With two former members of the Federal Trade Commission on payroll, perhaps it's not surprising that Facebook just got let off the hook for mass violations of federal privacy rules. It's pretty depressing, though.
The FTC just announced it reached a settlement with the shameless social network for breaking a slew of privacy promises to users, including by forcing private friends lists into public, grossly oversharing data with third party apps, and failing to actually delete deleted content. As punishment - if you can call it that - Facebook agreed to conduct 10 privacy audits over 20 years, to actually delete information when the user deletes it, to stop "making misrepresentations about the privacy or security of consumers' personal information," and to require users to opt-in to any new privacy changes.
This settlement makes a mockery of the idea of holding corporations accountable for their actions. It's being grossly oversold in the media. "Privacy Changes Must Be Opt In," said TechCrunch's headline, for example. Facebook "must obtain consumers' approval before it changes the way it shares their data," said the Wall Street Journal.
Too late! Facebook profiles are already splayed open for the world to see, just as Facebook intended when it misappropriated user data two years ago. Your date of birth and contact information are still private, largely to shield the company from culpability in identity theft, but that's about it; Facebook wanted users to share everything widely, and that's what we do, unless we fiddle with the settings. So yes, you must "opt in" to any new privacy changes, but by default you're already sharing virtually everything about yourself, so there's probably no need.
The FTC could have done much more. Privacy groups are already noting the settlement's shortcomings. EPIC, the group whose complaints formally brought Facebook's violations to the FTC's attention, today wrote that "the settlement does not adopt EPIC's recommendation that Facebook restore users' privacy settings to pre-2009 levels." In other words, the commission could have forced Facebook to undo its misdeeds - misdeeds alleged by the commission itself - but chose not to.
And there's little doubt Facebook knew what it was doing was nefarious when it rolled back user privacy in 2009. All the way back in 2007, the FTC issued guidelines instructing companies to obtain "affirmative express consent for material changes to existing privacy promises, and affirmative express consent to (or prohibition against) using sensitive data for behavioral advertising." Now, years later, the FTC has finally made Facebook agree to "obtain consumers' affirmative express consent before enacting changes that override their privacy preferences." What a victory.
In the nearly three years since it flouted FTC guidelines, Facebook saw its valuation grow from $15 billion to close to $100 billion. On the negative side of the ledger, Facebook must now undergo 20 years of FTC oversight, consisting mainly of third party privacy audits, and face fines of up to $16,000 for each violation of its FTC deal. It's hard to imagine a company planning to raise $10 billion within the next seven months is particularly worried about some audits and possible future fines.
Facebook's collection of ex FTC staffers must also provide the company some comfort when dealing with the government. The social network hired as a lobbyist former FTC chair Timothy Muris. Also in its pocket: Former FTC commissioner Mozelle Thompson, who works as the company's "chief privacy adviser."
The prospect of such gainful private employment for commissioners couldn't have hurt this toothless settlement's chances as it hurtled toward a unanimous, 4-0 commission approval. And having some ex regulators in hand surely emboldened Facebook CEO Mark Zuckerberg to herald the settlement in a blog post, and to pepper said blog post with such preposterous statements as, " I think we have a good history of providing transparency and control over who can see your information."
Approximately no one would agree that is Facebook's history. But at least the company has promised to finally begin complying with privacy laws, now that it can more than afford to do so.