Facebook has agreed to settle charges that it violated users’ privacy and shared their personal information with advertisers.
The Federal Trade Commission’s eight-count complaint, released Tuesday, argues the social networking site failed to live up to its promises on privacy. The complaint cites practices such as allowing applications to access nearly all user data and allowing access to content even after users deactivated or deleted their accounts.
“Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions of users,” said FTC Chairman Jon Leibowitz. “Facebook’s innovation does not have to come at the expense of consumer privacy. The FTC action will ensure it will not.”
In a blog post published Tuesday afternoon, Facebook founder Mark Zuckerberg framed the settlement as a preventive move on the part of the company. He compared the settlement to a similar agreement between the FTC and Google struck earlier this year after the search giant’s failed rollout of the Buzz social network.
“Today, the FTC announced a similar agreement with Facebook. These agreements create a framework for how companies should approach privacy in the United States and around the world,” Zuckerberg wrote.
“For Facebook, this means we’re making a clear and formal long-term commitment to do the things we’ve always tried to do and planned to keep doing — giving you tools to control who can see your information and then making sure only those people you intend can see it.”
Leibowitz said the complaint alleges Facebook violated the Federal Trade Commission Act by engaging in unfair or deceptive practices. But he called Zuckerberg's post, which acknowledged some missteps and reiterated Facebook's commitment to privacy, a positive sign going forward and said it was important to note the violations have stopped.
The second set of charges relates to Facebook applications; the FTC claims Facebook mislead consumers by telling them apps would only have access to the information they needed to operate. In actuality, Leibowitz said, apps could access almost all users' information as well as information provided by friends.
The FTC alleges Facebook allowed access to photos and videos from deleted and deactivated accounts in some cases despite promising not to. It also claims Facebook designed its platform in a way that would allow advertisers to obtain data from users who clicked on a Facebook ad.
"This settlement will help ensure that companies keep their promises to consumers and give those consumers a real voice in how their information is used, distributed, and managed," said Sen. John Kerry (D-Mass.). "It reinforces the principle that data collectors should not hold consumer information hostage, especially after a user has terminated the service."
Facebook has been the target of increasing scrutiny on the Hill as the site has become a crucial part of the digital economy, thanks to its real-name ecosystem relied upon by millions of users and thousands of sites. Lawmakers have repeatedly questioned how the site handles users' privacy and personal information during its frequent updates.
The settlement attempts to address some of those concerns by requiring Facebook to obtain user consent before making changes to its privacy settings that would retroactively publish data already posted. The firm must also clearly disclose what information is shared with third parties like apps and advertisers.
“When it comes to its users’ privacy, Facebook’s policy should be: ‘Ask for permission, don’t assume it,'" said Rep. Edward Markey (D-Mass.), who has voiced privacy concerns about Facebook. “Today’s settlement should not be the end of the company’s efforts to ensure user control over their own personal information on Facebook. I remain alarmed by a continuing pattern of privacy and security problems at Facebook."
“The importance of personal privacy is woven into the fabric of our country, and use of personal data by any company must be transparent and secure," said Rep. Anna Eshoo (D-Calif.).
"I’ve always believed that companies, whether large or small, should provide tools that give consumers confidence that their information will not be shared more broadly than they intended. Today’s agreement upholds this belief.”
—This post was updated at 2:42 p.m.