Facebook to pay $5 billion for privacy lapses, but consumer groups say changes the company agreed to won’t solve its privacy problems

Facebook will pay a record-breaking $5 billion penalty, and submit to new restrictions and a modified corporate structure that will hold the company accountable for the decisions it makes about its users’ privacy, to settle Federal Trade Commission charges that the company violated a 2012 FTC order by deceiving users about their ability to control the privacy of their personal information.

The settlement requires Facebook to conduct a massive overhaul of its consumer privacy practices. The settlement also makes major changes to Facebook’s operations, and CEO Mark Zuckerberg no longer has sole control over privacy.

“Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices,” said FTC Chairman Joe Simons. “The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC. The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations.”

Consumer Federation of America, a consumer advocacy organization, says the agreement between the FTC and Facebook fails to protect the privacy of Americans. 

“While the $5 billion penalty may sound impressive, neither that nor the internal controls that the company will implement under the order will change the fundamental business practices of the company,” said Susan Grant, director of consumer protection and privacy for the CFA. “These practices are based on the massive surveillance of individuals and monetizing information gleaned from their behavior. In spite of the agreement, the company remains free to use data about people in any way it sees fit.”

The CFA applauds the dissenting positions taken by FTC Commissioners Rohit Chopra and Rebecca Kelly Slaughter who have identified the serious shortcomings in the agreement.

Allowing Facebook to decide for itself how much information it can harvest from users and what it can do with that information, as long as it documents its decisions, is akin to robbing a bank and leaving a note that you did it, Grant said.

“The failure to require structural change to the company’s data practices is a failure to protect American’s privacy," she said.  "Furthermore, the fact that the agreement ignores the consolidation of data from Facebook and its affiliated companies, WhatsApp and Instagram, is incomprehensible.”

The FTC should have gone even further and forced the company to divest those assets since the integration of these platforms helps fuels the massive commercial surveillance that Facebook conducts, said Grant .

Grant said particularly disturbing is the broad shield that the order provides regarding conduct not addressed in the settlement. The parties agreed that the order will resolve not only issues with Facebook’s violations of its original settlement with the FTC but all consumer-protection claims known by the FTC prior to June 12, 2019, that the company violated Section 5 of the FTC Act.

There is no reason for this except to give Facebook a complete pass on any other problems with Facebook that the FTC was aware of before that date, she said.

Public Citizen, a consumer advocacy group, said at the end of the day, the FTC’s settlement amounts to Facebook remaking the promise to adhere to its own privacy policy, while reserving the right to change that policy at any time. Facebook users and the public should take no comfort in that.

Facebook makes money by serving up targeted ads based on users’ personal information. Many consumers are hesitant about sharing certain data, so Facebook calms that concern by promising that people can control the privacy of their information through the platform’s privacy settings.

The FTC sued Facebook in 2012 for making misleading promises about the extent to which consumers could keep their personal information private. Facebook told users they could select settings to make information available just to “friends.”

But despite that promise, Facebook allowed apps used by those friends to access consumers’ information, a decision that put money in Facebook’s pocket. The 2012 FTC order put penalties in place if Facebook made misleading statements in the future about consumers’ control over the privacy of their personal information.

Facebook violated the order by again giving companies access to information that consumers said they didn’t want to share, according to the FTC. The FTC also alleges Facebook made other misleading statements about how it used facial recognition, consumers’ cell phone numbers, and other personal data.

The largest civil penalty in a privacy case

The $5 billion settlement is the largest civil penalty ever imposed on a company for violating consumers’ privacy and it’s one of the largest penalties assessed by the U.S. government for a violation of any kind. The $5 billion it goes to the general fund of the U.S. Treasury, not to the FTC.

Changes at Facebook, including removal Mark Zuckerberg as the company’s consumer privacy decision maker

The order establishes a new regulations for privacy transparency at Facebook and at WhatsApp and Instagram. It creates an independent committee of Facebook’s board of directors to oversee privacy decisions and requires an independent third-party assessor to evaluate the effectiveness of Facebook’s privacy program.

Mark Zuckerberg also is required to certify every quarter that Facebook is in compliance with the new privacy program. Any false certification will be subject to civil – and criminal – penalties.

New privacy program in place

Consumers need to revisit their toolbars, privacy settings, and other privacy settings to make sure the system is set up to honor their choices and preferences.

More than 185 million people in the United States and Canada use Facebook on a daily basis.

In a related, but separate action, the FTC also announced Wednesday separate law enforcement actions against data analytics company Cambridge Analytica, its former Chief Executive Officer Alexander Nix, and Aleksandr Kogan, an app developer who worked with the company, alleging they used false and deceptive tactics to harvest personal information from millions of Facebook users.

Kogan and Nix have agreed to a settlement with the FTC that will restrict how they conduct any business in the future.

The commission vote to refer the lawsuit and final order to the Department of Justice for filing was 3-2. The department will file the lawsuit and final order in the U.S. District Court for the District of Columbia. 

Chairman Simons along with Commissioners Noah Joshua Phillips and Christine S. Wilson issued a statement on the settlement. Commissioners Rohit Chopra and Rebecca Kelly Slaughter issued separate statements.

Comments

[Carol Cassara]

I just got a FB survey asking what I think of them and I was...very candid. So abusive.

[Rita]

Hi Carol,

Thank for giving feedback to Facebook.

I like Facebook. It's helped me connect with my cousins and others from the past. However, I was really disappointed to learn that they received the big fine because they were under an order in 2012 to improve their privacy procedures. If Facebook had been on the ball, they may have prevented the Russian influence in the election of 2016. Facebook is a big deal and it let us down badly.

Rita