Facebook was slapped with a $5 billion fine by the Federal Trade Commission on Wednesday in a record penalty that also ends an investigation into the company's privacy practices.
According to the deal announced by FTC Chairman Joe Simons, in addition to the penalty, Facebook will be required to set up a new board-level committee that would oversee the social media giant's privacy practices. However, the deal with the FTC does not require any major changes to the company's advertising business, which is run on the use of the personal information of millions of Facebook users.
"Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices," said Simons. "The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC. The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations. The Commission takes consumer privacy seriously, and will enforce FTC orders to the fullest extent of the law."
The settlement still needs to be approved by a federal judge, but if approved, it would cap an investigation by the U.S. government into the Cambridge Analytica scandal. The consulting company was revealed to have obtained millions of users' Facebook profile information and their friends using a quiz app. Cambridge Analytica also worked on President Donald Trump's 2016 campaign.
A new independent board will also be created by the social media company to oversee the privacy practices of Facebook and two other companies it owns: WhatsApp and Instagram. CEO Mark Zuckerberg as well as other "designated compliance officers" will be required to submit quarterly certifications that the company is indeed complying with protecting user's privacy. An independent assessor will also submit privacy reports every quarter.
Facebook is also set to settle a complaint with the Securities and Exchange Commission for $100 million that ends an investigation into whether the company was sufficiently transparent with investors over its privacy practices.
In a post on Facebook announcing the settlement with the FTC, Zuckerberg wrote that they were going to "set a completely new standard for our industry."
"Going forward, when we ship a new feature that uses data, or modify an existing feature to use data in new ways, we’ll have to document any risks and the steps we're taking to mitigate them," Zuckerberg wrote. "We expect it will take hundreds of engineers and more than a thousand people across our company to do this important work. And we expect it will take longer to build new products following this process going forward."
The order also imposes 'significant new privacy requirements' on the company:
- Facebook must exercise greater oversight over third-party apps, including by terminating app developers that fail to certify that they are in compliance with Facebook’s platform policies or fail to justify their need for specific user data;
- Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising;
- Facebook must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users;
- Facebook must establish, implement, and maintain a comprehensive data security program;
- Facebook must encrypt user passwords and regularly scan to detect whether any passwords are stored in plaintext; and
- Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services.
As part of the settlement, Zuckerberg and Facebook will not be required to admit any wrongdoing that include a series of privacy scandals beyond Cambridge Analytica. The settlement also covers Facebook's use of user's phone numbers for advertising purposes, or the company's failure to allow users to turn off the social media network's facial recognition feature.
"The next focus for our company is to build privacy protections as strong as the best services we provide," Zuckerberg wrote. "I'm committed to doing this well and delivering the best private social platform for our community."