Facebook hit with $5 billion fine, forced to create privacy oversight board

The Federal Trade Commission announced a $5 billion settlement with Facebook on Wednesday to end an investigation into the company’s privacy practices. It’s a record penalty that shows the federal government taking a harder stance against tech firms but one that may stop short of changing how Silicon Valley does business. Facebook will be required as part of the deal to create a new board-level committee to oversee privacy, but the agreement with the government does not include any major changes to the social media giant’s lucrative advertising business, which runs on the collection and use of personal information about its more than 2 billion users. Facebook was also expected to settle with the Securities and Exchange Commission, agreeing to pay $100 million to end an investigation into whether it sufficiently disclosed its privacy practices to investors, The Wall Street Journal reported late Tuesday. The FTC settlement, which will need to be approved by a federal judge, would put an endpoint on the U.S. government’s probe of the Cambridge Analytica scandal, which erupted last year after reports that the consulting company had obtained profile information on millions of Facebook users and their friends via a quiz app. Cambridge Analytica also worked on President Donald Trump’s 2016 campaign. "Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices," FTC Chairman Joe Simons said in a press release. "The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC. The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations." The agreement establishes a new, independent board to oversee the company’s privacy practices. CEO Mark Zuckerberg and other "designated compliance officers" will be required to submit quarterly certifications that the company is protecting user privacy. An independent assessor will also submit quarterly privacy reports. The agreement extends to messaging service WhatsApp and Instagram. Zuckerberg wrote in a post on Facebook that the settlement would force the company to slow its product development processes. "Going forward, when we ship a new feature that uses data, or modify an existing feature to use data in new ways, we’ll have to document any risks and the steps we’re taking to mitigate them," Zuckerberg wrote. "We expect it will take hundreds of engineers and more than a thousand people across our company to do this important work. And we expect it will take longer to build new products following this process going forward." Privacy advocates, lawmakers and other critics of Facebook have already been grumbling about the lack of teeth in the settlement since word that it was imminent leaked two weeks ago. Sen. Richard Blumenthal, D-Conn., said this week he was fearful the $5 billion deal "will be just a pinprick penalty compared to the total assets and profits of the company," Bloomberg News reported. The social media company and Zuckerberg won’t be required as part of the settlement to admit wrongdoing in any of a series of recent privacy flare-ups. Zuckerberg is Facebook’s founder, chairman and controlling shareholder who has final say in the company’s operations, but the FTC did not question Zuckerberg as part of its investigation, The Washington Post reported, citing two people familiar with the probe. The deal covers a drumbeat of privacy scandals that have rocked Facebook for the past two years, including its practice, revealed last year, of using phone numbers for advertising purposes when users handed them over for security purposes. The deal also covers Facebook’s failure, reported in May by Consumer Reports, to allow some users to turn off the social network’s facial recognition features. Colin Stretch, Facebook’s general counsel, wrote in a blog post that the agreement would mark a turning point for Facebook. "The agreement will require a fundamental shift in the way we approach our work and it will place additional responsibility on people building our products at every level of the company," Stretch wrote. "It will mark a sharper turn toward privacy, on a different scale than anything we’ve done in the past." "The accountability required by this agreement surpasses current U.S. law and we hope will be a model for the industry," Stretch wrote. The FTC voted 3-2 along party lines to approve the settlement this month, the Journal reported. The Republican majority approved the settlement while Democratic commissioners opposed it. It is a follow-up agreement to a 2011 settlement in which Facebook promised the FTC that it would not mislead users about its privacy practices. In a dissenting statement, Democratic FTC Commissioner Rebecca Slaughter said the regulator should have pushed Facebook harder — and gone to court if necessary. Here’s the bottom line: Facebook’s flagrant violations were a direct result of their business model of mass surveillance and manipulation, and this action blesses this model. The settlement does not fix this problem. It now goes to court for approval. — Rohit Chopra (@chopracfpb) July 24, 2019 "The Commission should not have accepted this settlement and should instead have voted to litigate," Slaughter wrote. "I understand the majority’s argument in favor of the terms of the settlement, and I recognize the settlement’s historic nature. But I do not share my colleagues’ confidence that the order or the monetary penalty will effectively deter Facebook from engaging in future law violations, and thus I fear it leaves the American public vulnerable." Democratic FTC Commissioner Rohit Chopra also dissented and said that the settlement offered unnecessary safeguards to the company. "The fine print in this settlement gives Facebook a lot to celebrate, particularly when it comes to the blanket immunity for unspecified violations by Facebook and its executives," Chopra wrote in a dissent." This is a disappointing precedent for the FTC to set, since more companies may now seek ways to buy broad immunity." The Republican commissioners wrote in their majority statement that the settlement went beyond what a court would have allowed both in terms of the monetary penalty and the installation of an oversight board. "The Order’s innovative, far-reaching conduct relief — imposing affirmative obligations and corporate governance reforms — extends well beyond the typical relief historically awarded by the courts in consumer protection cases involving legitimate companies," the Republican commissioners write. Facebook may still face scrutiny from state attorneys general, European authorities and the U.S. Justice Department, which Tuesday said it was undertaking a wide-ranging review of whether big American tech companies including Facebook have acquired too much power in the marketplace. Wall Street reacted positively when Facebook first told investors in April that it might be able to end the FTC investigation for $5 billion or less, sending shares up about 8 percent. Investors were expected to react positively again Wednesday. As of March 31, Facebook reported $45 billion in cash and cash equivalents and marketable securities. The company is due to report its latest quarterly results after the close of the stock market Wednesday. Alex Stamos, a former chief security officer of Facebook, wrote on Twitter that the settlement could also prove to be a boost for Facebook in the long term because it would preclude forcing Facebook to open itself to competition. "Facebook paid the FTC $5B for a letter that says ‘You never again have to create mechanisms that could facilitate competition,'" Stamos, who is also an NBC News contributor, wrote. "This order doesn’t include the word competition or include any balancing tests. It’s fantastic for FB."