The U.S. Federal Trade Commission (“FTC”) recently proposed changes to the Stipulated Order for Civil Penalty, Monetary Judgment, and Injunctive Relief with Meta Platforms Inc. (“Meta,” formerly Facebook), entered July 23, 2019, and effective in 2020 (the “2020 privacy order”). This comes after Meta allegedly violated the privacy order and the Children’s Online Privacy Protection Act of 1998 (“COPPA,” 15 U.S.C. §§ 6501-6506).
The proposed changes include the following, without limitation:
- Prohibiting Meta from profiting from data collected from users under eighteen (18) years of age;
- Imposing stricter limitations on the use of facial recognition technology; and
- Mandating additional protections for users.
The FTC is authorized to modify a final order under Section 5(b) of the Federal Trade Commission Act of 1914 (“FTC Act”) and Rule 3.72 thereunder when it finds changed conditions of fact or law or when the “public interest” may require such action. Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce.
A History of Alleged Privacy Violations
This is not the first time that the FTC has taken action against the social media company. The FTC filed its first complaint against Facebook in 2011, followed by a 2012 order barring the company from misrepresenting its privacy practices. Despite these measures, Facebook was alleged to have violated the order shortly thereafter, leading to the infamous Cambridge Analytica “scandal,” in which the company allegedly harvested data of up to 87 million people to influence the 2016 presidential election.
In 2019, Facebook agreed to a second order, effective in 2020, resolving claims of violations of the FTC’s first order. The FTC now alleges that Facebook has violated the 2020 privacy order and the COPPA Rule.
About The FTC’s 2020 Privacy Order With Facebook
The 2020 privacy order required Facebook to pay a $5 billion civil penalty and establish a more-comprehensive privacy program. Such protections include the following, without limitation:
- A privacy review of every new or modified product, service, or practice before implementation;
- Increased security measures for personal information; and
- Restrictions on the use of facial recognition and phone numbers obtained for account security.
Despite these requirements, the FTC claims that Facebook violated the 2012 and 2020 privacy orders by allowing application (“app”) developers to access users’ private information after promising to cut off such access, if the apps had not been used in the previous 90 days. The FTC also alleges that from late-2017 to mid-2019, Facebook misrepresented parents’ ability to control their children’s communications through its “Messenger Kids” app.
FTC Proposes Tougher Privacy Measures
The proposed changes to the 2020 privacy order are significant, affecting Facebook and Meta’s other services, such as Instagram, WhatsApp, and Oculus. Examples of proposed changes include those listed below:
- Protection of Minors’ Data – Meta would be restricted from monetizing the data of children and teens under 18.
- Product Launch Pause – Meta would not be able to release new or modified products, services, or features without written confirmation that its privacy program is fully compliant.
- Compliance for Merged Companies – Meta would have to ensure compliance with the FTC order for any acquired or merged companies.
- Limits on Facial Recognition – Meta would have to disclose and obtain users’ affirmative consent for any future uses of facial recognition technology.
- Strengthening Existing Requirements – Some privacy program provisions from the 2020 privacy order would be strengthened, including those related to privacy review, third-party monitoring, data inventory and access controls, and employee training.
Takeaways
The FTC’s proposed order signifies a continued push for greater regulation and accountability of technology companies, especially those with a substantial impact on users’ privacy. Whether Meta implements the proposed privacy enhancements in time remains to be seen.
Victims who believe that their privacy rights have been violated may be able to pursue an individual action or participate in a class action with the help of an experienced class action attorney.
