WASHINGTON, D.C. — Federal regulators have fined Facebook $5 billion for privacy violations and are instituting new oversight and restrictions on its business. But they are only holding CEO Mark Zuckerberg personally responsible in a limited fashion.
The fine is the largest the Federal Trade Commission has levied on a tech company, though it wonβt make much of a dent for a company that had nearly $56 billion in revenue last year.
As part of the agencyβs settlement with Facebook, Zuckerberg will have to personally certify his companyβs compliance with its privacy programs. The FTC said that false certifications could expose him to civil or criminal penalties.
Some experts had thought the FTC might fine Zuckerberg directly or seriously limit his authority over the company.
βThe magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC,β Joe Simons, the chairman of the FTC, said in a statement. He added that the new restrictions are designed βto change Facebookβs entire privacy culture to decrease the likelihood of continued violations.β
Facebook does not admit any wrongdoing as part of the settlement.
Two of the five commissioners opposed the settlement and said they would have preferred litigation to seek tougher penalties.
The commission opened an investigation into Facebook last year after revelations that data mining firm Cambridge Analytica had gathered details on as many as 87 million Facebook users without their permission. The agency said Wednesday that following its yearlong investigation of the company, the Department of Justice will file a complaint alleging that Facebook βrepeatedly used deceptive disclosures and settings to undermine usersβ privacy preferences.β
The FTC had been examining whether that massive breakdown violated a settlement that Facebook reached in 2012 after government regulators concluded the company repeatedly broke its privacy promises to users. That settlement had required that Facebook get user consent to share personal data in ways that override their privacy settings.
The FTC said Facebookβs deceptive disclosures about privacy settings allowed it to share usersβ personal information with third-party apps that their friends downloaded but the users themselves did not give permissions to.
Privacy advocates have pushed for the FTC to limit how Facebook can track users β something that would likely cut into its advertising revenue, which relies on businesses being able to show users targeted ads based on their interests and behavior. The FTC did not specify such restrictions on Facebook.
Three Republican commissioners voted for the fine while two Democrats opposed it, a clear sign that the restrictions on Facebook donβt go as far as critics and privacy advocates had hoped. That wish list included specific punishment for Zuckerberg, strict limits on what data Facebook can collect and possibly even breaking off subsidiaries such as WhatsApp and Instagram.
βThe proposed settlement does little to change the business model or practices that led to the recidivism,β wrote Commissioner Rohit Chopra in his dissenting statement. He noted that the settlement imposes βno meaningful changesβ to the companyβs structure or business model. βNor does it include any restrictions on the companyβs mass surveillance or advertising tactics,β he wrote
The fine is well above the agencyβs previous record for privacy violations β $22.5 million β which it dealt to Google in 2012 for bypassing the privacy controls in Appleβs Safari browser. There have been even larger fines against non-tech companies, including a $14.7 billion penalty against Volkswagen to settle allegations of cheating on emissions tests and deceiving customers. Equifax will pay at least $700 million to settle lawsuits and investigations over a 2017 data breach; the FTC was one of the parties. The money will likely go to the U.S. Treasury.
The FTCβs new 20-year settlement with Facebook establishes an βindependent privacy committeeβ of Facebook directors. The committeeβs members must be independent, will be appointed by an independent nominating committee and can only be fired by a βsupermajorityβ of Facebookβs board of directors. The idea is to remove βunfettered controlβ by Zuckerberg, the FTC said.
Since the Cambridge Analytica debacle erupted more than a year ago, Facebook has vowed to do a better job corralling its usersβ data. Nevertheless, other missteps have come up since then.
In December, for example, the Menlo Park, California, company acknowledged a software flaw had exposed the photos of about 7 million users to a wider audience than they had intended. It also acknowledged giving big tech companies like Amazon and Yahoo extensive access to usersβ personal data, in effect exempting them from its usual privacy rules. And it collected call and text logs from phones running Googleβs Android system in 2015.
Amid all that, Zuckerberg and his chief lieutenant, Sheryl Sandberg, apologized repeatedly. In March, Zuckerberg unveiled a new, βprivacy-focusedβ vision for the social network that emphasizes private messaging and groups based on usersβ interests.
But critics and privacy advocates are not convinced that either a fine or Facebookβs new model amounts to a substantial change.
If the companyβs business practices donβt change as result of the FTCβs action, βthere is no benefit to consumers,β said Marc Rotenberg, the president and executive director of the Washington-based nonprofit Electronic Privacy Information Center.
βThe eight-year delay wonβt be justified,β he said, referring to when Facebook first told the FTC it would do better.
The fine does not spell closure for Facebook, although the companyβs investors β and executives β have been eager to put it behind them. Facebook is still under various investigations in the U.S. and elsewhere in the world, including the European Union, Germany and Canada. There are also broader antitrust concerns that have been the subject of congressional hearings, though it is too early to see if those will come to fruition.
Matt Stoller, a fellow at the Open Markets Institute, which has been critical of Facebook, said the company should admit wrongdoing.
βThere should be structural solutions to force competition into the social networking market,β he added. βOne of the angles for competition is privacy. They will compete to make a safer space to retain their user base.β
