The Federal Trade Commission's $5 billion privacy settlement with Facebook is drawing criticism from a variety of tech industry observers and privacy advocates, who say the terms aren't stringent enough.
Sen. Ed Markey (D-Massachusetts) called the deal an “insult to consumers,” adding that it could encourage questionable practices by tech companies.
“The only market-wide message the Commission is sending is that it is acceptable for online giants to beg for forgiveness afterward rather than get permission first,” Markey stated. “The FTC is giving little confidence to the American people that Facebook and other online companies will now have to operate within a new incentive structure that will end the profits-over-privacy status quo.”
The FTC said Wednesday that it voted 3-2 to approve a settlement that requires Facebook to pay $5 billion, and to accept new oversight on privacy.
The deal must still be approved by a district court judge.
If approved, the settlement will resolve an investigation into whether Facebook violated the terms of a 2012 consent decree. That earlier consent decree includes terms prohibiting Facebook from misrepresenting its privacy practices, and from misrepresenting the extent to which it makes users' information available to third parties.
Facebook allegedly violated that earlier decree in a number of ways. Three alleged misuses in particular stand out: Facebook allowed outside developers to access users' data, collected phone numbers for security purposes but then used them for advertising, and misled people about the use of facial recognition technology, according to the FTC.
Markey slammed the deal, arguing that the monetary penalty “fails to deter future bad behavior,” and and that the non-monetary components of the deal “fail to systematically change Facebook’s internal infrastructure and put a stop to its privacy malpractice once and for all.”
The settlement covers all violations of the prior consent decree that occurred before June 12, 2019. It also covers any other pre-June 12 violations of Section 5 of the FTC Act, as well as consumer-protection violations, that are currently known by the agency.
It wasn't immediately clear Wednesday what other potential violations were covered by the deal. Among the unresolved questions are whether the settlement immunizes Facebook from prosecution for allegedly violating children's privacy laws.
Last October, 17 advocacy groups, including the Campaign for a Commercial-Free Childhood, argued to the FTC that Facebook's Messenger Kids service doesn't comply with the Children's Online Privacy Protection Act.
“We don't even know if our case has been dismissed or not,” Josh Golin, executive director for the Campaign for a Commercial-Free Childhood, tells MediaPost. “That's how untransparent this decision is.”
FTC Commissioner Rohit Chopra, who dissented from the decision to resolve allegations against Facebook, appears to interpret the deal as precluding the agency from prosecuting Facebook for prior violations of the Children's Online Privacy Protection Act.
"The proposed release not only shields Facebook from 'known' (an undefined term) Section 5 claims, but also 'known' claims under COPPA and other statutes," he wrote. "Given persistent questions about Facebook’s compliance with these statutes, the Commission should be transparent about which claims are being released -- even if they are being released because they are seen as lacking viability."
The federal children's privacy law requires companies to obtain parental consent before collecting personal information -- including names, email addresses, geolocation data and unique identifiers -- from children 12 and younger. The advocacy groups said that even though Facebook requires parents to give permission before children use Messenger Kids, the company doesn't verify that the people giving permission are actually the users' parents.
Golin adds that his organization is considering weighing in on the deal with the district court.
The advocacy group Public Knowledge also criticized the deal as weak.
“Facebook users cannot count on being protected as a result of this settlement,” Charlotte Slaiman, competition policy counsel at Public Knowledge stated.
“The settlement also protects Facebook from further enforcement on other potential violations that we may not even know exist,” Slaiman added. “The settlement does not impose any pro-competition terms, such as interoperability requirements or limiting data-sharing between Facebook, Instagram, and Whatsapp to the same terms used with third-parties so that competitors can compete fairly.”
New America’s Open Technology Institute added that the deal shows a need for privacy legislation.
“The FTC only achieved as much as it did because it had a prior consent decree in place,” senior counsel Eric Null stated. “Without comprehensive privacy legislation, consumers will likely end up with more of the same.”