Facebook fine for data fiasco said to be $5B

Sources report FTC’s vote to back privacy settlement

In this May 1, 2018, file photo, Facebook CEO Mark Zuckerberg makes the keynote speech at F8, Facebook's developer conference, in San Jose, Calif.
In this May 1, 2018, file photo, Facebook CEO Mark Zuckerberg makes the keynote speech at F8, Facebook's developer conference, in San Jose, Calif.

The Federal Trade Commission voted this week to fine Facebook about $5 billion for mishandling users' personal information, according to two people briefed on the vote, in what would be a landmark settlement that signals a newly aggressive stance by regulators toward the country's most powerful technology companies.

The agency approved the settlement in a 3-2 vote along party lines, with the two Democrats voting against it, said the people, who would speak only on the condition of anonymity.

The settlement was born out of the Cambridge Analytica privacy scandal that came to light last year.

If the reported amount is correct, it would be the biggest fine ever imposed by the United States on a tech company, easily eclipsing the $22 million imposed on Google in 2012.

Facebook had nearly $56 billion in revenue last year. Facebook has earmarked $3 billion for a potential fine and said in April that it was anticipating having to pay up to $5 billion.

The deal still needs final approval from the Justice Department, which rarely rejects settlements reached by the agency.

The Wall Street Journal earlier reported on the vote by the commission.

In addition to the fine, Facebook agreed to more comprehensive oversight of how it handles user data, according to the sources. But none of the conditions in the settlement will restrict Facebook's ability to collect and share data with third parties. That decision appeared to split the five-member commission: The two Democrats who voted against the deal sought stricter limits on the company, the people said.

Peter Kaplan, a spokesman for the FTC, declined to comment.

Andy Stone, a spokesman for Facebook, also declined to comment.

Facebook critics, such as advocacy groups that have decried the company's privacy and other policies, were quick to slam the reported deal.

"A fine -- no matter how large -- is not enough," said David Segal, executive director of Demand Progress Education Fund, in a statement Friday. "It is clear that Facebook has too much power and is too big to manage. A Federal Trade Commission that was serious about its job would push for structural reforms -- like spinning off Instagram and WhatsApp -- that would create competition in the social media space and make Facebook more likely to respect its users."

PRIVACY ENFORCEMENT

The settlement with Facebook would be one of the most aggressive regulatory actions by President Donald Trump's administration, and a sign of its willingness to punish one of the country's biggest and most powerful companies. Trump has dialed back regulations in many industries, but the Facebook settlement sets a new bar for privacy enforcement by U.S. officials, who have brought few cases against large Silicon Valley companies.

Until now, the biggest fines and restrictions against the companies have come from Europe. Officials there have made several accusations of violations of antitrust and privacy laws against Amazon, Apple, Facebook and Google. Last year, the European Union fined Google $5.1 billion for abusing its large market share in the mobile phone industry.

But in recent weeks, U.S. regulators and lawmakers of both parties have taken a more combative stance toward the tech giants. Congress started an antitrust investigation into how the biggest tech companies have harmed consumers and impeded competition. The Justice Department and the FTC divvied up responsibility for potential antitrust investigations into several of the companies.

Shares of Facebook surged to $205.27 -- the stock's highest price in the past year -- in after-hours trading Friday after news of the vote became public.

After the news last year that political data consulting firm Cambridge Analytica accessed the personal information of up to 87 million Facebook users without their explicit consent, the FTC opened an investigation into whether the Silicon Valley tech giant had violated a 2011 settlement regarding its privacy practices.

The Justice Department and the Securities and Exchange Commission have also opened investigations related to the Cambridge Analytica scandal. Facebook declined to comment on the status of those inquiries. Separately, the attorney general for Washington, D.C., has sued the company, claiming it failed to safeguard users' data. Other state attorneys general are also investigating.

The FTC is poised to continue scrutiny of Facebook. As part of a broad agreement with the Justice Department dividing oversight of four of the biggest tech companies, the agency will take responsibility for a potential antitrust investigation into Facebook. One area of focus is likely to be the company's acquisitions of Instagram and WhatsApp.

The reported fine is just the latest fallout from the Cambridge Analytica mess, which among other things led Congress to summon Facebook Chief Executive Officer Mark Zuckerberg to Washington last year.

LEAKY CONTROLS

Since the Cambridge Analytica debacle flared up more than a year ago, Facebook has vowed to do a better job corralling its users' data.

The scandal revealed that the data-mining firm affiliated with Trump's 2016 campaign may have improperly accessed private information f through a quiz app offered to Facebook users by a Cambridge University researcher. About 270,000 people downloaded the app, allowing the researcher to access data about both those individuals and their friends. The information was subsequently sold to Cambridge Analytica.

Other leaky controls have also since come to light. Facebook acknowledged giving big tech companies like Amazon and Yahoo extensive access to users' personal data, in effect exempting them from its usual privacy rules. And it collected call and text logs from phones running Google's Android system in 2015.

The FTC can impose fines only on companies that have previously agreed to settle claims with the agency under consent decrees, but not on first-time offenders. The agency has lobbied for greater authority to penalize wrongdoers in privacy cases.

The commission's 2011 consent decree with Facebook addressed a litany of deceptive practices by the social-media company. Facebook, for example, allowed profile information -- photos, education, place of employment -- that a user chose to restrict to "Only Friends" or "Friends of Friends" to be accessible to apps that the person's friends used. Facebook also promised users that it wouldn't share personal information about them with advertisers when in fact the company identified to advertisers the users who clicked on their ads or to whom ads were targeted.

"This closes a dark chapter and puts it in the rearview mirror with Cambridge Analytica," said Wedbush analyst Daniel Ives. "Investors still had lingering worries that the fine might not be approved. Now, the Street can breathe a little easier."

Rep. David Cicilline, a Democrat from Rhode Island, said in a statement that the fine gives Facebook "a Christmas present five months early. It's very disappointing that such an enormously powerful company that engaged in such serious misconduct is getting a slap on the wrist. This fine is a fraction of Facebook's annual revenue."

Cicilline leads the House Judiciary subcommittee on antitrust, which is pursuing a bipartisan investigation of the big tech companies' market dominance.

Information for this article was contributed by Cecilia Kang of The New York Times; by Levi Sumagaysay of the San Jose Mercury News; by Barbara Ortutay of The Associated Press; and by David McLaughlin and Daniel Stoller of Bloomberg News.

A Section on 07/13/2019

Upcoming Events