FTC's record $5 billion Facebook fine less than a tenth of company's revenue

• The Federal Trade Commission (FTC) slapped Facebook with a $5 billion fine over its role in allowing Cambridge Analytica to collect millions of users' data without their consent.

• Facebook will be required to form an independent privacy oversight commission that can only be fired by a supermajority of the company's board of directors, as well as evaluate new products from a privacy standpoint.
• The settlement indemnifies Facebook for possible wrongdoing before June 12 of this year, and does not require it to admit wrongdoing.
  

• While $5 billion is the highest privacy-related fine the FTC has ever imposed, it's less than a tenth of Facebook's yearly revenue.
  

Federal regulators have slapped Facebook with a $5 billion fine over the company's breaches of user privacy in 2014 and 2015. While that's the largest fine the Federal Trade Commission has ever imposed on any company, it won't make much of a dent on a growing tech giant that had nearly $56 billion in revenue last year.

"Facebook betrayed the trust of its users and deceived them about their ability to control their personal information," FTC chairman Joe Simons said at a press conference Wednesday. "The enormity of this penalty resets the baseline for privacy cases and serves as an important deterrent for future violations."

The commission opened an investigation into Facebook last year after revelations that data-mining firm Cambridge Analytica had gathered details on as many as 87 million Facebook users without their permission. The investigation found that Facebook misled users when it told them in 2014 that it would no longer collect private information without their active consent, because the company continued to allow third-party developers like those connected to Cambridge Analytica to get personal information from friends of users who had downloaded those apps.

Separately, Facebook paid a $100 million fine to the Securities and Exchange Commission to settle allegations that the company should have disclosed its data mishandling to investors.

A new "privacy committee"

Along with paying $5 billion, Facebook will be required to form an "independent privacy committee" of directors who can only be fired by a supermajority of the board. CEO Mark Zuckerberg will also have to personally attest each quarter that Facebook abides by its privacy programs. If he falsely attests to that, he could be liable for criminal or civil penalties, the FTC said.

The company will also be required to review every new or relaunched product or service from a privacy perspective and document the decisions it makes about privacy. The order covers Instagram and WhatsApp as well as Facebook.

That review requirement is likely to slow down product releases, although it doesn't change the fundamentals of Facebook's business model of collecting reams of user data and using it for targeted advertising.

"Facebook has built a very, very deep moat in terms of being able to serve targeted ads to users based on prior engagement, and that doesn't change," said Steve Weiss, CEO of MuteSix, an advertising agency that works primarily with Facebook. "But their ability to rapidly iterate and launch new products will change."

Corporate indemnity

The terms of the settlement seem more than favorable to Facebook, critics pointed out. It does not require Facebook to admit any wrongdoing and does not hold Zuckerberg personally responsible. It also clears the company of "any and all consumer protection claims" from the FTC prior to June 12 of this year, essentially giving it a pass for a spate of potential violations
reported after the Cambridge Analytica disclosure. 

As Ashkan Soltani, a former senior adviser in the Barack Obama White House, pointed out, that includes activities like failing to protect user passwords, misleading advertisers about ad views and letting developers access private messages.

He added, "If this were a game of chess, Facebook just checkmated FTC, flipped the board so it couldn't be played again, and covered the whole thing up with a blanket."

The company, which has spent the last year re-branding itself as focused on privacy, lauded the FTC settlement. Zuckerberg called it "historic" and said it would "set a completely new standard for our industry" in a post Wednesday.

For investors, the news means that Facebook can put a major privacy disaster behind it and focus on making more money. Facebook stock has risen 10% since the company first disclosed the expected amount of the fine in late April.

No laws for privacy

Privacy advocates had pushed for the FTC to limit how Facebook can track users. But FTC commissioners said the agency didn't have the authority to do that.

"Look, we don't have a national privacy law. If we had a national privacy law and Facebook violated that law, in all likelihood, this would have been different," Simons said during the press conference.

"Our authority comes from a 100-year-old statute that was never intended to deal with privacy issues like the ones we address today," he said. "Would it have been nice to get more, to get $10 billion instead of $5 billion, to get greater restrictions on how Facebook collects and uses data? ... To the extent that people object to our settlement because it did not have terms like these, we did not have those options," he said

Simons and fellow Republican FTC Commissioner Christine Wilson called on Congress to pass privacy legislation.

The FTC's three Republican commissioners voted for the $5 billion fine while its two Democrats opposed it. In his dissenting statement, Commissioner Rohit Chopra wrote that the settlement "does little to change the business model or practices that led to the recidivism" and imposes "no meaningful changes" to the company's structure or business. "Nor does it include any restrictions on the company's mass surveillance or advertising tactics," he wrote.

The start of a pattern?

Privacy advocates hope that the fine, rather than marking the end of a chapter, instead indicates the start of a multi-agency crackdown on Facebook and other big tech companies.

Disdain of large tech companies is one of the few bipartisan issues in a hyper-polarized Congress, which has taken Facebook, Google, Amazon and Apple to task for their market power. Separately, the Department of Justice is taking a broad look at whether market-leading online companies have too much market power and should be broken up.

The size of the FTC fine could serve as encouragement to other regulators, including in other countries Facebook operates, said James Rosener, head of the international practice group at Pepper Hamilton.

"The question is whether that gives other regulators in Europe more ambitious targets," Rosener said. "Say, the U.S. got $5 billion, maybe we should get $6 billion. We'll look like chumps if we ask for just one billion."

In:
• Federal Trade Commission