Those of us who were on Facebook at the time the alleged misrepresentations occurred (mostly in 2009) remember fondly the viral status statements telling us, e.g., how we were now inviting Mark Zuckerberg into our homes to watch us shower, unless we immediately went and changed this or that setting. Facebook’s transition to its new system of privacy controls and settings did not go smoothly, apparently, and it was difficult for some users to understand how the new system worked. So maybe we should be glad that the F.T.C. cracked down on Facebook. After all, even Mark Zuckerberg, in a blog post made the same day as the settlement news broke, admitted that Facebook had made “a bunch of mistakes.”
Part II of the order requires Facebook to get a user’s express consent before allowing the user’s data to be shared with a third party, when such sharing “materially exceeds the restrictions imposed by [the] user’s privacy setting(s).” Part III requires Facebook to make a user’s information, stored on Facebook’s servers, inaccessible to any third party, no longer than thirty days after the user has deleted either the information, or his entire account. But it is Part IV of the Consent Order that constitutes the real power grab by the F.T.C. It requires Facebook to establish a “comprehensive privacy program,” which must be “documented in writing.” The program must “contain controls and procedures appropriate to [Facebook’s] size and complexity, the nature and scope of [Facebook’s] activities,” and so on, as judged by (per Part V of the Order) an “independent third-party professional.” Except that said third-party professional can’t be completely independent: He must be “approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580, in his or her sole discretion.” Said “independent third-party professional” is to prepare and submit reports on the substance of Facebook’s privacy policies, every two years for the next twenty years.
I can’t understand why Facebook would have agreed to this, and further, why Zuckerberg would be so effusive about it in the above-linked blog post. The only plausible reason I can think of, is that Facebook was concerned that the government would not allow it to go through with its anticipated IPO. Whether it was for this pragmatic reason, or because Zuckerberg is, as he said in his blog post, truly looking forward to cooperating with big government bureaucracy in the running of his business, he and his partners will get what they deserve.** If the F.T.C. wants to find a way in which Facebook has violated this Consent Order, so that it may take even more control of Facebook’s operations in the future, it will.
*Of course in an ideal world the F.T.C. would not exist and all this would be done via lawsuits initiated by disgruntled users. But given the current legal context, this is what I would expect.
**Further reading: Sanction of the Victim.