Is $5B fine for Facebook sufficient?
FTC commissioner: ‘I fear it leaves the American public vulnerable’
Facebook will pay a record-breaking $5 billion penalty in a settlement with the Federal Trade Commission that the agency and the company promise will spark real change in how the social networking giant operates and handles user information.
The FTC on Wednesday confirmed numerous reports that it had approved the agreement after a yearlong investigation into whether Facebook failed to obey the terms of a previous settlement designed to protect its users. The agency characterized the latest settlement, which includes the largest penalty ever for violating consumer privacy, as “unprecedented.”
But the commission was immediately and widely denounced for letting the company and its top executives get off too easy.
In a news conference Wednesday, the FTC accused Facebook of repeated violations of its previous 2011 settlement, but Chairman Joe Simons said “litigation would’ve taken years … this provides immediate and important protection for consumers.”
Among key parts of the new, 20year deal: The Silicon Valley company must create a board-level privacy committee, appoint privacy compliance officers who cannot be removed by Facebook’s chief executive, and provide to the FTC quarterly and yearly certifi
cations that it is complying with the terms of the settlement.
“We are extremely proud of the landmark penalty and conduct relief announced today,” the FTC said in a statement. “The size of the $5 billion penalty, as well as the percentage of profits it represents, will provide significant deterrence not just to Facebook, but to every other company that collects or uses consumer data.”
But the two Democrats on the commission disagreed and voted against the deal, which was approved 3-2 along party lines.
“I recognize the settlement’s historic nature,” Commissioner Rebecca Kelly Slaughter said in her dissenting statement. “But I do not share my colleagues’ confidence that the order or the monetary penalty will effectively deter Facebook from engaging in future law violations, and thus I fear it leaves the American public vulnerable.”
Slaughter, who noted that $5 billion is the equivalent of what Facebook earns in a month, said she had wanted to recommend litigation against the company and CEO Mark Zuckerberg.
Simons and the majority of the commission pointed out that the settlement would subject Zuckerberg and other company executives to individual civil and criminal penalties in the future. Zuckerberg will also have to submit quarterly certifications of compliance. But Slaughter said, “I strenuously object to the choice to release him and all other executives from any potential liability for their roles to date.”
The other Democratic FTC commissioner agreed.
“This is a disappointing precedent for the FTC to set, since more companies may now seek ways to buy broad immunity,” Rohit Chopra said in his dissent. “We should have continued the investigation to obtain more data and evidence on what Facebook and its executives knew and how they profited.”
Zuckerberg addressed the settlement in a Facebook post Wednesday, noting that the company will have to keep privacy in mind when designing or modifying its offerings.
“When we ship a new feature that uses data, or modify an existing feature to use data in new ways, we’ll have to document any risks and the steps we’re taking to mitigate them,” Zuckerberg said, adding that it will take more time and people to comply with that requirement.
The FTC accused Facebook of violating its previous settlement by deceiving users about information it was sharing with thirdparty developers, and failing to adequately screen developers and their apps. Slaughter essentially said Facebook’s failure allowed “Cambridge Analytica’s expropriation of data and manipulation of voters.”
The political data consulting firm, which was used by the campaigns of Donald Trump and others, accessed the information of up to 87 million Facebook users without their consent. The FTC also said Wednesday it had sued the now-defunct Cambridge Analytica — which has not settled with the agency — and has reached settlements with Alexander Nix, former CEO of Cambridge Analytica, and Aleksandr Kogan, the researcher and developer who collected Facebook user information through a personality-quiz app.
The Facebook settlement also covers its businesses WhatsApp and Instagram, and requires the company to kick out developers and apps that don’t comply with privacy policies.
In addition, the FTC accused Facebook of deceiving users about its use of facial recognition and of using phone numbers it obtained for two-factor authentication for advertising purposes. Going forward, Facebook must get consent for its use of facial recognition and is prohibited from collecting phone numbers to send ads to users.
An independent assessor must provide the FTC with a privacy evaluation of Facebook every two years and “can’t just take management’s word for what’s happening,” according to the commission.
Electronic Privacy Information Center, which was among the groups that filed the FTC complaint that led to the 2011 settlement, pointed out that the first deal failed to prevent numerous Facebook privacy breaches and said Wednesday’s agreement doesn’t go far enough.
“The FTC’s action is too little, too late,” said Marc Rotenberg, president of EPIC. “American consumers cannot wait another decade for the Commission to act against a company that violates their privacy rights. Congress should move quickly to establish a data protection agency.” He noted that the FTC could designate 1% of the settlement fund to create such an agency.
Lawmakers from both sides of the aisle also renewed their call for a federal privacy law in light of the settlement.
Sen. Ron Wyden, D-Ore., who has introduced federal privacy legislation, said in a statement: “The FTC is sending the message that wealthy executives and massive corporations can rampantly violate Americans’ privacy, lie about how our personal information is used and abused and get off with no meaningful consequences.”
“The settlement between the FTC and Facebook further stresses the need for a strong federal data privacy law,” said Sen. Roger Wicker, R-Miss. “The details of Facebook’s conduct that were illuminated by the FTC’s investigation are troubling.”
Other regulatory pressure awaits Facebook. The FTC announcement came a day after the Justice Department confirmed it has started a broad antitrust review of “market-leading online platforms” it did not name. When Facebook released its second-quarter results Wednesday, it said the FTC informed it last month that the agency had opened an antitrust investigation into the company.
Facebook also disclosed Wednesday that it has reached a $100 million settlement with the Securities and Exchange Commission over charges that it misled investors about the Cambridge Analytica matter.
“As alleged in our complaint, Facebook presented the risk of misuse of user data as hypothetical when they knew user data had in fact been misused,” Stephanie Avakian, co-director of the SEC’s Enforcement Division, said in a statement. “Public companies must have procedures in place to make accurate disclosures about material business risks.”