In recent years, tech companies that played fast and loose with customers' data have faced lawsuits, civil investigations by the government, and even fines by the Federal Trade Commission. But criminal prosecutions weren't on the table. Until now, that is.
The New York Timesreported Wednesday evening that federal prosecutors in the Eastern District of New York are pursuing a criminal investigation into Facebook's data sharing practices. A grand jury has already reportedly subpoenaed at least two smartphone manufacturers that entered into partnerships with Facebook. Both of the manufacturers reportedly were able to obtain personal information about Facebook users as a result of the arrangements.
The Times says the precise focus of the investigation isn't yet clear. The paper notes that the company was already facing governmental inquiries over news that the data consultancy Cambridge Analytica harvested personal information of up to 87 million users. Facebook says it's cooperating with the investigations, according to the Times.
While there are numerous reasons why Facebook's decision to share users' information with app developers or other outside companies was ill-advised, it's not clear how doing so could have violated any criminal laws.
The company has consistently argued that its data transfers didn't violate promises to users, or a 2011 consent decree that prohibits Facebook from misrepresenting its privacy practices.
Facebook has argued in court papers and other public statements that its privacy policies notified users their data could be shared with other companies.
While the company almost certainly doesn't have public opinion on its side, it isn't necessarily wrong on the law: Facebook may well have disclosed the possibility of data sharing with outside parties -- albeit in fine print that virtually no one read.
In fact, U.S. District Court Judge Vince Chhabria, who is presiding over a class-action lawsuit stemming from the Cambridge Analytica fiasco, recently indicated he believes Facebook disclosed its practices to users via privacy policies.
“If you read the words, you come away knowing that even if you limit your settings so that you're sharing only with friends, these third-party apps can communicate with your friends and get all of the information that your friends have access to unless you further change your settings,” Chhabria said, according to a transcript Facebook provided to a judge presiding over a lawsuit brought by the Washington D.C. attorney general.
“Even then,” Chhabria continued, “you can further change your settings, but if you want to have a meaningful Facebook experience, apps are still going to get some subset of information about you. All of that seems to be disclosed.”
Of course, even if Facebook prevails in its various legal fights, Congress could pass new privacy laws that would restrict the use of online data. Sen. Ron Wyden (D-Oregon) has already floated a privacy and security bill that provided for criminal sanctions, including up to 20 years in prison, for some senior executives. New court rulings in favor of Facebook (and other tech companies) could give even more momentum to efforts to pass bills like the one proposed by Wyden.