FTC Announces Historic, Yet Insufficient, Settlement with Facebook for Privacy Violations

Today the FTC announced its settlement with Facebook over allegations that the company violated its 2012 consent decree and otherwise engaged in deceptive practices. The 16-month investigation began shortly after the Cambridge Analytica scandal in 2018, and the FTC expanded the scope of its investigation to cover other practices like facial recognition. The FTC levied its highest-ever, though still insufficient, $5 billion fine on the company and imposed internal and external structural requirements aimed at improving Facebook’s privacy practices.

The following statement can be attributed to Eric Null, senior counsel at New America’s Open Technology Institute:

“With the Facebook settlement, the FTC appears to be stepping up its privacy enforcement. But consumers should be skeptical that the settlement will lead to any effective change in online privacy protections or Facebook’s business practices—the company was rewarded on the stock market for the settlement, the settlement imposed no meaningful restrictions on Facebook’s data collection and sharing practices, and structural changes require a tenacious overseer to ensure compliance or they may lead to nothing.

“Today’s settlement exemplifies the need for strong privacy legislation, which could better protect consumers everywhere by making many practices, including those Facebook engaged in, explicitly unlawful. The FTC only achieved as much as it did because it had a prior consent decree in place. Without comprehensive privacy legislation, consumers will likely end up with more of the same.”