Facebook, Inc. agreed to pay a record $5 billion civil penalty and submit to new privacy oversight requirements under a settlement with the Federal Trade Commission announced July 24, 2019, resolving charges that the company violated a 2012 FTC consent order by deceiving users about their ability to control the privacy of their personal information.DOCUMENTED
The settlement, approved by a 3-2 vote of the Commission along party lines, remains the largest penalty ever imposed by the FTC for any privacy or data-security violation and one of the largest penalties ever assessed by the U.S. government for any violation of any kind.DOCUMENTED
- Facebook paid a $5 billion civil penalty, roughly 20 times larger than the largest privacy or data-security penalty ever previously imposed worldwide.
- The case stemmed from Facebook's alleged violations of a 2012 FTC consent order requiring the company to give users clear notice and obtain consent before sharing their data beyond stated privacy settings.
- Data harvested by an outside quiz app developer, whose data was later provided to political consulting firm Cambridge Analytica, affected up to 87 million Facebook users.
- The FTC's complaint alleged Facebook gave third-party app developers access to data on users' friends without those friends' knowledge or consent, despite privacy settings suggesting otherwise.
- The settlement required Facebook to restructure its approach to privacy, including new board-level oversight and independent third-party assessments every two years.
The 2012 order Facebook allegedly violated
Facebook had previously settled FTC charges in 2012 alleging the company deceived consumers by telling them their personal information would remain private, while actually allowing that information to be shared and made public in ways users did not expect. As part of that earlier settlement, Facebook agreed to a consent order requiring it to obtain users' affirmative consent before sharing their information beyond the privacy settings they had specified.DOCUMENTED
The FTC's 2019 complaint alleged Facebook violated that 2012 order in multiple ways, including by misrepresenting the extent to which users could control the privacy of their personal information, misrepresenting its compliance with the EU-U.S. Privacy Shield framework, and misrepresenting that a facial recognition feature was off by default when it was not.DOCUMENTED
The Cambridge Analytica connection
Central to the case was Facebook's "Friends API," a feature that allowed third-party app developers to access not only data on the app's actual users but also data on those users' Facebook friends, even when those friends had never installed or interacted with the app themselves and had no knowledge their data was being accessed. According to the FTC's complaint, a personality quiz app developed by Aleksandr Kogan, a researcher who separately worked with political consulting firm Cambridge Analytica, used this API to harvest data on up to 87 million Facebook users, the overwhelming majority of whom never took the quiz themselves and had only a friend connection to someone who did.DOCUMENTED
That harvested data was subsequently obtained by Cambridge Analytica and reportedly used in connection with political campaign targeting, a revelation that became public in March 2018 and set off the broader public scandal and Congressional scrutiny that ultimately led to the FTC's investigation and this settlement.DOCUMENTED
The settlement's structural reforms
Beyond the $5 billion penalty, the order imposed a set of governance reforms designed to embed privacy oversight more deeply into Facebook's corporate structure. The settlement required Facebook to establish an independent privacy committee of its board of directors, removing unilateral control over privacy decisions from CEO Mark Zuckerberg alone. It also required the company to designate compliance officers responsible for its privacy program who could be removed only by the board's privacy committee, and mandated an independent third-party assessor conduct biennial reviews of Facebook's privacy practices.DOCUMENTED
A divided Commission
The settlement passed on a 3-2 party-line vote, with the Commission's two Democratic commissioners at the time, Rohit Chopra and Rebecca Kelly Slaughter, dissenting from the majority's approval. Their dissents argued the settlement's terms, including the monetary penalty and the decision not to impose individual liability on Zuckerberg or other executives, were insufficient given the scale of Facebook's alleged violations and the fact that the underlying conduct occurred after the company had already agreed to the 2012 consent order specifically meant to prevent it.DOCUMENTED
A record that still stands
Then-FTC Chairman Joe Simons defended the settlement's scale, describing the $5 billion penalty as unprecedented in the world of privacy enforcement and one that would fundamentally alter how the company approached privacy decision-making going forward, given the new governance and accountability structure layered on top of the monetary penalty.DOCUMENTED
More than five years later, the $5 billion Facebook penalty remains the largest privacy-related fine the FTC has ever imposed on any company, a benchmark that subsequent privacy and data-security settlements, including far smaller cases against health-data companies and ad-tech firms, have been measured against ever since.
More than five years on, the case remains a touchstone in debates over whether monetary penalties alone, however large, meaningfully change a dominant platform's data-handling incentives absent structural changes to its underlying business model. Facebook's advertising business, built fundamentally around monetizing user data and attention, continued operating largely unchanged in its core mechanics even after the settlement's governance reforms took effect, a reality that shaped much of the subsequent debate in Congress and among privacy advocates over whether comprehensive federal privacy legislation, rather than case-by-case FTC enforcement, is the more durable path to protecting consumer data going forward.REVIEWED
Facebook's rebrand to Meta Platforms in 2021, adopted partly to signal a strategic pivot toward virtual and augmented reality products, did not exempt the company's core advertising business from the settlement's ongoing governance and independent-assessment requirements, which continue to apply to the underlying legal entity regardless of the corporate name or stated strategic direction it has since adopted.REVIEWED
The case also prompted renewed congressional interest in comprehensive federal privacy legislation, though no such law has since been enacted, leaving the FTC's Section 5 authority and case-by-case consent-order enforcement as the primary federal mechanism for policing platform data practices in the years since the Facebook settlement, notwithstanding the emergence of state-level privacy statutes in California and elsewhere covering similar ground.REVIEWED
Sources behind this report
Have documents relevant to this story? Reach us through our tips channel.