Facebook has settled complaints by the Federal Trade Commission, which alleged the company allowed advertisers and others to access users’ personal information even though it promised to protect their privacy, the agency said Tuesday.
The settlement over eight counts of privacy violations will force the the social network to obtain consent from consumers before changing its privacy policies. It also will be subject to regular, independent reviews of its practices for 20 years.
The Palo Alto, Calif.-based firm, which claims 800 million global users, will not face monetary penalties unless it violates the agreement in the future.
“Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users,” said Jon Leibowitz, chairman of the FTC. “Facebook’s innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not.”
The settlement removes a weight on the company as it plans for a massive initial public offering for next year. Facebook founder Mark Zuckerberg said in a blog post Tuesday that the Web site has tried to protect users. But he conceded that the company needs to do more.
“I’m the first to admit that we’ve made a bunch of mistakes,” Zuckerberg said. “In particular, I think that a small number of high profile mistakes . . . have often overshadowed much of the good work we’ve done.”
Recent privacy settlements with Facebook and other titans of the Web, such as Google, show that protecting consumer data has become a major policy issue in Washington, some analysts said.
Marc Rotenberg, executive director of Electronic Privacy Information Center, said, “2011 is the year the FTC took significant steps in privacy against the two biggest Internet companies in the world. It’s hard to ignore the implications for others in the industry.”
The FTC’s investigation partly stemmed from a complaint filed by the center in December 2009, when Facebook announced several changes that made some user profile information public.
The actions enraged users who complained that they were not given enough notice and that hiding their information from strangers became more difficult and confusing.
In its investigation, the agency found that when users clicked on ads, third-party marketers were able to collect the users’ information even though the company said that wasn’t possible, according to the FTC.
And those who left Facebook weren’t able to completely delete their data. As part of the settlement, Facebook agreed that 30 days after an account is deleted, no information will be available.
Members of Congress are contemplating new privacy laws intended to better protect users as they keep more of their information online.
“This action against Facebook is just the first step toward protecting consumer privacy,” said Sen. John D. Rockefeller IV (D-W.Va.) “Ultimately, I believe legislation is needed that empowers consumers to protect their personal information from companies surreptitiously collecting and using that personal information for profit.”