Federal Trade Commission reaches settlement with Facebook over privacy

WASHINGTON—The Federal Trade Commission has reached a settlement with Facebook Inc. in its privacy complaint against the social media company.

The settlement calls on Palo Alto, Calif.-based Facebook to implement a “comprehensive privacy program” that is reasonably designed to address privacy risks and protect the privacy and confidentiality of covered information. An independent third party will issue reports on its compliance with this provision for the next 20 years.

In addition, according to the settlement announced Tuesday, Facebook agreed that it will “not misrepresent in any manner, expressly or by implication, the extent to which it maintains the privacy or security of covered information.”

Other provisions

The settlement also requires disclosure in the event Facebook shares nonpublic user information in connection with any product or service that “materially exceeds the restrictions imposed” by a user’s privacy settings.

Among other provisions, Facebook agreed to “implement procedures reasonably designed to ensure that covered information cannot be accessed by any third party from servers” under Facebook’s control “after a reasonable period of time,” not to exceed 30 days from the time the information has been deleted.

The FTC commission approved the agreement unanimously. It will decide whether to give final approval after a 30-day public comment period. If the commission issues a final consent order, each violation could result in a civil penalty up to $16,000, the FTC said.

Complaint’s charges

The complaint alleged that Facebook changed its website in December 2009 so certain information that users may have designed as private, such as their friends list, was made public. “They didn’t warn users that this change was coming or get their approval in advance,” the FTC said in a statement.

“In many instances, Facebook has made profile information that a user chose to restrict to ‘only friends’ or ‘friends of friends’ accessible to any platform applications that the user’s friends have used,” the FTC said in its complaint.

It also alleged that, despite promises to the contrary, Facebook also shared personal information with advertisers.

Facebook CEO Mark Zuckerberg said in a blog posted Tuesday, “I’m the first to admit that we’ve made a bunch of mistakes. In particular I think that a small number of high-profile mistakes…and poor execution as we transitioned our privacy model two years ago, have often overshadowed much of the good work we’ve done.”