The Federal Trade Commission has voted to fine Facebook $5 billion for failing to protect its users’ privacy, a person familiar with the matter said Friday — a record-high amount that Democratic lawmakers nonetheless denounced as “chump change” and a “Christmas present” for one of Silicon Valley’s wealthiest companies.
The FTC, which acted behind closed doors, has now referred the matter to the Justice Department for its sign-off, two people confirmed. Both spoke on condition of anonymity to discuss an ongoing enforcement matter.
Story Continued Below
Facebook’s stock price rose in afternoon and after-market trading on Friday, after The Wall Street Journal first reported the settlement.
The company, which is worth more than $580 billion, had already told shareholders that it expected a fine of the $3 billion to $5 billion. Critics of the terms said a penalty in that range would not be sufficient to force Facebook to change its ways without tough restrictions on how it obtains and uses people’s data, and they saw no indications that the FTC had imposed any.
“The FTC just gave Facebook a Christmas present five months early,” Democratic Rep. David Cicilline (R.I.), chairman of the House Judiciary antitrust subcommittee, in a tweet Friday evening.
“It’s very disappointing that such an enormously powerful company that engaged in such serious misconduct is getting a slap on the wrist,” Cicilline continued. “This fine is a fraction of Facebook’s annual revenue. It won’t make them think twice about their responsibility to protect user data. If the FTC won’t protect consumers, Congress surely must.”
The FTC and Facebook declined to comment.
The deal is the latest in a series of signs that, for all the talk of a tech backlash in Washington, the industry’s biggest players may suffer only limited regulatory blowback despite a series of huge data scandals in recent years and unhappiness with their handling of the 2016 U.S. presidential election. Congress, which also has discussed reining in tech’s practices, is running short on time to pass any kind of data privacy law before the August recess, and President Donald Trump has yet to endorse any specific actions against the companies despite railing against them at a social media summit Thursday.
Facebook has been under the shadow of the FTC probe for more than a year. The agency last spring began investigating a series of reports that the political data firm Cambridge Analytica, which did work for Trump’s 2016 campaign, improperly obtained information on some 50 million Facebook users via an academic researcher. That number was later revised upward to as many 87 million affected users.
Still, the $5 billion fine far surpasses anything the FTC has imposed on a tech company to date, dwarfing the agency’s $22.5 million settlement with Google in 2012. And it puts U.S. regulators, for the first time, in the same league as their European Union counterparts, who have been much more aggressive in scrutinizing the practices of the U.S. tech industry. EU regulators have levied billions of dollars in fines against Google, for example.
Yet the scale of the settlement is already inviting criticism that the FTC didn’t go hard enough on the social media giant, which has racked up a steady stream of data scandals and user privacy stumbles.
For one thing, the figure is still within range of Facebook’s expectations. The company said in an April 24 earnings release that it expected a penalty between $3 billion and $5 billion. Wall Street shrugged at that announcement, a sign that investors believe the giant social network, which has a market capitalization approaching $600 billion, can easily absorb such a cash hit despite its record-setting size.
And the lack of bipartisan support suggested that the terms of the settlement may not have gone as far as the FTC’s two Democrats wanted. Former FTC chief technologist Ashkan Soltani tweeted after the news broke that a party-line vote at the agency — as the Journal report indicated — was “definitely not ideal for an FTC settlement of this magnitude.” He speculated that the agency’s GOP majority was unable to win over Democrats because it may have minimized the range of Facebook conduct addressed in the settlement and opted against holding CEO Mark Zuckerberg personally liable for the company’s missteps.
Democratic Sens. Richard Blumenthal (Conn.), Mark Warner (Va.) and Ron Wyden (Ore.) all put out similar statements slamming the FTC for apparently failing to insist on sweeping structural changes at the company or even impose a larger penalty. Blumenthal called the $5 billion figure “chump change for a company that makes tens of billions of dollars every year,” while Wyden called it a “mosquito bite to a corporation the size of Facebook.” All three called for some form of congressional action such as FTC oversight hearings and tough privacy legislation.
The news strikes a marked contrast with the Trump administration’s ostensibly hostile view of Facebook and other tech giants. It comes just one day after Trump gathered right-wing internet stars at the White House to pillory social media platforms over unsubstantiated claims of anti-conservative bias. The president said he was directing his administration “to explore all regulatory and legislative solutions” to rein in tech companies in the name of free speech.
The Cambridge Analytica controversy, although originating with a firm aiding the Trump campaign, drew more bipartisan blowback. It became a symbol for Facebook’s troubled track record on user privacy, as details emerged that the social network had known about the issue since 2015 and had failed to verify that the firm deleted the data once the violation was discovered.
After an initial period of silence after the story broke, Zuckerberg took a more active role in responding to the scandal as criticism mounted about his leadership. He called the data leak a “huge mistake” and submitted to a marathon, 10-hour grilling on Capitol Hill. The company’s chief operating officer, Sheryl Sandberg, also did an apology tour in a string of media appearances.
But Facebook struggled to shed the scandal, and as the FTC investigation dragged on, the company racked up an array of other headline-grabbing privacy missteps, from questionable data-sharing arrangements with other tech firms to insecure storage of hundreds of millions of passwords to its decision to pay teens to install software to spy on their phones and web activity.
The FTC’s hook was a consent decree it had signed with Facebook in 2011, requiring the company to give consumers clear notice and obtain their expressly stated consent before sharing their information with outside parties. That settlement, which followed a series of Facebook missteps like making users‘ friend lists public without notification, imposed restrictions over the social network’s privacy practices for 20 years.
Cambridge Analytica, which denied wrongdoing in the Facebook scandal, closed down last May. The firm touted its use of “psychographics,” in which huge troves of data are collected to microtarget potential voters based on personality traits. The operation had strong ties to team Trump. GOP megadonor Robert Mercer, a major backer of Trump’s campaign, provided funding for Cambridge Analytica, and Steve Bannon, who went on to be Trump’s campaign CEO and chief White House strategist, served on its board.
According to news reports citing Christopher Wylie, a onetime Cambridge Analytica employee-turned-whistleblower, the firm improperly obtained Facebook data via Aleksandr Kogan, a Russian-American academic at Cambridge University who paid people to take a personality quiz. Only 270,000 people downloaded the quiz app, but it siphoned up information about their Facebook friends as well, creating a pool of data on as many as 87 million users.
Wylie said the Facebook data was used to influence the outcome of the U.S. presidential election and U.K.’s Brexit referendum. Kogan complained he’s been made a “scapegoat” in the affair and said he was assured by Cambridge Analytica that “everything was perfectly legal and within the terms of service.” He claimed to have no knowledge of the data being used for the Trump campaign.