Sixteen months later, Facebook is actually in trouble over the Cambridge Analytica scandal. Last March, the public learned that the data of 87 million Facebook users had wrongfully landed in the hands of a political-analytics firm—Cambridge Analytica, which would go on to work for the Trump campaign in 2016—because of the company’s lax data policies at the time. The Wall Street Journal first reported on Friday afternoon that the Federal Trade Commission had approved a $5 billion settlement with Facebook in a vote that went along party lines. The three Republicans at the commission voted for the fine, while two Democrats reportedly wanted the agreement to include additional tougher oversight over Facebook. Now the decision has to be approved by the Justice Department, which is unlikely to reject the FTC’s plan.
Five billion dollars is a record fine against a technology company for the FTC, surpassing a $22 million fine against Google in 2012 for misleading privacy practices. Though $5 billion is a big number, it’s not that much considering Facebook’s annual revenue, which in 2018 was more than $55 billion—more than $152 million a day. The fine is also in line with other recent fines abroad. Google paid $5 billion in 2018 to European regulators for anti-competitive practices in the Android smartphone market. It was also fined $2.7 billion in 2017 for anti-competitive practices in its comparative shopping services, and earlier this year it was fined $1.7 billion for its “abusive practices” in online advertising. That’s more than $9 billion in the past three years. In that context, massive-sounding fines may be becoming the cost of doing business for large technology platforms.
The FTC’s privacy probe into Facebook was sparked by an agreement Facebook had made with the agency in 2011 that required the social network to obtain affirmative consent from users before accessing or sharing data about them beyond what they had explicitly agreed to. Under the consent decree, the FTC can fine Facebook up to $40,000 a day per individual violation, which for the amount of people affected the Cambridge Analytica scandal could have amounted to a bill as high as $2 trillion. Facebook did tighten its data-sharing practices after it learned that Cambridge Analytica wrongfully removed user data, like making it harder for app-makers to scrape user data and no longer making users’ friends’ data available for harvesting.
Democrats who want harsher regulatory actions against companies like Facebook and Google, which were instrumentalized by Russian operatives in the 2016 and 2018 elections, weren’t pleased with the news of the $5 billion fine. “Given Facebook’s repeated privacy violations, it’s clear the fundamental structural reforms are required,” Sen. Mark Warner, who has been pushing for increased congressional scrutiny of Facebook, said in a statement. “With the FTC either unable or unwilling to put in place reasonable guardrails to ensure that user privacy and data are protected, it’s time for Congress to act.”
We don’t yet know all the details of the settlement, which may come with other oversight requirements and regulations about how the company operates and handles user data. A symbolic $5 billion fine combined with robust regulations or oversight rules actually could affect how Facebook does business and treats its users’ information. Still, the FTC has concluded the company didn’t follow the rules it agreed to observe in 2011, making it a repeat offender. When it comes to moving fast and not breaking the law, Facebook doesn’t have a good track record.