AFTER MONTHS OF negotiations, the Federal Trade Commission fined Facebook a record-setting $5 billion on Friday for privacy violations, according to multiple reports. The penalty comes after an investigation that lasted over a year, and marks the largest in the agency’s history by an order of magnitude. If approved by the Justice Department’s civil division, it will also be the first substantive punishment for Facebook in the US, where the tech industry has gone largely unregulated. But Washington has taken a harsher stance toward Silicon Valley lately, and Friday’s announcement marks its most aggressive action yet to curb its privacy overreaches.
Full details of the settlement were unavailable Friday afternoon, and the FTC and Facebook both declined to comment. The Wall Street Journal first reported the news. It’s unclear how long it will take for the Justice Department to review the terms. In the meantime, important questions remain unanswered, including whether the FTC has opted to hold Facebook CEO Mark Zuckerberg personally liable for the company’s privacy violations, and what sort of external oversight Facebook must submit to going forward.
The FTC opened its investigation into Facebook’s data practices last March, one week after news broke that Cambridge Analytica, a political consulting firm that worked with the Trump campaign in 2016, had improperly obtained information on tens of millions of Facebook users. The data was purchased from an academic who used a personality profiling app to collect information not just from consenting users but, thanks to Facebook’s lax privacy policies at the time, from all those users’ friends—without their knowledge. Facebook didn’t cut off that access until 2015.
But in 2011, Facebook had promised the FTC that it would not share data with third parties without users’ affirmative consent, as part of a settlement agreement over charges that the company deceived consumers about its privacy practices. It appears that the regulator has found that Facebook violated that consent decree.
The reported fine far surpasses the previous largest privacy-related penalty that the FTC has levied, a $22.5 million strike against Google in 2012 over its privacy policies on the Safari browser. But even $5 billion would be a drop in the bucket for Facebook, which generated $15 billion in revenue last quarter alone. When Facebook disclosed in its Q1 earnings report that it had set aside $3 billion to $5 billion to cover the costs of the settlement, its stock price soared.