Facebook to Pay $5 Billion for Cambridge Analytica Scandal

Update, 7/24/19, 9:35 a.m. PT: The FTC today announced that it's reached a settlement with Facebook through which the company will pay a $5 billion fine, which the commission said is "one of the largest penalties ever assessed by the U.S. government for any violation," and change its corporate structure in an effort to better protect user privacy. Facebook will also be subject to new restrictions on its use of user data; the FTC said the settlement "overhauls the way the company makes privacy decisions by boosting the transparency of decision making and holding Facebook accountable via overlapping channels of compliance."

“Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices,” FTC Chairman Joe Simons said in the commission's announcement. “The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC. The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations. The Commission takes consumer privacy seriously, and will enforce FTC orders to the fullest extent of the law.”

More information about the settlement is available via the FTC's website (PDF). The commission said that it filed a separate complaint regarding Cambridge Analytica--whose use of Facebook data led to increased scrutiny of the social network's practices and, ultimately, this settlement--The FTC said its complaint alleges that the firm "employed deceptive tactics to harvest personal information from tens of millions of Facebook users for voter profiling and targeting." The FTC has proposed settlements with Cambridge Analytica's former CEO and app developer. The filing is on the commission's website (PDF).

Original article, 7/13/19, 7:44 a.m. PT:

The Wall Street Journal reported Friday that the Federal Trade Commission (FTC) approved a $5 billion settlement with Facebook over the Cambridge Analytica scandal that erupted in 2018. FTC commissioners voted 3-2 in favor of the settlement, which is also expected to include more careful regulations that are meant to protect the privacy of Facebook users, although it's not yet clear what those additional restrictions might be.

This settlement is supposed to resolve the Justice Department's investigation into Facebook following the Cambridge Analytica scandal. That scandal erupted in 2018 after it was revealed that Cambridge Analytica took advantage of Facebook's lackadaisical approach to protecting user privacy so it could gather data from 50 million people. That revelation prompted several others that eventually led to international scrutiny of Facebook's practices.

If the Justice Department approves the settlement--and it usually sides with the FTC on these matters--it would be the largest fine U.S. regulators have ever issued a tech company. It's not even a real competition, either, with the second-largest being a $22 million fine issued to Google in 2012. Yet critics have said the FTC should have done more, with Rep. David Cicilline (D-RI) saying in a tweet that the settlement was "a Christmas present" to Facebook.

Cicilline said in another tweet that $5 billion is "a fraction of Facebook's annual revenue" that "won't make them think twice about their responsibility to protect user data." That's actually an understatement--the company said it brought in revenues of roughly $15 billion in the first quarter of 2019. It has more than $40 billion in cash reserves, too, which means it could theoretically pay this $5 billion settlement another seven times over with cash alone.

Does that mean Facebook wants to be fined $5 billion a quarter through 2021? Probably not; that would be weird. But it does mean the privacy abuses that prompted this settlement have essentially become little more than accounting problems. The company already warned shareholders in the first quarter of 2019 that it expected this settlement to end up somewhere between $3 billion and $5 billion. Such is the cost of doing business.

The New York Times reported that the new restrictions imposed on Facebook as part of the settlement were also weaker than some expected:

"In addition to the fine, Facebook agreed to more comprehensive oversight of how it handles user data, according to the people. But none of the conditions in the settlement will impose strict limitations on Facebook’s ability to collect and share data with third parties. And that decision appeared to help split the five-member commission. The 3-to-2 vote, taken in secret this week, drew the dissent of the two Democrats on the commission because they sought stricter limits on the company, the people said."

Criticism of this settlement will likely draw attention to the core problem with regulating tech companies like Facebook. They are so massive--and exploiting the privacy of their users is so lucrative--that even a $5 billion settlement would merely be a line-item in their quarterly results. How many such settlements would these companies have to violate for regulators to do more than just tack a few zeroes onto the previous fine? Ask us in 2027.

Neither the FTC nor Facebook have publicly commented on the settlement or the reports describing it.