Former FTC worker says Facebook violated consent decree

‘No other single company has done more to erode consumer privacy’: ex-chief technologist

Facebook Inc.’s Cambridge Analytica incident was likely a violation of the company’s 2011 consent decree with the Federal Trade Commission, which requires it to get users’ consent before sharing their data, according to the agency’s former chief technologist.

Ashkan Soltani, who was at the FTC when it looked into Facebook seven years ago, was asked by a Congressional subcommittee on Tuesday whether Facebook violated the rules, which could result in heavy fines.

“It is my opinion that they have,” Soltani told the Senate Commerce, Science and Transportation subcommittee.

“No other single company has done more to erode consumer privacy than Facebook,” he said in his prepared testimony.

“Facebook’s business practices have driven the entire online advertising industry to adopt increasingly invasive tracking practices in what amounts to a race to the bottom for privacy,” added Soltani, who said he was among FTC officials who investigated Facebook for privacy violations that led to the 2011 consent decree.

Soltani testified on a panel that also included Aleksandr Kogan, the Cambridge Analytica researcher, who outlined his version of events during the hearing. The FTC is probing the scandal, in which a Facebook application developer transferred data on up to 87 million users to Cambridge Analytica, a political consultancy.

Under the terms of the 2011 settlement, Facebook agreed to get user consent for certain changes to privacy settings as part of its resolution of federal charges that it deceived consumers and forced them to share more personal information than they intended.

That complaint arose after the company changed some user settings without notifying its customers, according to an FTC statement at the time.

Facebook has said it’s confident it didn’t violate the decree.

If the FTC finds Facebook violated terms of the consent decree, it has the power to fine the company more than $40,000 a day per violation.

Other former FTC officials, including Jessica Rich and David Vladeck, former chiefs of the agency’s consumer protection bureau, both said in March when the breach emerged that they thought what happened was a violation of the consent agreement.