The US government and Facebook are negotiating a settlement over the company’s privacy lapses that could require the online social network to pay a multibillion-dollar fine, the Washington Post reported on Thursday.

The newspaper said that the US Federal Trade Commission and Facebook had not agreed on an amount, citing two people it said were familiar with the matter. Facebook reported fourth-quarter revenue of $16.9bn and profit of $6.9bn.

The FTC has been investigating revelations that Facebook inappropriately shared information belonging to 87 million of its users with the now-defunct British political consulting firm Cambridge Analytica.

The inquiry has focused on whether the sharing of data with Cambridge Analytica and other privacy disputes violated a 2011 agreement with the FTC to safeguard users’ privacy.

An eventual settlement may also mandate changes in how Facebook does business.

Facebook declined to comment directly on the Washington Post report. “We have been working with the FTC and will continue to work with the FTC,” a spokeswoman said.

The FTC declined comment.

The biggest FTC fine for a privacy lapse was $22.5m levied on Google in 2012. The agency has had bigger settlements on other issues.

The FTC settled with the pharmaceutical company Teva Pharmaceutical Industries in 2015 for $1.2bn to resolve antitrust violations committed by Cephalon, which it had acquired.