⚖️ Facebook $5B FTC penalty: what it required of Mark Zuckerberg

Facebook agreed in July 2019 to pay a $5 billion penalty to settle Federal Trade Commission charges that it violated a 2012 FTC order by deceiving users about their control over personal information, the FTC said in a July 24, 2019 press release. The agency called it the largest privacy penalty ever imposed on any company. The order did something less common than the number: it wrote Mark Zuckerberg's name into the compliance machinery.

The charge: a 2012 promise, an alleged breach

The 2012 order barred Facebook from misrepresenting the privacy or security of users' information and required a reasonable privacy program, the FTC's business blog says. The FTC alleges Facebook then repeatedly used deceptive disclosures and settings to undermine users' privacy preferences, which allowed personal information to reach third-party apps downloaded by users' Facebook friends. Per the FTC blog, the tools involved carried feel-good names: "Privacy Shortcuts" and "Privacy Checkup."

The Guardian reported that the FTC's investigation began in March 2018, after the Observer revealed that Cambridge Analytica had improperly obtained the private information of more than 50 million Facebook users. The FTC separately filed an administrative complaint against Cambridge Analytica, which it says deceived consumers. The FTC's release says the company had filed for bankruptcy and had not settled.

What the order required of Zuckerberg

According to the FTC's press release, the order establishes an independent privacy committee of Facebook's board, "removing unfettered control" by Zuckerberg over decisions affecting user privacy. Committee members must be independent, are appointed by an independent nominating committee, and can be fired only by a supermajority of the board.

Facebook must also designate compliance officers responsible for its privacy program. Per the FTC, the new committee approves them and only the committee can remove them, not the CEO or Facebook employees.

Then comes the signature. The FTC says Zuckerberg and the designated compliance officers must independently submit quarterly certifications that the company complies with the privacy program, plus an annual certification of overall compliance with the order. Any false certification, the FTC says, will subject them to individual civil and criminal penalties.

"The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC."

FTC Chairman Joe Simons, FTC press release, July 24, 2019

The rest of the paperwork

The FTC release says Facebook must run a privacy review of every new or modified product, service or practice before launch, and document its decisions. The program covers WhatsApp and Instagram. Incidents in which the data of 500 or more users was compromised must be documented and delivered to the FTC and the assessor within 30 days of discovery.

An independent assessor must review the privacy program every two years, using its own fact-gathering rather than relying primarily on management's assertions, and report quarterly to the board committee, per the FTC. The FTC business blog adds that phone numbers collected for security cannot be used for advertising, and that Facebook must give clear notice of facial recognition use and get express consent before a materially different use.

The money, set against the money

The FTC says the $5 billion penalty is almost 20 times greater than the largest privacy or data security penalty ever imposed worldwide. The same release says Facebook's targeted advertising generated most of its $55.8 billion in revenues in 2018. The FTC business blog notes the penalty goes to the U.S. Treasury, not the FTC, and says the agency probably could not have won a bigger civil penalty in court.

Critics were less impressed. The Guardian reported that the Wall Street Journal and the Washington Post, citing anonymous sources, said the FTC vote was 3-2 along party lines, and that Facebook and the FTC declined to comment. The Guardian also reported that Facebook had earlier said it expected a fine of between $3bn and $5bn, and that its stock rose more than 1% when the news broke.

"This reported fine is a mosquito bite to a corporation the size of Facebook"

Senator Ron Wyden, quoted by The Guardian, July 12, 2019

Matt Stoller of the Open Markets Institute called it "a parking ticket," the Guardian reported. The FTC's own account is that the penalty and conduct terms were designed to change Facebook's "entire privacy culture."

Facebook's side, and the other bills

Facebook's statement on the final order is not in the documents read. Its public posture on the underlying scandal is. Zuckerberg told Congress in April 2018, as the Guardian reported: "I started Facebook, I run it, and I'm responsible for what happens here." The 2019 order turned that sentence into a filing requirement.

The FTC penalty was not the only bill. CNBC reported that Facebook also agreed around the same time to pay $100 million to settle SEC allegations of misleading disclosures about the risk of user-data misuse. The BBC reported that Facebook agreed in October 2019 to pay a £500,000 fine to the UK data regulator with no admission of liability. CNBC reported in December 2022 that Meta agreed to pay $725 million to settle a class action, and that the company did not admit wrongdoing.

MrMoney's reading of the ledger: the $5 billion is a one-time line item. The certification is a recurring one, and money can pay the first but not sign the second.