## Facts

- The Federal Trade Commission (FTC) brought an administrative enforcement action against Facebook, Inc. alleging unfair and deceptive acts or practices under § 5 of the Federal Trade Commission Act.
- The FTC alleged Facebook represented that users could control the visibility of profile information, but product changes reduced or negated users’ prior privacy selections.
- The FTC alleged Facebook represented it would not share users’ personal information with advertisers, but disclosed to advertisers which specific users clicked advertisements.
- The FTC alleged Facebook represented users could limit access to photos and videos by deleting accounts, yet certain “deleted” content remained accessible through direct URLs.
- Facebook resolved the matter through a negotiated consent order; there was no litigated merits decision after an evidentiary hearing.

## Issues

1. Whether Facebook’s statements about privacy controls, data sharing with advertisers, and deletion of user content were deceptive under § 5 of the FTC Act given Facebook’s alleged practices.
2. Whether Facebook’s alleged privacy practices constituted unfair acts or practices under § 5 of the FTC Act.
3. What forward-looking injunctive and compliance obligations were appropriate to prevent recurrence of alleged privacy misrepresentations and unexpected information sharing.

## Decision

- The FTC accepted a consent order resolving the allegations of unfair and deceptive privacy practices.
- Facebook was prohibited from misrepresenting the extent to which it maintains the privacy or security of covered information, including how covered information is collected, used, disclosed, or maintained.
- Facebook was required to provide clear and prominent notice and obtain users’ affirmative express consent before sharing user information beyond the users’ established privacy settings.
- Facebook was required to implement and maintain a comprehensive privacy program addressing privacy risks to covered information.
- Facebook was required to obtain biennial, independent third-party privacy assessments for a defined period.

## Legal Principles

- Under § 5 of the FTC Act, materially misleading privacy representations about data visibility, sharing, security, or deletion can constitute deceptive acts or practices.
- When a company represents that users can control privacy settings, it must not materially diminish those controls or expand sharing beyond existing settings without clear notice and affirmative express consent.
- Structural remedies—such as a written privacy program and recurring independent assessments—may be imposed to ensure ongoing compliance where alleged misconduct reflects repeated or organizationally rooted privacy failures.
- A company’s statements about deletion or retention of user content must match actual accessibility and retention practices.

## Conclusion

The FTC’s consent order imposed injunctive and compliance requirements designed to align Facebook’s privacy representations with its practices, including a ban on privacy misrepresentations, affirmative express consent for expanded sharing, and long-term privacy program and audit obligations under § 5 of the FTC Act.


In re Facebook, Inc., No. C-4365, 2012 WL 3518628 (F.T.C. Aug. 10, 2012)