The settlement — adopted along party lines, with the FTC’s three Republicans supporting it and two Democrats against it — puts in motion an end to a wide-ranging probe into Facebook’s mishandling of users’ personal information that began more than a year ago.
The FTC’s $5 billion punishment against Facebook sets a new record as the largest penalty ever assessed against a tech company that broke a past promise to the government to improve its privacy practices — more than 200 times greater than the previous largest fine. The matter from here rests in the hands of the Justice Department, which typically must finalize such FTC settlements, though DOJ rarely has upended them.
“It’s quite a substantial amount of money, and it sets a baseline [for] the Googles and Microsofts and Apples and the Twitters of the world,” said David Vladeck, a former director of the FTC’s Bureau of Consumer Protection who is now a law professor at Georgetown University. He said the real test of the agency’s work — to hold Facebook accountable for its missteps and deter other tech giants — would depend on final details that the FTC has not yet revealed.
But some critics still assailed the FTC on Friday for approving a fine that’s small in comparison to Facebook’s massive profits. Democratic Rep. David Cicilline (R.I.), who oversees an antitrust panel in the House, described the agency’s efforts on Friday as a “slap on the wrist.”
Investors also appeared to shrug off the initial details of the agency’s punishment: Facebook’s stock closed nearly 2 percent higher after news broke of the FTC’s vote. Facebook in April had warned Wall Street it could face a fine as high as $5 billion, and it set aside a large chunk of it during its most recent earnings report when it announced it earned $15 billion in quarterly revenue.
The FTC declined to comment on the matter. Facebook also declined to comment.
But the FTC’s probe quickly expanded beyond the Cambridge Analytica incident to cover other privacy and security abuses at Facebook, including the revelation that it had provided popular websites and the makers of some smartphones and other devices with access to users’ social data without adequately notifying them.
Under the FTC’s new settlement, the consequences for Facebook could be vast: The tech giant may have to document every decision it makes about data before offering new products, keep closer watch over third-party apps that tap users’ information, and require its top executives, including Facebook CEO Mark Zuckerberg, to attest that the company adequately has protected privacy. Facebook had agreed to broad contours of those terms as part of confidential settlement talks with the FTC, the Post reported earlier this year.
Once finalized, such a new settlement could go far beyond the 2011 agreement Facebook brokered with the FTC. That accord required Facebook to give users greater notification about what happens to their data and how their personal information is used. The agreement also required Facebook to submit to 20 years of regular privacy checkups from outside watchdogs, though those reviewers never once flagged a major mishap at the company for the FTC to review.
The Wall Street Journal first reported details of the FTC’s vote.
The decision by the commission’s two Democrats to vote against the settlement suggests simmering frustrations within the FTC that it did not go far enough in the fine and other punishments it levied against Facebook to end the probe. At times, they’ve advocated for putting not only companies but individual executives — such as Facebook CEO Mark Zuckerberg — under an order so that they can be held personally liable for future privacy abuses.
“Democrats appear to want stronger accountability, both at the c-suite of the company and processes internally,” said Ashkan Soltani, who previously served as a chief technologist at the FTC.
But Facebook fiercely resisted an effort to hold Zuckerberg personally accountable, according to two people familiar with the probe who weren’t authorized to discuss a confidential proceeding. If the company had walked away from talks, the FTC would have been forced to challenge Facebook in court, potentially triggering a bruising legal battle over the social-networking giant’s data-collection practices and the government’s ability to regulate them.
“Rather than deter misconduct, the signal here is that the fines or monetary penalties will be a fraction of what they should be,” said Sen. Richard Blumenthal (D-Conn.). “There is no reason for optimism, let alone confidence, that the structural or conduct reforms will be strong enough to really change Facebook’s ongoing practices."