MARK ZUCKERBERG’S NAME doesn’t appear anywhere in the 50-page complaint brought against Facebook by the US government Wednesday as it settled charges the company deceived millions of Americans over how it used and shared their personal information. But make no mistake: The Federal Trade Commission is not happy with how Zuckerberg has been running his company.
As part of the settlement order, Facebook has agreed not just to pay a record $5 billion civil penalty, as previously reported, but also to make substantial changes to the company’s structure and how it handles privacy issues. The order doesn’t hold any executives personally liable, as some commissioners had sought, but Zuckerberg will need to personally certify each year that Facebook remains compliant with its terms.
Among other things, the settlement requires Facebook to change how it nominates people to its board of directors, and create a board committee dedicated to privacy issues that will be briefed quarterly by management. An outside, government-approved assessor—also new—will monitor Facebook’s compliance with the order and issue biannual reports to the board and the US government, though not necessarily the public. The FTC and the Justice Department will both be involved in oversight. Facebook will also need to review and report on the privacy impact of new features or updates, and alert the FTC as well as the assessor in the event the data of more than 500 users is compromised. Facebook also appointed a new chief privacy officer, who reports directly to Zuckerberg.
For the uninitiated, it sounded like regulators had stepped up, grabbed Facebook by the lapels and given it a good shake. The fine was large. The FTC’s complaint was stern. Zuckerberg sounded contrite.
In reality, the settlement is almost meaningless. Facebook makes more than $5 billion in many quarters. Wednesday, it reported second-quarter profit of $2.6 billion, after accounting for some of the costs of the settlement. It’s sitting on nearly $50 billion in cash. And with only a few exceptions, it has delivered better-than-expected results since it became a public company in 2012. Facebook’s stock actually rose after the settlement was announced, and rose further in after-hours trading.
Even Joe Simons, the FTC chair, acknowledged that Facebook’s money and power gave the agency little flexibility in meting out a more severe punishment. “We were faced with two choices: (1) settle on excellent terms or (2) litigate for years and likely come away … with far less relief than we announce today,” he said at a news conference. “Would it have been nice to get even more? To get $10 billion instead of $5 billion for example? To get greater restrictions on how Facebook collects, uses, and shares data? To put Mark Zuckerberg’s name in the complaint caption? To the extent people object to our settlement because it does not have terms like these, we did not have those options. We cannot impose such things with our own fiat.” Two of the five commissioners voted against the settlement, saying it wasn’t large enough and its terms not punitive enough.
Former FTC chief technologist Ashkan Soltani says the agency was negotiating from a position of weakness, because it lacks broad enforcement authority. “People want the FTC to enforce laws that don’t exist, and they want the FTC to enforce issues that the FTC doesn’t have authority over, unfortunately,” he told WIRED. Congress could empower the agency with more rule-making authority and resources, or pass federal privacy legislation that would regulate companies like Facebook—but so far efforts to change the status quo have stalled on Capitol Hill.
Even within the limited authority of the FTC, however, Soltani worries that the agreement is too narrow to sufficiently protect consumers as Facebook’s business model evolves. The agreement mostly addresses Facebook’s past sins, he says. For example, the order prohibits Facebook from taking phone numbers users had shared for security purposes and use them for advertising purposes, something the company has previously done. But, Soltani says, “it doesn’t essentially look at some of the future planned activity that Facebook has signaled, like around the use of information for commerce, around the interaction between their business and consumers via WhatsApp.”
As for the settlement’s other stern-sounding terms, Facebook began putting many of those into practice six months ago when Zuckerberg said he had concluded that social activity in the privacy of our living rooms was just as important as the online public square he’d created. He said that Facebook planned to unify all of its messaging platforms and encrypt communication on them.
Was that shift in part to respond to changes in user and advertiser expectations about data privacy since the 2016 US presidential election? Of course. But it was just as much driven by Zuckerberg’s hunger to make Facebook the most dominant company on the planet. Encrypting and unifying Facebook’s messaging platforms enables it to jump into the multi-trillion-dollar online payments business. That’s important because in about five years, at current growth rates, Facebook will find it harder to generate huge revenue growth from advertising. Most of it will have moved online by then and Facebook will have to take share away from other companies to generate growth.
Alex Stamos, Facebook’s former chief security officer, said on Twitter that the FTC deal is actually one of the best things to happen to Facebook. “The real threat to the tech giants is competition, not regulation,” he said. “Facebook paid the FTC $5B for a letter that says ‘You never again have to create mechanisms that could facilitate competition.’" Now, Stamos said, whenever critics ask Facebook to make it easier to move to other social networks, Facebook can say, “Sorry, the mean FTC won’t let us.”
The country may still be waiting for Congress to act on data privacy, but lawmakers eagerly jumped at another opportunity to criticize Facebook and its CEO, who have become particularly popular targets on the Hill over the past year.
“This fig leaf deal releases Facebook without requiring any real privacy protections—no restraints on future data use, no accountability for top executives, nothing more than chump change financial fines,” Senator Richard Blumenthal (D-Connecticut) said in a statement. “The American public is owed more than another Zuckerberg apology and an anemic FTC settlement.”
News of the settlement all but drowned out what may prove to be the most consequential news about the future of Facebook and the rest of Silicon Valley this week: The Justice Department said it has begun a broad antitrust investigation into the dominance of all the big technology companies. The FTC may not have the power to take Facebook to court, but the antitrust division of the Justice Department certainly does.
For those with long memories it all feels like a familiar pattern. The government in the 1990s spent nearly a decade trying—unsuccessfully—to bring an increasingly dominant Microsoft to heal. What it concluded was that Congress doesn’t understand enough about technology to solve these problems with legislation. It concluded that the only way to reign in a company as rich and powerful as Facebook is to take it to court.
Zuckerberg didn’t appear to apologize for anything on Wednesday, however. “We have a responsibility to protect people's privacy. We already work hard to live up to this responsibility, but now we're going to set a completely new standard for our industry,” the CEO wrote in a Facebook post. He estimated that implementing some of the new processes “will take hundreds of engineers and more than a thousand people across our company.”
Separately, the Securities and Exchange Commission announced charges of its own against Facebook Wednesday, for failing to adequately disclose to investors that its users’ data had been misused. The Wall Street Journal first reported the SEC was investigating the company last July. To settle these charges, Facebook agreed to pay a fine of $100 million; as with the FTC agreement, the company does not have to admit any fault.
