Whopping $5 billion FTC settlement still a bargain for Facebook, critics say

The reaction was swift, loud and predictable: Facebook got off light. After months of build-up, the $5 billion settlement between the social network and the Federal Trade Commission was anticlimactic for almost everyone, a disappointing result that managed to unite Democrats, Republicans, consumer advocates and privacy hardliners. 

The settlement does little to force changes in Facebook's core business model, which relies on using the personal data you willingly give it to deliver targeted ads. It does little to punish the company for failing to disclose how it will use the data it collects. It doesn't hold executives, including CEO Mark Zuckerberg and COO Sheryl Sandberg , personally responsible for the problems that cropped up on their watch.

Instead, the settlement mandates the creation of a committee of Facebook's board to review privacy decisions and a new privacy program. It also requires Zuckerberg to personally certify that the program complies with a legal agreement Facebook has with the FTC to protect user privacy. The $5 billion fine is the largest penalty ever levied against a company for consumer privacy violations, the FTC said. The FTC voted 3-2 along party lines to approve the settlement, which still needs to be cleared by a court. 

To Facebook's critics, the deal was an expensive Get Out of Jail Free card. 

"This settlement does nothing to change Facebook's creepy surveillance of its own users & the misuse of user data," tweeted Sen. Josh Hawley, a Republican from Missouri. "It utterly fails to penalize Facebook in any effective way."

Democrats were just as quick to bash the agreement, saying it amounted to a token penalty that will do nothing to change the social network's operating procedures. "A $5 billion fine may appear large, but it amounts to a slap on the wrist in comparison to the revenue that Facebook rakes in," Sen. Edward Markey, a Massachusetts Democrat, said in a statement. "This settlement is also notably deficient in its lack of new safeguards that would effectively prohibit similar privacy violations in the future."

The responses, as well as the settlement itself, shouldn't come as a surprise. The broad strokes of the eventual agreement -- a $5 billion fine and a handful of conditions, including one that will require CEO Mark Zuckerberg to give his word the company is protecting privacy -- have been evident for months. 

For more than a year, the FTC had been investigating whether Facebook's failure to prevent Cambridge Analytica, a now-defunct consultancy that worked on President Donald Trump's campaign, from harvesting data on as many as 87 million users was a violation of an earlier agreement to protect user privacy. Dribs and drabs of the discussions leaked out, preparing everyone for the eventual deal. In April, Facebook all but told investors what the deal would be, saying during its first-quarter earnings it had set aside as much as $5 billion related to the FTC investigation. Shares rose on relief that it was so small.

Watch this: Facebook FTC settlement puts Zuck personally on the hook

03:28

No doubt, $5 billion is a lot of money for most of us. And it's more than 200 times the $22.5 million Google paid in a 2012 FTC settlement over tracking users that set the previous record for a tech company. But at Facebook, which raked in $56 billion in revenue last year, the fine will barely be felt. 

In fact, it may be the best $5 billion Facebook ever spent.

Ashkan Soltani, former chief technologist at the FTC, noted in a tweet that the settlement covers Facebook violations outside of the Cambridge Analytica scandal. Those include using telephone numbers -- gathered ostensibly for use in two-factor authentication -- to serve ads, storing passwords in plain text and harvesting email contacts. The settlement also indemnifies Facebook for "any and all claims prior to June 12, 2019," though that applies only to issues the FTC is currently aware of.

The FTC said the settlement would achieve some of the goals that critics had identified. "The relief is designed not only to punish future violations but, more importantly, to change Facebook's entire privacy culture to decrease the likelihood of continued violations," said FTC Chairman Joe Simons in a statement. Zuckerberg argued that it will also take Facebook longer to build products.

None of that mollified critics.

"In exchange for modest changes to Facebook's internal structure, the settlement shields the company from responsibility for violations that may not even be known," Neema Singh Guliani, senior legislative counsel at the American Civil Liberties Union, said in a statement. "It fails to put strong and meaningful limits on how Facebook collects, uses, and processes user data."

Wanted: Better consumer protection

The FTC, of course, may have done the best it could with the tools it has. The agency enforces the law, but Congress makes the law. And Congress hasn't pursued privacy legislation that would protect Americas in the same way that the EU can protect Europeans with the year-old GDPR privacy regulation. 

This wasn't lost on many critics. Consumer Reports, an independent nonprofit, said the FTC wasn't getting the support it needed from legislators.

Consumer Reports welcomed the action from the FTC after a year-long investigation, but said it's clear that Congress needs to give the FTC greater authority and resources to rein in companies like Facebook.  

"With a weak and under-resourced FTC, and a glaring need for far more comprehensive privacy laws, Congress must raise the standards for consumers and hold Big Tech accountable," Marta Tellado, president and CEO of Consumer Reports, said in a statement. "Lawmakers have a responsibility to pass laws that offer real protections, giving consumers control of their data and the FTC the power it needs to rein in Big Tech."

On Tuesday, the Department of Justice said it was opening an antitrust review of online platforms and whether they're reducing competition. The department didn't name specific companies, but The Wall Street Journal reported that it's targeting tech giants including Apple, Alphabet, Amazon and Facebook.

Free Press, a nonpartisan group that fights for people's rights to connect and communicate, said the settlement fell "far too short," but used it to call for legislation that would prevent such abuses in the future.

"Without corrective action, the business of behavioral advertising is bound to harm our social, political and private lives again and again," Gaurav Laroia, a lawyer at the group, wrote. "It's now up to Congress to pass legislation to protect our privacy, our democracy and our civil rights."

Originally published July 24, 12:05 p.m. PT
Update, 12:47 p.m.: Adds Consumer Reports comments. Update, 9:15 p.m.: Adds ACLU comment.