The settlement resolves a formal complaint by the FTC alleging that Facebook “used deceptive disclosures and settings” that eroded user privacy, violating a prior agreement Facebook signed with the commission in 2012. Facebook also broke the law, the FTC alleged, by misusing phone numbers obtained for account security purposes to also target advertisements to its users. And the company allegedly deceived “tens of millions of users” by implying that a facial recognition feature on the service had not been enabled by default, when in fact it had.
“The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC,” said Chairman Joseph Simons in a statement. “The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations.”
Separately Wednesday, the Securities and Exchange Commission announced that Facebook had agreed to pay $100 million to settle “charges… for making misleading disclosures regarding the risk of misuse of Facebook user data.”
Facebook’s stock was down slightly when the market opened Wednesday morning.
The FTC settlement — which also covers Facebook subsidiaries Instagram and WhatsApp — could set the tone for a wave of further action by policymakers worldwide as they seek to rein in the most powerful players in Silicon Valley.
In addition to the record civil penalty, Facebook also agreed to accept greater oversight of its privacy practices. Under the FTC deal, Facebook’s board will form a privacy oversight committee made up of independent members who cannot be fired by Zuckerberg alone. That committee will be charged with appointing still other officials who must periodically and truthfully certify that Facebook is complying with the FTC agreement, or risk being held personally liable. Zuckerberg will also be required to make those same certifications, the FTC said.
“False certifications would subject Mr. Zuckerberg and the [designated compliance officers] to personal liability, including civil and criminal penalties,” Simons said in a statement written jointly with the Commission’s two other Republican members, Christine Wilson and Noah Phillips.
The FTC also required that regular third-party assessments of Facebook’s privacy practices not rely on company materials but instead on the auditor’s own fact-finding.
The FTC voted 3-2 to approve the settlement, with the agency’s two Democrats dissenting because they believed the measure did not go far enough. In dissents, Commissioners Rohit Chopra and Rebecca Slaughter said they believed the fines were far too small, and that the FTC wrongfully gave Zuckerberg and Facebook COO Sheryl Sandberg a pass.
“Failing to hold them accountable only encourages other officers to be similarly neglectful in discharging their legal obligations,” wrote Chopra. “In my view, it is appropriate to charge officers and directors personally when there is reason to believe that they have meaningfully participated in unlawful conduct, or negligently turned a blind eye toward their subordinates doing the same.”
For more than a year, Facebook — once the darling of policymakers and a celebrated example of American ingenuity — has lurched from crisis to crisis.
With Wednesday’s announcement, the FTC sought to demonstrate its resolve as the nation’s top privacy cop, attempting to show it is a robust and credible enforcer at a time when tech dominates nearly all aspects of modern life, from advertising to communications and entertainment.
Over more than a year, the FTC investigation gained increasing significance as a test of Washington’s commitment and ability to regulate Silicon Valley. It marked a sharp divergence from the Obama era, when Silicon Valley engineers and entrepreneurs were frequent White House visitors and, in many cases, filled key administration posts. Now, at a time when technology companies are under heightened scrutiny from Congress and on the receiving end of President Trump’s social media jabs, analysts say the FTC was under pressure to seek a tough deal from Facebook.
But the settlement, which must still be approved by a judge, proved much weaker than some commissioners had hoped. Chopra and Slaughter both said the far-reaching consequences of Facebook’s missteps called for more aggressive action.
The federal government should have taken Facebook to court to deter it from violating the law in the future, Slaughter wrote in her dissent.
“Litigation would have provided public transparency and accountability for the company, its leaders, and the Commission,” she wrote. “It would send a message to the market and the public that the Commission is willing to go to the mat to ensure compliance with its orders.”
The settlement does not require Facebook to spin off Instagram and WhatsApp; antitrust experts have said that a breakup proceeding would likely require a separate lawsuit alleging that Facebook violated the nation’s competition laws, as opposed to a prior settlement order.
Separately, the FTC said Tuesday it had brought complaints against — and reached settlements with — Cambridge Analytica, its former CEO Alexander Nix, and app developer Aleksandr Kogan for their alleged roles in misusing Facebook user data. The settlements will limit the ability of Nix and Kogan to “conduct any business in the future,” the FTC said.
The FTC announcements this week may add pressure on Congress to give the agency more power or to develop a national privacy law, some analysts said.
“There’s a need and a demand for legislation irrespective of this [Facebook] settlement,” said Hal Singer, an economist at George Washington University’s Institute of Public Policy.
Such a bill could have far-reaching effects, potentially touching every corner of the economy as technology increasingly finds its way into new areas. But progress on the legislation has been slow, and many policy experts privately say they increasingly doubt a bill can be passed this year.
The “techlash,” as some observers have come to call it, is a remarkable break from recent history — particularly for many Democrats who otherwise share close ties culturally and financially with Silicon Valley. For the tech industry, it represents a dramatic shift in attitudes about its role in civil society.
“These questions of trust and privacy are not limited to Google and Facebook,” said Todd McKinnon, CEO of the cloud services company Okta. “If you’re a laundromat and you have a mobile app that gets your customers in there, you’re a tech company — so the techlash is going to affect your laundromat. It sounds funny, but it’s true.”
Republicans such as Sen. Marsha Blackburn (R-Tenn.) have also called for greater limits on tech companies. In a recent speech before the U.S. Chamber of Commerce, Blackburn said it is too early to consider breaking up large tech platforms, but that companies such as Facebook have shown they can no longer regulate themselves.
Wednesday’s settlement, however, isn’t likely to deter states that are taking their own close look at Silicon Valley.
Multiple state attorneys general have suggested they could pile on with their own investigations or lawsuits against the tech industry. In December, Karl Racine, attorney general for the District of Columbia, became the first when his office sued Facebook over the Cambridge Analytica debacle.
And the FTC itself could open additional investigations, said Harold Feld, a senior vice president at the consumer group Public Knowledge. A recently established task force charged with reviewing past tech mergers could, for example, seek to determine whether Facebook’s acquisition of WhatsApp or Instagram proved harmful to competition.
“It’s very clear that the settlement is not the end of the game,” said Feld.