Dylan Byers

(CNN Money) -- Mark Zuckerberg spent more than 10 hours testifying before Congress this week and still didn't answer the most important question about Facebook:

How much data does Facebook collect on users -- and non-users?

It is a question asked in various forms by lawmakers in both the Senate and the House, but in most cases Zuckerberg evaded it by proposing that his team follow up later.

The closest the Facebook CEO came to addressing the issue was when he acknowledged to Rep. Kathy Castor that Facebook collects data from users even when they're not on Facebook and not even logged in to the platform.

The extent of Facebook's data collection is, ultimately, the core concern of Facebook's business. The company brings in $40 billion in advertising revenue annually because it offers brands data that gives them an unparalleled ability to target consumers. If Facebook stopped collecting this data, it would undermine its entire business model.

Throughout the hearings, Zuckerberg repeatedly sought to dispel the notion that Facebook sells user data. It doesn't. But it does trade off user data. Harvesting the data and using it to target ads more effectively than its competitors can is how Facebook makes the bulk of its money.

It will be weeks before Facebook responds to Congress and addresses this issue. The congressional record is open for another two weeks for lawmakers to submit questions, a Facebook source said, after which Facebook will have several more days to respond.

But in the wake of the Cambridge Analytica scandal and this week's hearings, lawmakers and the public are growing more concerned about Facebook's data collection practices. Various news outlets, from CNN to The New York Times to BuzzFeed, have published reports highlighting just how much data Facebook has on its users.

The fact that Zuckerberg did not provide lawmakers with a clear answer about the extent of its data collection is notable because much of that information is readily available on Facebook's Help page.

There, Facebook states clearly that it tracks users and non-users on every site that features a Facebook "Like" or "Share" button (including the article you're reading right now).

"If you're logged into Facebook and visit a website with the Like button, your browser sends us information about your visit," Facebook says. "If you're logged out or don't have a Facebook account and visit a website with the Like button or another social plugin, your browser sends us a more limited set of info."

Facebook also provides advertisers with a tool called Facebook Pixel, an invisible code that allows both marketers and Facebook to track users' actions.

When my colleague Sara Ashley O'Brien downloaded her 14-year Facebook history, she found that Facebook had access to a litany of details from her past, including the phone number of her late grandmother, who never used Facebook, and conversations with an ex whom she had unfriended. She also found that several brands had her on their advertising lists and had access to her information.

Facebook also includes a note about its data collection in its user agreement, noting that it collects data on "the websites and apps you visit, your use of our services on those websites and apps, as well as information the developer or publisher of the app or website provides to you or us."

If Zuckerberg doesn't want to talk about this issue in front of lawmakers, it may be because he fears regulation that would curb Facebook's ability to track data on third-party sites.

Next month, the European Union countries will introduce General Data Protection Regulation. GDPR will give European users more control over their data, including a clear and obvious option to choose who has access to their data.

The U.S. Congress appears to be a long ways away from introducing similar legislation.