NOTE: The FTC held an IN-PERSON press event at FTC Headquarters, 600 Pennsylvania Ave, NW, Washington D. C., on July 24, 2019. You can watch the recorded video of the press conference.
The speakers included: FTC Chairman Joe Simons, Commissioners Noah Joshua Phillips and Christine S. Wilson from the FTC, and Gustav W. Eyler, Director of the Consumer Protection Branch at the Department of Justice Civil Division.
Facebook, Inc. is set to pay a historic $5 billion fine and will have to follow new rules along with changes in its corporate setup to make sure it’s responsible for how it handles users’ privacy. This settles Federal Trade Commission claims that Facebook broke a 2012 FTC order by misleading users about their control over their personal info privacy.
This $5 billion penalty is the biggest ever handed down to any company for consumer privacy violations – nearly twenty times higher than any previous data security or privacy fine worldwide. It’s also one of the largest fines ever issued by the U. S. government for any breach.
The settlement announced today adds unprecedented limits on Facebook’s business practices and creates multiple compliance checks. It forces Facebook to change how it handles privacy decisions starting from its board level and sets up strong ways to hold executives accountable for those choices with real oversight.
“Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices,” said FTC Chairman Joe Simons. “The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC. The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations. The Commission takes consumer privacy seriously, and will enforce FTC orders to the fullest extent of the law.”
“The Department of Justice is committed to protecting consumer data privacy and ensuring that social media companies like Facebook do not mislead individuals about the use of their personal information,” said Assistant Attorney General Jody Hunt for the Department of Justice’s Civil Division. “This settlement’s historic penalty and compliance terms will benefit American consumers, and the Department expects Facebook to treat its privacy obligations with the utmost seriousness.”
Over 185 million people in Canada and the U. S. use Facebook daily. The company earns most of its $55.8 billion revenue in 2018 through targeted ads based on user info. To get people sharing data on its platform, Facebook promises they can manage their info through privacy settings.
After a yearlong investigation by FTC officials, DOJ will file a complaint accusing Facebook of repeatedly using misleading disclosures and settings that undercut users’ chosen privacy preferences – breaking its 2012 order. These methods let Facebook share friends’ personal info with third-party apps without many users knowing or opting out properly.
The FTC also says Facebook didn’t do enough about apps known for violating platform policies.
Separately today, FTC announced legal actions against Cambridge Analytica, ex-CEO Alexander Nix, and app developer Aleksandr Kogan for deceptive tactics harvesting millions’ data from Facebook users. Nix and Kogan agreed on settlements restricting future business activities.
New Rules in Facebook Settlement
The new 20-year settlement revamps how Facebook handles user privacy decisions – boosting transparency while holding them accountable across several levels.
It demands stronger accountability right at board level by setting up an independent board committee focused just on privacy issues-taking away unchecked control from CEO Mark Zuckerberg over these decisions. Committee members must be independent with appointments made by a separate nominating group; firing requires broad agreement from other directors.
It also makes individual accountability clearer: designated compliance officers responsible for running FB’s privacy program must get approval from this board committee-and only this group can remove them (not Zuckerberg or employees). Both Zuckerberg & these officers need quarterly certification filings confirming compliance with required programs plus annual overall compliance statements; false reports carry civil/criminal penalties personally against them.
The deal strengthens outside oversight too-the appointed independent assessor gets broader powers checking if FB’s program actually works through fact-finding & testing rather than just trusting management claims alone. They cannot be misled by FB staff & report directly every quarter back into that same board committee. The FTC may even use legal discovery tools provided under Federal civil procedure rules to check FB’s adherence closely.
This mandatory program covers Instagram & Whats App too – requiring reviews before launching or changing products/services/practices impacting user data plus clear records kept about each decision. Compliance officers generate quarterly review reports sent not only internally but also shared when requested with both assessor & FTC. Must notify Commission & assessor within 30 days after finding incidents where data belonging to over 500 people got compromised alongside efforts taken addressing such breaches.
This order includes tough new requirements:
- Facebook has tighter controls over third-party apps; it must cut off developers who fail certifying policy adherence or can’t justify needed access;
- No using phone numbers gathered solely for security (like two-factor authentication) as ad targets;
- User consent must be clearly obtained before significantly expanding facial recognition uses beyond what was originally disclosed;
- A solid comprehensive data security plan must be maintained;
- User passwords require encryption plus regular scanning so no plain-text storage happens;
- No asking users for email passwords during signup anymore;
How They Broke Their Old Agreement
This whole case comes from claimed violations dating back to a 2012 agreement between FB &the FTC. The original deal banned FB from lying about how secure or private user info was, and limited sharing details like names/dates-of-birthwith outsiders. It also forced FBto keep solid programs protecting user confidentiality.
The FTC says FB breached this when sharing friends’ app-related data despite some setting stricter restrictions. Notably, in May2012FB added text warning friend-shared info might go towardfriends’ apps, but removedit four months laterwhile stillpassingdataon anyway. This happened after August2012finalizingthatorder. FB created features like “Privacy Shortcuts”(late2012)and“Privacy Checkup”(early2014), butthose didn’t explain properlythat strictsharingcontrols weren’t enough unless you separately opted outvia appsettings page. No mention anywhere else said your friends’ info might leak viaapps either.
In April2014FB promised stopping developers collecting “affected friend”data, but secretly told devs already active they had until April2015to keep gathering it. FTC says actually stopped completely around June2018. Meanwhile FB didn’t really screen app makers before letting them grab tons o’userdata – mostly relying on contracts post-registration instead. Troublemakers weren’t dealtwith consistently, often dependingwhether FB profitedfromthem -breakingits ownprivacy programrequirements under old deal.
Additionally, the agency alleges misleading language around facial recognition tech called “Tag Suggestions” which defaulted ONdespite suggesting opt-in was needed. Users were kept unaware.
Apartfromthis, Breakingtheolddealagain, FBranafoulofthelawbycollecting phone numbers supposedly justforsecurity but secretly used those digitsforadswithout proper disclosure either.
The vote sending case&orderto Justice Dept. for filingwas3-2. Chairman Simonsand Commissioners Phillips/Wilsonissued joint statement. Commissioners Chopra& Slaughter offered separate views.
NOTE: The Commission files complaintswhentheyhave reasonable beliefoflawbreaksandan interestinpublicproceedings. Stipulated final orders become legally bindingonce judge approves& signs them.
The Federal Trade Commissionworks topromotecompetition, and protect+ educateconsumers. Youcanlearnmoreaboutconsumer topics, filecomplaintsonlineorcall1-877-FTC-HELP(382-4357). Followuson Facebook/Twitter/readourblogs/subscribeforupdatesonthelatestnews/resourcesfrom FTC.
Source link
