FTC and Facebook Reportedly Agree to $5 Billion Settlement After Privacy Investigation
Privacy advocates say even a massive fine isn't enough, and call for more government oversight of the company
The Federal Trade Commission reportedly has reached a settlement agreement with Facebook, fining the company $5 billion dollars over violations of a 2011 consent decree in which the social media giant promised to improve privacy practices. The fine is by far the largest that the FTC has ever levied over the mishandling of consumer data.
The settlement was first reported Friday afternoon by the Wall Street Journal, and details were scarce. The FTC and Facebook did not immediately respond to CR's requests for comment on any restrictions the agency is imposing on how Facebook collects, stores, uses, and shares consumer data.
In early May, news reports suggested that Facebook could face increased government oversight as part of a settlement. However, consumer advocacy groups, including Consumer Reports, warn that the FTC needs to do more than levying a fine to ensure that Facebook improves the way it handles its users' personal information.
Facebook's Many Privacy Scandals
The FTC investigation began in spring 2018 after news came out that Cambridge Analytica, a political data firm that worked for the presidential campaigns of Ted Cruz and then Donald Trump, had acquired data on about 87 million Facebook users without their knowledge or consent. Those people had connections to just 270,000 people who had once participated in an online personality study.
And several additional privacy missteps by Facebook have been revealed since last spring. These include an October 2018 data breach, a Facebook bug that let developers improperly download user photos, news that Facebook knowingly let children amass large credit card bills on the site, and recent federal charges against the company for alleged violations of the Fair Housing Act.
In a required report to the Securities and Exchange Commission this spring, Facebook said it was setting aside money to pay a potential multibillion-dollar fine.
A $5 billion fine would be the biggest ever imposed by the FTC in a digital privacy case, far higher than the $22.5 million levied against on Google in 2012.
The 2011 consent decree that Facebook has allegedly violated was meant to correct "unfair and deceptive" claims to consumers about privacy protections. Facebook was barred from misrepresenting the privacy of consumer data and was required to provide users with more control over their data.
In addition, the company agreed to submit to third-party audits every two years for the following 20 years to ensure that the company was taking measures to protect consumer privacy.
Those audits apparently didn't work as intended. "The previous order failed," Kovacic, the former FTC chair, says. "The monitoring mechanism of turning oversight over to a third party turned out to not be effective."
Along with other privacy experts interviewed by Consumer Reports, he believes that regulators, and perhaps lawmakers, need to be more directly involved in overseeing consumer privacy protections.