Facebook reaches consent decree with the Federal Trade Commission

In November 2011, the US Federal Trade Commission charged Facebook with repeatedly breaking the privacy promises it made to users. Among the list of deceptive practices and incidents in the FTC's complaint were December 2009 changes Facebook made to its site that publicly exposed information users might have marked private, such as their Friends lists; Facebook's failure to certify the security of apps participating in its Verified Apps programme, as the company said it would; the company's reneging on its promise not to share users' personal information with advertisers; and allowing access to the content in deactivated or deleted accounts after saying that information would be inaccessible. The FTC also called out Facebook for telling users they could restrict access to their data to limited audiences such as "Friends Only", but not preventing that information from being shared with third-party applications their Friends used. In the final consent decree, Facebook agreed to give consumers clear and prominent notice, obtain consumers' express consent before their information is shared beyond the privacy settings they have established, establish a comprehensive privacy programme, and have a third party conduct audits every two years until 2031. The company would be subject to civil penalties of up to $16,000 per violation of the order.

In 2018, the FTC began investigating the question of whether Facebook had violated the consent decree by allowing University of Cambridge researcher Aleksandr Kogan to collect data about Facebook users via Friends who took his "personality quiz" and then pass that data on to Cambridge Analytica. Facebook CEO Mark Zuckerberg told the US Congress that when Facebook discovered Kogan had sold the data to Cambridge Analytica in 2015, it asked that company to delete the data. However, it didn't appear to have an audit process in place to verify that Cambridge Analytica had done so. Zuckerberg argued that Kogan and Cambridge Analytica deceived Facebook, and that Facebook was not in violation of the consent decree.

https://www.ftc.gov/news-events/press-releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep
https://www.cnet.com/news/facebooks-ftc-consent-decree-deal-what-you-need-to-know/
tags: Facebook, Cambridge Analytica, deceptive practices, FTC, regulatory actions
Writer: FTC, Marguerite Reardon
Publication: FTC, CNet