Update [March 20, 10:09 a.m. CT]: This post has been updated to include a statement from Cruz spokeswoman Catherine Frazier.

Flanked by his wife and daughters, U.S. Senator Ted Cruz of Texas three years ago stepped onto the stage of Liberty University and launched what was then a long-shot run for the Republican presidential nomination. Cruz opened his speech with biographical material and a testimony to his Christian faith. Then he recited a litany of conservative ideas for restraining government, not the least of which was “Instead of a government that seizes your e-mails and your cell phones, imagine a federal government that protected the privacy rights of every American.”

Now, Cruz may have to face the possibility that his presidential campaign was—at least tangentially—involved in violating the privacy rights of millions of Americans by employing a voter-profiling company that scraped personal information off of Facebook. That firm is Cambridge Analytica, which provided the Cruz campaign with “psychographic” profiles that allowed him to target his messaging to individual voters, helping him to win the 2015 Iowa caucuses in 2016. That victory made Cruz a player in the crowded field of Republican presidential candidates.

This weekend, the New York Times reported that Cambridge Analytica harvested the profiles of 50 million Americans without their permission. Contracting with the firm might have also violated a federal law that prohibits foreign companies from working in U.S. federal elections, the Times reported. While the story concentrated on President Trump’s use of the firm in the second half of the 2016 election, most of the questionable activities by Cambridge Analytica occurred during the 2014–16 time frame, when the firm was employed by the Cruz campaign to provide data.

Cruz spokeswoman Catherine Frazier responded Tuesday morning to say his presidential campaign contracted with Cambridge Analytica in a good-faith belief that everything the company was operating legally:

The campaign hired Cambridge Analytica as a vendor to assist with data analysis and online advertising.  The campaign’s data analysis program followed and built upon the successful data-modeling and micro-targeting approach pioneered by the Obama campaigns in 2008 and 2012. 
 
In explicit contractual language, Cambridge Analytica affirmatively represented that all data used by them were obtained legally, that they would conduct their operations ‘in accordance with all applicable laws and regulations,’ and that they ‘hold all necessary permits, licenses and consents to conduct its operations.’ The campaign relied upon those representations throughout our engagement, which were reiterated by Cambridge Analytica upon inquiries of the media back in 2015, when they assured us the claims made in the press were false.

The primary investor in Cambridge Analytica is computer programmer and hedge fund manager Robert Mercer, who donated $11 million to one of Cruz’s super PACs in the presidential contest. After Cruz dropped out of the race in July 2016, Mercer and Cambridge Analytica shifted to the presidential campaign of eventual winner Donald Trump.

The company uses “psychographic” profiling to identify how to target campaign messages to specific voters. By using social media profiles and messaging, Cambridge Analytica could build a psychological profile of voters so campaigns could hone message marketing.

The Times reported that Cambridge Analytica “was effectively a shell company” operating in the United States while serviced by London-based SCL Group and overseen by Alexander Nix, a British citizen. In 2014, an American election lawyer warned company executives that the arrangement could violate laws limiting the involvement of foreign nationals in U.S. elections, according to the Times.

In a speech delivered to a New York audience in September 2016, Nix took credit for Cruz’s Iowa victory. “It is easy to forget that only 18 months ago Senator Cruz was one of the less popular candidates and certainly one of the more vilified,” Nix said. Projected behind him on the stage was the quote from U.S. Senator Lindsey Graham, “If you killed Ted Cruz on the floor of the Senate, and the trial was in the Senate, nobody would convict you.” (Graham has since apologized to Cruz for that statement.)

Cruz’s campaign paid Cambridge Analytica more than $5.8 million for its services in 2016. In the video below, Nix explains to the Concordia Summit how he believed his company turned Cruz into a potential Republican presidential nominee.

Shortly after losing the Republican nomination to Trump, Cruz cut his ties to Cambridge Analytica. But with investigations launched into the company on both sides of the Atlantic and with congressional hearings a possibility, those 2014–16 ties to Cambridge Analytica could haunt Cruz in his campaign for reelection and the challenge brought by Democrat Beto O’Rourke.