Under the settlement, Facebook founder and CEO Mark Zuckerberg will be required to certify that the company is in compliance with new privacy strictures, and could be subject to civil and criminal penalties for false certifications.
“The $5 billion penalty against Facebook is the largest ever imposed on any company for violating consumers’ privacy and almost 20 times greater than the largest privacy or data security penalty ever imposed worldwide,” the Federal Trade Commission said in a news release. “It is one of the largest penalties ever assessed by the U.S. government for any violation.”
But the force of the decision was blunted by stinging dissents from the two Democrats on the five-member commission, who said the financial penalty was insufficient and the settlement does little to change Facebook’s basic incentives to gather and leverage users’ data.
“The settlement imposes no meaningful changes to the company’s structure or financial incentives, which led to these violations,” commissioner Rohit Chopra said in a statement. “Nor does it include any restrictions on the company’s mass surveillance or advertising tactics.”
“Rather than accepting this settlement, I believe we should have initiated litigation against Facebook and its CEO Mark Zuckerberg,” said commissioner Rebecca Kelly Slaughter.
Taking note of the dissents, the Republican board majority led by Chairman Joe Simons said that suing Mr. Zuckerberg for past violations wouldn’t serve the public interest.
“Mr. Zuckerberg will be held accountable for certifying quarterly—under threat of civil and criminal penalties—that the company’s privacy program is in compliance with the order,” the FTC’s majority wrote. “The relief we have achieved today solves concrete problems, rather than venting frustration with individuals.”
Facebook’s general counsel, Colin Stretch, said the agreement “will mark a sharper turn toward privacy, on a different scale than anything we’ve done in the past.”
Separately Wednesday, the Securities and Exchange Commission announced a settlement with Facebook—including a fine of $100 million—over claims it insufficiently warned investors that developers and other third parties may have obtained users’ data without their permission or in violation of Facebook policies. Facebook neither admitted nor denied the SEC claims. The company said it shares the regulator’s insistence that it be “transparent with our investors about the material risks we face, and we have already updated our disclosures and controls in this area.”
The settlement with the FTC requires creation of a new committee of Facebook’s board to monitor the company’s privacy practices. Legal experts said they couldn’t recall prior FTC privacy settlements imposing such a requirement.
“If the committee had appropriate authority and was answerable to the FTC, it could have a significant impact,” David Vladeck, a former head of the agency’s consumer protection bureau during the Obama administration, said on Monday before the agreement’s announcement.
The order also requires Facebook to report to the FTC incidents where data of 500 or more users has been compromised, along with the company’s efforts to address the problems, and to deliver the documentation within 30 days.
The federal probe began more than a year ago after disclosures that data on tens of millions of Facebook users had been improperly transferred to a political data-analytics firm, Cambridge Analytica, that did work for Donald Trump’s 2016 presidential campaign.
The FTC’s investigation found more problems, Mr. Chopra said in his dissent, including Facebook misrepresenting its user settings and privacy tools to lure users into sharing information.
“The investigation also uncovered additional violations, including false assurances to users that they would need to opt in to facial recognition,” he said. “In addition, Facebook encouraged users to turn over their phone numbers for security purposes, but used those phone numbers to feed the company’s surveillance and advertising business.”
The lack of bipartisan agreement on the settlement within the FTC sends “the wrong message to tech companies,” Sens. Ed Markey (D., Mass.), Josh Hawley (R., Mo.) and Richard Blumenthal (D., Conn.) said in a letter to the FTC after some details of the settlement were disclosed earlier this month.
They told the agency they expected “strict structural reforms and managerial accountability that would put an end to Facebook’s privacy invasions.”
Lawmakers of both parties as well as Mr. Trump have gone on the offensive over a range of concerns relating to some tech companies’ immense size and influence, as well as their perceived intrusiveness in people’s lives. That reflects broader unhappiness in Washington over Big Tech, and particularly internet companies such as Facebook and Alphabet Inc.’s Google unit.
For Facebook, the FTC settlement appeared unlikely to have much immediate impact on its lucrative business model. The company earns almost all its profits from selling advertising that targets users based on their online behavior.
But the deal also appeared unlikely to do much to restore the company’s image, which has been badly tarnished during the investigation.
When a March Wall Street Journal/NBC News poll asked Americans how much they trusted huge tech firms to protect their personal information, Facebook scored the worst, with 60% responding they trusted the company “not at all.” That compared with 37% for Google and 28% for Amazon.com Inc.
The investigation and settlement also appear likely to heighten scrutiny of Mr. Zuckerberg, although the company succeeded in softening FTC efforts to target him individually.
The federal probe also has led to increasing focus on other alleged privacy missteps by the company that is likely to continue. Even as the FTC settlement was being completed this week, for example, new questions were being raised over potential risks to children from its Messenger Kids app.
The settlement could fuel a growing partisan debate over online privacy. To the extent lawmakers aren’t satisfied by the deal that may make both the FTC and Facebook targets during the 2020 campaign. It also may bolster efforts in Congress to grant more privacy authority to the FTC or another agency, although such legislation is currently stalled.