Facebook confirmed it is in discussions with the agency but declined to comment further. The FTC declined to comment. The two people familiar with the probe spoke on the condition of anonymity because they were not authorized to discuss the private talks.
A multi-billion dollar fine would amount to a reckoning for Facebook in the United States after a series of privacy lapses that may have put the personal information of its users at risk. Lawmakers have faulted the company for mishandling that data while failing to crack down on other digital ills, including the rise of online hate speech and the spread of disinformation from Russian operatives and other foreign actors.
“Facebook faces a moment of reckoning and the only way it will come is through an FTC order with severe penalties and other sanctions that stop this kind of privacy misconduct going forward,” said Democratic Sen Richard Blumenthal (Conn.).
For the FTC, a significant punishment levied against Facebook could represent a new era of scrutiny for Silicon Valley companies after years of privacy missteps. To date, the largest fine the FTC has imposed on a tech giant for breaking an agreement with the government to safeguard consumers’ data was a $22.5 million penalty that Google paid to settle a probe over in 2012.
“It is an open question at this moment in time whether the Federal Trade Commission is an effective privacy agency, and it is also an open question as to whether the FTC is willing to use its current authority to safeguard consumer privacy in the United States,” said Marc Rotenberg, the executive director of the Electronic Privacy Information Center.
With a steep fine and other penalties, Rotenberg said it “would indicate the FTC is now prepared to enforce its consent orders.”
The FTC’s probe of Facebook began in March of last year in response to reports about the social giant’s entanglement with Cambridge Analytica, a political consultancy that improperly accessed data on 87 million of the social site’s users. The agency’s inquiry focuses on whether Facebook’s conduct — along with a series of additional privacy mishaps made public in recent months — amount to violations of a 2011 agreement Facebook brokered with the FTC to improve its privacy practices. Facebook has maintained it did not breach that accord.
The FTC agreement stipulated that Facebook had to be more transparent and notify users in a clearer way before it shares personal data with third parties. The order also barred Facebook from deceiving users about its privacy practices, and it instituted regular checkups on the way it uses data. Under FTC rules, the agency can seek steep fines determined in part by the number of times a company violates such an order.
Facebook could broker a deal with the U.S. government by agreeing to pay a fine and make some changes to its business practices. That settlement would then have to be approved by a judge. The FTC’s punishment could include a new order that could force the tech giant to submit to tougher checkups to ensure it is complying with the settlement, according to two other people familiar with the probe but not authorized to discuss it publicly.
Alternatively, Facebook could choose to fight the federal agency over its findings and proposed punishments. If that battle lands in federal court, the move could prove bruising to both sides, analysts say, by putting Facebook’s top executives on a witness stand while subjecting the agency’s authority over tech giants to high-profile judicial review.
But Facebook could face significant reputation risk if it decided to fight the FTC fine. “They’re hemorrhaging users, they’re hemorrhaging trust, and I think this would only exacerbate the problem,” said Justin Brookman, the director of consumer privacy and technology policy for Consumer Reports.
Last year, Facebook said it would contest a small fine levied by regulators in the United Kingdom last year over its entanglement with Cambridge Analytica. The social-media giant is also battling back a lawsuit filed by the attorney general of the District of Columbia that contends Facebook misled its users about its data-collection practices. A slew of other attorneys general in states including New York, Pennsylvania and California have previously said they are investigating Facebook.
Adding to the pressure in Washington, a collection of consumer advocates urged the FTC last month to penalize Facebook aggressively with “substantial fines,” perhaps exceeding $2 billion, along with an order that limits how and when Facebook collects data about its users
“The company’s business practices have imposed enormous costs on the privacy and security of Americans, children and communities of color, and the health of democratic institutions in the United States and around the world,” wrote groups led by EPIC, which filed the original complaint leading to the FTC’s 2011 settlement.
Lawmakers also have pressed the FTC to speed up its work and penalize Facebook nearly a year after it first announced its investigation. “When Americans’ privacy is breached, they deserve a speedy and effective response,” wrote Blumenthal and Sen. Edward J. Markey (D-Mass.) in a letter in January.