, according to Andrew Wallis, founder of the human trafficking charity Unseen.

Gretchen Peters, who runs an organization that tracks crime and terror activity on social media, has been lobbying the Justice Department to investigate if Facebook’s hosting of criminal content rises to the level of a RICO violation, referring to a law that was designed to help prosecute organized crime. A probe isn’t certain, however. 

The boss seems to have checked out. Remember back in 2000 when Bill Gates stepped down as CEO of Microsoft? The company had been going through an antitrust nightmare with regulators, and Gates himself was often blamed for all that was wrong with Windows. Then he left to focus on the nonprofit Gates Foundation and became a philanthropic icon. That must sound pretty appealing to Mark Zuckerberg right now, and it almost shows in his behavior. 

Last week, instead of publicly responding to some of the most damning internal leaks in Facebook’s history, Zuckerberg posted videos of himself fencing and talking about new hardware products. He also joked that the New York Times got details about his surfing machine wrong, in what was a serious story about how the company tweaked newsfeeds. A more sensible approach would have been for Zuckerberg to publicly address the leaks, or to at least stay quiet and focus on dealing with the matter.

His behavior instead should be troubling, particularly to anyone who wants to see the CEO manage his senior leadership team through yet another crisis. The leak to the Wall Street Journal contained insights from many varied areas of Facebook, suggesting it may have come from a person or people with senior responsibilities. 

If Zuckerberg is replaced, that may be no bad thing for Facebook’s shares. A new boss who can more stringently fix the company’s issues, and appease regulators and lawmakers, could make the site a more attractive place for users who have left. 

It is understandable if Zuckerberg is tired of apologizing for yet another controversy. But with the potential liabilities piling up, his approach feels out of touch at best, and at worst irresponsible. Facebook investors should take note.

(1) Sustainanalytics, whichrates listed companies based on their environmental, social and corporate governance performance, said Facebook’s ESG rating was currently under reviewfollowingthe recent WSJ reports,to determine if it warranted a downgrade.

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

Parmy Olson is a Bloomberg Opinion columnist covering technology. She previously reported for the Wall Street Journal and Forbes and is the author of “We Are Anonymous.”

More stories like this are available on bloomberg.com/opinion

©2021 Bloomberg L.P.