The Consumer Financial Protection Bureau (CFPB) has notified Meta it may take “legal action” against the tech giant, alleging that the company improperly obtained consumers’ financial data from third parties and pumped it into its massively profitable targeted advertising business.

News of the federal probe emerged in a Thursday filing Meta submitted to the Securities and Exchange Commission (SEC).

The social media giant, which owns Instagram and Facebook, has been under mounting pressure from regulators and state attorneys general over a host of issues, including its privacy practices and how it allegedly addicts children to its product.

The filing reveals little about the CFPB investigation, saying only that Meta received a formal notification of a probe into “our alleged receipt and use for advertising of financial information from third parties through certain advertising tools.” 

It said the investigation is focused specifically on advertising for “financial products and services” on the platform but did not say whether the activity relates to Facebook, Instagram or both.

A spokesperson for Meta declined to comment, but the filing said the company disagrees with the allegations and believes an “enforcement action is unwarranted.”

The CFPB also declined to comment.

The filing says that on Sept. 18 the CFPB told Meta it is weighing whether the social media company’s conduct violates the Consumer Financial Protection Act, which protects consumers from unfair and deceptive financial practices.

The status of the probe is uncertain, the filing said, but it noted that the agency could “file a lawsuit in the near-term and seek financial penalties and equitable relief.”

Meta announced Wednesday that it posted $41 billion in revenue in the third quarter, 19 percent more than a year ago. Most of those profits are generated by its targeted advertising business, which has been under attack by the Federal Trade Commission (FTC) and European regulators who have said Meta exploits individual data in ways that violate users’ privacy.

The tech behemoth paid the FTC $5 billion in 2019 to settle privacy allegations related to the Cambridge Analytica uproar. That scandal erupted after it emerged that Meta had allegedly improperly shared Facebook user data with the firm, which used it to create voter profiles.

The European Union fined Meta $1.3 billion last year for allegedly moving user data to the U.S. from Europe.