• by Wendy Davis  @wendyndavis, April 24, 2020

A federal judge has approved Facebook's controversial $5 billion privacy settlement with the Federal Trade Commission.

In an order issued late Thursday, U.S. District Court Judge Timothy Kelly in Washington, D.C. rejected arguments by advocacy groups that the settlement doesn't go far enough to protect users from future privacy violations.

Kelly wrote that even though Facebook's alleged privacy violations were “stunning,” he would defer to the FTC's discretion.

“In the court’s view, the unscrupulous way in which the United States alleges Facebook violated both the law and the administrative order is stunning,” he wrote, adding that the allegations “call into question the adequacy of laws governing how technology companies that collect and monetize Americans’ personal information must treat that information.”

But he said those issues “are largely for Congress,” and not relevant to the settlement.

In addition to the $5 billion penalty, the settlement agreement requires Facebook to implement new privacy oversight. The most controversial portion of the deal, which was approved last July by a 3-2 vote, also immunizes the company from prosecution for potential privacy violations that occurred before mid-June of 2019.

The deal resolves an FTC investigation into whether Facebook violated the terms of a 2012 consent decree. That earlier order, which also stemmed from an investigation into Facebook's privacy practices, prohibits the company from misrepresenting the extent to which it makes users' information available to third parties.

Facebook allegedly violated the 2012 order in several ways, including by allowing Cambridge Analytica and other outside developers access to users' data, collecting phone numbers for security purposes but then using them for advertising, and misleading people about the use of facial recognition technology.

Kelly wrote that some of the allegations, such as the ones regarding the use of phone numbers “represent discrete and poorly considered decisions.”

Other allegations “appear to reflect Facebook’s willingness to deceive its users outright, such as allegedly telling the public that it would not share their personal information with third parties when it was continuing to do so,” he wrote. “And still others represent systemic oversight failures, such as allegedly allowing third parties to access users’ personal information without the users’ knowledge and without controlling how those third parties would use the information.”

Last July, when the agreement was announced, the deal drew criticism by outside watchdogs and some lawmawkers. Sen. Ed Markey (D-Massachusetts) called the settlement an “insult to consumers,” adding that it could encourage questionable practices by tech companies.

“The only market-wide message the Commission is sending is that it is acceptable for online giants to beg for forgiveness afterward rather than get permission first,” Markey stated at the time.

FTC Commissioner Rohit Chopra, who voted against the deal, said last July the agreement could prevent agency from prosecuting Facebook for prior violations of the Children's Online Privacy Protection Act. 

"The proposed release not only shields Facebook from 'known' (an undefined term) Section 5 claims, but also 'known' claims under COPPA and other statutes," he wrote in a dissenting statement. "Given persistent questions about Facebook’s compliance with these statutes, the Commission should be transparent about which claims are being released -- even if they are being released because they are seen as lacking viability."

On Friday, Chopra repeated his criticism of the deal. “I continue to share the widespread concerns that this settlement won't fix @Facebook's fundamental problems,” he tweeted.

He also called for people with information about violations by Facebook to file formal complaints with the agency.