The UK's data protection watchdog intends to fine Facebook £500,000 for data breaches - the maximum allowed.
The Information Commissioner's Office said Facebook had failed to ensure another company - Cambridge Analytica - had deleted users' data.
The ICO will also bring a criminal action against Cambridge Analytica's defunct parent company SCL Elections.
And it has raised concerns about political parties buying personal information from "data brokers".
Facebook said it would respond to the report "soon".
The ICO also said another company - Aggregate IQ - which worked with the Vote Leave campaign in the run up to the EU Referendum - must stop processing UK citizens' data.
The action comes 16 months after the ICO began its probe into political campaigners' use of personal data following concerns raised by whistleblower Christopher Wylie, among others.
The ICO found that Facebook had breached its own rules and failed to make sure that Cambridge Analytica had deleted this personal data.
Source: BBC Online
BDST: 1137 HRS, JUL 11, 2018