## Facts

- In 2012, Facebook, Inc. entered into an FTC consent order (the “2012 order”) that barred Facebook from misrepresenting (1) the extent to which it shared user information with third-party applications and (2) the extent to which consumers could control that sharing.
- The 2012 order also required Facebook to maintain a reasonable privacy-protection program designed to address privacy risks in developing and managing its products and services.
- After later concerns about Facebook’s practices, FTC staff conducted an investigation into whether Facebook was complying with the 2012 order.
- Following the investigation, the FTC authorized the filing of an action in federal district court seeking civil penalties and injunctive relief based on alleged violations of the 2012 order.
- The complaint alleged Facebook violated the 2012 order by:
  - Misrepresenting the extent of third-party application developers’ access to user information.
  - Misrepresenting the amount of user control over third-party sharing and misrepresenting the steps users needed to take to limit certain sharing.
  - Allowing financial considerations to affect enforcement of its policies, resulting in a privacy-protection program that was not reasonable as required by the 2012 order.
- The complaint also alleged a new Section 5 violation based on deceptive practices involving phone numbers collected for account-security purposes but then used for advertising.
- Facebook and the FTC negotiated a settlement that resulted in a stipulated order (filed July 24, 2019) providing for a civil penalty and detailed prospective obligations aimed at preventing future privacy misrepresentations and improving internal controls.

## Issues

1. Whether Facebook’s post-2012 representations and data-sharing practices violated the 2012 FTC consent order, authorizing civil penalties and injunctive relief.
2. Whether Facebook’s alleged use of phone numbers collected for account-security purposes for advertising constituted a deceptive act or practice under Section 5 of the FTC Act.
3. What injunctive and oversight requirements were appropriate in the stipulated settlement to reduce the risk of future privacy misrepresentations and failures in Facebook’s privacy-protection program.

## Decision

- The dispute was resolved through a stipulated settlement rather than a litigated merits decision.
- The stipulated order imposed a $5 billion civil penalty/monetary judgment and required Facebook to undertake detailed prospective privacy and accountability obligations.
- The settlement addressed alleged violations of the 2012 order relating to third-party access and user control representations, and it addressed alleged deceptive practices regarding phone numbers collected for security features.
- The stipulated order imposed governance, monitoring, and reporting requirements intended to improve internal review of privacy risks and to provide the government with ongoing visibility into Facebook’s privacy practices.
- Facebook did not admit liability as part of the settlement, except to the extent reflected in agreed terms and any express stipulations in the order.

## Legal Principles

- The FTC may seek civil penalties and injunctive relief in federal court for alleged violations of an existing FTC administrative consent order under the FTC Act.
- Statements to users about what information is shared with third parties, and how users can control that sharing, can be actionable under Section 5 when they are materially misleading.
- A consent-order requirement to maintain a reasonable privacy-protection program can be violated when a company’s controls and enforcement are not reasonably designed to address identified privacy risks, including risks created by third-party access.
- Collecting information for a stated security purpose and then using it for advertising can be deceptive when the use conflicts with the company’s representations to consumers.
- Privacy settlements may impose forward-looking governance and accountability measures (including oversight, documentation, assessments, and reporting) to reduce the likelihood of repeat order violations.

## Conclusion

In *In re Facebook, Inc.*, FTC Docket No. C-4365 (July 24, 2019), the FTC’s investigation and federal-court enforcement effort based on the 2012 consent order concluded in a stipulated settlement that imposed a $5 billion penalty and imposed detailed prospective requirements focused on truthful privacy representations, controls over third-party access, and internal privacy program accountability, including limits on using security-collected phone numbers for advertising when inconsistent with user-facing statements.


In re Facebook, Inc., FTC Docket No. C-4365 (July 24, 2019)