Kreller Hot Topic Report | Facebook, Privacy Awareness and Investigations

by Lauren Caryer, PhD

Privacy in the Spotlight
July 24, 2019 may prove to be a watershed day for privacy advocates, following statements from the Federal Trade Commission announcing a staggering $5 billion dollar civil penalty against Facebook over breaches of a 2012 FTC order regarding the company’s user privacy settings and a suit against data analytics company, Cambridge Analytica, for allegedly employing “deceptive tactics to harvest personal information from tens of millions of Facebook users for voter profiling and targeting.” Also on July 24, separate from its settlement with the FTC, Facebook agreed to a $100 million settlement with the US Securities and Exchange Commission, “for making misleading disclosures regarding the risk of misuse of Facebook user data.” The SEC alleged that following its discovery of data misuse by the third-party developer, Cambridge Analytica, in 2015, Facebook continued to present such risks as hypothetical until March of 2018. On the same day that the SEC and FTC announced these settlements Netflix released the documentary The Great Hack, tying the alleged details of the Cambridge Analytica scandal to broader issues surrounding data mining and its sociopolitical implications. What’s more, Facebook’s regulatory woes seem far from over; the company is embroiled in similar investigations from the Privacy Commissioner of Canada and the Irish Data Protection Commission, which is currently fielding eleven investigations into the social media company’s potential violations of European data privacy regulations (GDPR). According to an August 1, 2019 report from The Wall Street Journal, the FTC and Department of Justice have also launched separate antitrust investigations into Facebook, examining whether the company’s acquisition practices “were part of a campaign to snap up potential rivals to head off competitive threats.”

The FTC’s $5 billion dollar complaint and settlement order against Facebook, Inc. follow from a 2012 FTC order regarding Facebook’s application programming interface “Graph API,” which allowed third party developers to access a wide swathe of data regarding app users and, notably, their friends, including dates of birth, employment history, education history, relationships, religious and political views, hometown, current town, interests, activities, and photos. The 2012 complaint alleged that Facebook misled its users by placing the opt-out settings relating to third-party developers outside of the main Privacy Settings page, leading Facebook’s users to believe that the selections chosen on the Privacy Settings page would also apply to access by third-party developers. In August of 2012, the FTC ordered that Facebook cease misrepresenting the means by which consumers could control privacy settings with relation to third-party developers; however, as alleged in the 2019 complaint, Facebook continued to bury information regarding third-party developers’ access to consumer data and the data of their friends.