## Facts

- In 2012, the Federal Trade Commission (FTC) brought an administrative complaint against Facebook, Inc., alleging misrepresentations about how much user information Facebook shared with third parties and how much control users had over that sharing.
- Facebook agreed to a 2012 FTC consent order that prohibited privacy-related misrepresentations and required Facebook to implement a reasonable privacy-protection program.
- In 2018, reports disclosed that Cambridge Analytica used a personality-quiz app to collect personal data tied to millions of Facebook users; that data was then used to support targeted political messaging, including for the 2016 U.S. election cycle.
- Following those disclosures, the FTC reopened its investigation and alleged Facebook continued to misrepresent its privacy and data-sharing practices, including whether and how user information was made available to third-party developers and apps.
- The government also alleged Facebook used phone numbers collected for account security (such as two-factor authentication) for advertising purposes without adequate disclosure.
- The government alleged that Facebook’s platform design allowed app developers to access not only a user’s information but also information about that user’s Facebook friends, increasing the scope of data exposure.
- On July 24, 2019, the United States (acting on notification and authorization of the FTC) filed a civil enforcement complaint in the U.S. District Court for the District of Columbia, alleging violations of Sections 5(a) and 5(l) and 16(a)(1) of the FTC Act and violations of the 2012 FTC consent order.
- On the same date, the parties filed a proposed “Stipulated Order for Civil Penalty, Monetary Judgment, and Injunctive Relief,” reflecting a negotiated settlement that included a $5 billion civil penalty and significant privacy compliance and governance obligations (including enhanced oversight, monitoring, and executive compliance certifications).

## Issues

1. Whether Facebook violated the 2012 FTC consent order and Section 5 of the FTC Act through alleged deceptive privacy practices, including third-party data access and use of security-related phone numbers for advertising.
2. Whether the court should enter the parties’ proposed stipulated order resolving the government’s civil enforcement action through a civil penalty and injunctive relief.

## Decision

- On July 24, 2019, the United States initiated the civil enforcement action by filing its complaint in the District of Columbia federal district court.
- On the same date, the parties submitted a proposed stipulated order that, if approved and entered by the court, would impose a $5 billion civil penalty and require extensive privacy-related compliance and governance measures.
- As of the July 24, 2019 filing date, the court had not yet ruled on the merits or approved the proposed stipulated order.

## Legal Principles

- Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce.
- A violation of an FTC administrative order can expose a defendant to civil penalties under the FTC Act.
- The United States may bring a federal court enforcement action seeking civil penalties and injunctive relief for alleged violations of an FTC order and related consumer-protection violations.
- A negotiated stipulated order in a federal enforcement case does not take effect as a court order until the district court approves and enters it.

## Conclusion

*United States v. Facebook, Inc., Case No. 19-CV-2184 (July 24, 2019)* began as a federal civil enforcement action alleging Facebook violated a prior FTC privacy order and engaged in deceptive privacy practices highlighted by the Cambridge Analytica disclosures, including third-party access to user and friends’ data and use of security-related phone numbers for advertising; the parties simultaneously lodged a proposed stipulated order providing for a $5 billion civil penalty and significant privacy governance and compliance requirements, subject to court approval.
