As a privacy advocate, I normally stand up for companies that stand up for user privacy. In the hi-tech world, we need these firms to oppose broad government requests for personal data and to build strong privacy safeguards into their products. But Facebook is not protecting the privacy of its users when it stonewalls the public about the role of Russia in the 2016 election. Instead, it is hiding its business practices—and that’s a problem.

There is little doubt that Russia targeted social media with the goal of influencing the outcome of the 2016 U.S. presidential election. The unclassified portion of a report prepared by the Office of Director National Intelligence (DNI) in January describes Russia’s multi-pronged attack, including spreading online propaganda on Facebook. But the public needs the full story. Earlier this year, my organization sued the DNI under the Freedom of Information Act for release of the complete January report. We want to know what the government knows about Russian meddling. But we don’t have the ability to uncover Facebook’s records. That is a role for Congress.

Mark Zuckerberg seems to be listening. This week the Facebook CEO announced changes in advertising practices that would improve transparency and make clear the sources of political ads run on the social media network. This is a step in the right direction.

But Facebook still needs to operate under the same rules that govern other media companies that sell political advertising. If the goal is to ensure fair and accountable elections, the Internet cannot be a Federal Elections Commission-free zone. This week members of Congress urged the FEC in a letter to update advertising laws to prevent foreign governments from using online advertising platforms such as Facebook and Twitter to influence voters.

That letter came just two weeks after Facebook admitted that it sold more than 3,000 ads to the “Internet Research Agency,” a troll farm that spreads propaganda in support of Russian President Vladimir Putin and his allies and goes after his enemies. Political ads on most U.S. media are required to state their sources and funding. But the Russian troll farm hid behind Facebook’s anonymous algorithms—a practice that would have violated the law had it been done in print or on television.

I don’t have much sympathy for Facebook’s shifting privacy arguments. But if the company, Congress, and the FEC can work together and prevent online election fraud, that will be good news for Internet users and U.S. voters.

Marc Rotenberg is president of the Electronic Privacy Information Center and author of Privacy in the Modern Age: The Search for Solutions.