Facebook fined billions and forced to restructure after privacy violations

Facebook has reached a $5 billion settlement with the US trade watchdog FTC. This relates to multiple privacy violations by the social network. The FTC also requires Facebook to make major changes to its corporate structure.

The fine is the largest the FTC has handed out to date. “Despite promising billions of users that they had control over how their personal data is shared, Facebook undermined those choices for years,” FTC chairman Joe Simons said in a statement. In addition to paying the fine, Facebook must also introduce new privacy rules. These apply not only to Facebook itself, but also to other apps from the company, such as WhatsApp and Instagram.

The fine comes after more than a year of investigation. The FTC launched its investigation into the Cambridge Analytica scandal, though the investigation soon expanded to include other privacy violations by the company. Facebook has been fined for three different violations. For example, the company allegedly misled users about when it shared data from users’ friends with third parties, even if those friends had changed their privacy settings themselves. For example, the company built the Privacy Checkup, a feature that would allow users to easily determine what they wanted to share with others. However, it did not clearly state that Facebook was allowed to share user data with others despite those settings.

Also, Facebook would not have been honest about stopping data sharing. Facebook announced in April 2014 that third-party developers could no longer collect data from users’ friends, but allowed them to do so until April 2015. According to the FTC, Facebook would not have completely stopped doing so until June 2018.

The FTC also denounces the way Facebook monitored developers on the platform. The social network would not screen developers or their apps before collecting user data. The company said it would crack down on violators who collected too much data or did so unfairly, but the FTC says Facebook wasn’t doing enough. The internal policy would also be ignored if Facebook became financially better off.

The trade watchdog also has problems with Facebook’s handling of facial recognition. The company is said to have enabled a feature called ‘Tag Suggestions’ by default to train facial recognition algorithms based on it, while the company wrote in its data processing agreement that the feature was opt-in. Finally, the FTC denounces the fact that Facebook used phone numbers to link advertising features to it, even if users initially set it only for security features such as two-step verification or backup.

Changes

The fine is not the only punishment for Facebook. The company also has to rebuild its entire privacy policy from scratch. The trade authority has enforced significant measures. Many of the things the company has now been fined for, such as abusing phone numbers, must stop immediately. Facebook also has to encrypt user passwords and regularly check that they are not stored in plaintext. This measure is being implemented after it turned out that Facebook stored hundreds of millions of passwords in a readable way.

Facebook is required by the FTC to implement high-level measures to better protect privacy. That starts at the board level; the measures are intended to curtail Mark Zuckerberg’s power. For example, Facebook must set up an independent privacy committee. It must monitor the overall privacy aspects of the entire social network. Members of that committee must be appointed by another independent committee, and can only be dismissed by a majority of the Board of Directors.

The same goes for new compliance officers who are deployed in different departments of the company. They fall under the privacy committee and will supervise at a smaller level. In particular, the fact that Mark Zuckerberg cannot fire them as a major shareholder is an important step, according to the FTC. The compliance officers must submit an independent report to the FTC every quarter in which they demonstrate that they meet individual requirements of the new regulations.

The FTC itself will also have more options to monitor Facebook. The watchdog can appoint external researchers to check whether Facebook is complying with the newly imposed privacy rules and whether risks may arise in the future. Under the new rules, the FTC may also use more tools to enforce the rules, although it is not entirely clear what those rules are.

Facebook response

In a response, Facebook says little substantive about the fine, except that it will implement the new rules of the FTC. The first step the company is taking is to impose more restrictions on apps that collect data through friendships on the network. Users will also gain more insight into which apps they have linked to Facebook, and the social network will reward people who expose abuses by app developers.

The FTC didn’t just attack Facebook, though. The watchdog has simultaneously sued Cambridge Analytica. The company allegedly misinformed users about how it collected personal data.