## Facts

- In 2012, the Federal Trade Commission (FTC) issued an administrative order governing Facebook, Inc.’s privacy representations and requiring Facebook to implement and maintain a comprehensive privacy program.
- The 2012 order barred Facebook from misrepresenting the extent to which users could control the privacy of their personal information and required practices designed to address privacy risks connected to Facebook’s products and services.
- The FTC alleged that after the 2012 order, Facebook failed to disclose to users that information shared with “friends” could be further shared by those friends with third parties, including app developers and behavioral advertisers.
- In 2014, Facebook publicly stated it would no longer allow third-party app developers to obtain users’ personal information through their friends.
- The FTC alleged that, despite that 2014 statement, Facebook continued allowing certain third-party app developers to access users’ personal information through their friends for at least an additional year.
- The 2012 order required Facebook’s privacy program to address privacy risks, but the FTC alleged Facebook’s program did not include a process to screen or evaluate third-party app developers seeking access to user data.
- The FTC further alleged Facebook represented to users that its facial-recognition feature would not operate unless users turned it on, but for certain users the feature was enabled automatically.

## Issues

1. Whether Facebook violated the 2012 FTC order by failing to accurately disclose how users’ information could be shared with third parties through friends and by misstating the extent of third-party access to user data.
2. Whether Facebook’s continued provision of “friends” data access to third-party app developers after announcing it would stop that access constituted a misrepresentation prohibited by the 2012 order.
3. Whether Facebook failed to maintain a comprehensive privacy program required by the 2012 order by omitting controls to screen and oversee third-party app developers.
4. Whether Facebook’s statements about user choice for facial-recognition operation were deceptive, including where the feature was enabled automatically for some users.

## Decision

- The FTC determined there was reason to believe Facebook had engaged in conduct inconsistent with the 2012 administrative order’s restrictions on privacy misrepresentations and the order’s privacy-program requirements.
- The matter proceeded as an FTC administrative enforcement action focused on alleged order violations tied to third-party data access and representations about privacy settings, including facial recognition.
- The proceeding resulted in an FTC order-based resolution that addressed alleged misrepresentations about privacy controls and third-party access and required privacy-program measures directed at identified risks, including controls related to third-party app developers and user-facing privacy settings.

## Legal Principles

- When an FTC administrative order prohibits privacy-related misrepresentations, statements or omissions about the extent of user control and the extent of third-party access to personal information can constitute violations of that order.
- A company subject to an order requiring a comprehensive privacy program must implement processes reasonably designed to identify and manage privacy risks tied to its services, including risks created by third-party developers that seek access to user data.
- Representations that a privacy-sensitive feature (such as facial recognition) operates only if a user affirmatively turns it on can be deceptive if the feature is enabled by default for certain users or otherwise operates inconsistently with the representation.
- In an FTC administrative enforcement matter, the Commission may use order-based remedies to impose forward-looking requirements aimed at preventing repetition of the specific privacy representations and data-access practices found to be at issue.

## Conclusion

In *In the Matter of Facebook, Inc., No. C-4365 (2019)*, the FTC pursued an administrative enforcement action alleging Facebook violated a prior 2012 FTC privacy order by failing to disclose friends-based third-party sharing, continuing certain third-party access after announcing it would stop, lacking developer-screening controls in its privacy program, and misrepresenting how facial recognition was enabled; the resulting order-based relief focused on preventing future misstatements and requiring privacy-program controls tied to those risks.
