Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Facebook and the FTC <a href="http://case-studies.digitalads.org/wp-content/uploads/2011/10/complaint.pdf">announced</a> an agreement on November 29, 2011, ending the FTC&rsquo;s 18-month investigation into Facebook&rsquo;s user privacy practices.&nbsp; By adding Facebook to the list of major social media entities subject to an FTC consent order&mdash;a list that includes <a href="http://ftc.gov/opa/2011/03/google.shtm">Google</a> and <a href="http://www.ftc.gov/opa/2010/06/twitter.shtm">Twitter</a>&mdash;the FTC has loudly signaled its leading role in regulating the online privacy practices of businesses.&nbsp; Indeed, shortly after announcing the settlement, the FTC posted a <a href="http://business.ftc.gov/blog/2011/12/lessons-facebook-settlement-even-if-youre-not-facebook">list</a> of seven key lessons for businesses based on its recent consumer privacy enforcement actions.
The FTC&rsquo;s eight-count <a href="http://case-studies.digitalads.org/wp-content/uploads/2011/10/complaint.pdf">complaint</a> included allegations regarding Facebook&rsquo;s statements about user privacy controls, including whether Facebook shared user information with third party applications, despite representations that users could control their privacy settings.&nbsp; For example, a user&rsquo;s personal privacy settings in some instances were ineffective against &ldquo;Friends&rsquo;&rdquo; applications.&nbsp; Additionally, the FTC alleged that Facebook engaged in retroactive privacy changes that overrode users&rsquo; previous levels of privacy in December 2009 by making certain information, such as name, profile picture, city, gender and friend list, public.&nbsp; Though Facebook admitted to no wrongdoing in the settlement agreement, as Mark Zuckerberg explained in a <a href="https://blog.facebook.com/blog.php?post=10150378701937131">blog post</a>, the agreement establishes certain requirements for Facebook&rsquo;s management of users&rsquo; information and privacy settings&mdash;many of which Facebook has implemented.
In the <a href="http://www.ftc.gov/os/caselist/0923184/111129facebookagree.pdf">consent order</a>, Facebook agrees that it will not misrepresent the extent to which it maintains privacy or security of &ldquo;covered information&rdquo; (user provided information, including name, address, e-mail address, phone number, IP address, photos and videos, or physical location).&nbsp; Specifically, Facebook agreed not to misrepresent the following aspects of its privacy controls:&nbsp;
<ul>
<li>the extent to which it maintains the privacy or security of such information in the collection or disclosure of covered information;</li>
<li>the extent to which a consumer can control the privacy of any covered information maintained by Facebook and the steps a consumer must take to implement such controls;</li>
<li>the extent to which Facebook makes or has made covered information accessible to third parties;</li>
<li>the steps Facebook takes or has taken to verify the privacy or security protections that any third party provides;</li>
<li>the extent to which Facebook makes or has made covered information accessible to any third party following deletion or termination of a user&rsquo;s account with Facebook or during such time as a user&rsquo;s account is deactivated or suspended; and </li>
<li>the extent to which Facebook is a member of, adheres to, complies with, is certified by, endorsed by or otherwise participates in any privacy, security or any other compliance program sponsored by the government or any third party, including but not limited to, the U.S.-EU Safe Harbor Framework. </li>
</ul>
Other highlights of the agreement include that Facebook must clearly convey what user information is &ldquo;nonpublic&rdquo; and the extent to which it is shared to third parties by disclosing the identity of third parties, the extent that sharing such information may exceed the boundaries of a user&rsquo;s established privacy controls, and by obtaining a user&rsquo;s informed consent. The agreement also limits use of a Facebook user&rsquo;s covered information to a 30 day window after a user has terminated or deleted his or her account.&nbsp; Facebook must also designate a comprehensive privacy program, obtain privacy audits every two years for the next 20 years, and keep certain records of its communications or policy changes regarding privacy.
<a href="http://www.bakerlaw.com/jenniferdjohnson/">Jennifer Johnson</a> contributed to this post.&nbsp;

Facebook and FTC Settlement Agreement – Online Privacy Practice Implications