Facebook and FTC reach agreement on privacy protections
Reporting from San Francisco — Facebook Inc. is on the verge of going public, so it’s getting serious about privacy.
The company, under intense scrutiny for its privacy policies as it prepares for what promises to be a blockbuster initial public offering next year, has agreed to get its users’ permission before making changes to privacy settings.
According to a proposed settlement with the federal government, Facebook will undergo independent privacy audits every other year for the next 20 years.
The Federal Trade Commission did not levy any fines, but failure to meet the terms of the settlement could result in steep civil penalties, the commission said.
Facebook is looking to raise $10 billion in an IPO that would value the world’s largest social networking site with more than 800 million users at more than $100 billion, double the valuation of Hewlett-Packard Co., the world’s largest computer maker.
Its agreement with the FTC announced Tuesday would settle allegations that in 2009 it made public information that users had thought would remain private.
The controversial move prompted a flurry of complaints from privacy watchdogs who say changes to the company’s privacy settings duped users into sharing more personal information with the public than they intended. The FTC also alleged that Facebook shared too much information with third-party application developers and advertisers.
The proposed settlement is viewed as a helpful, though unnecessary, step in the company’s march toward next year’s IPO.
“This would not have precluded an offering had it not been settled. But [Chief Executive] Mark Zuckerberg ‘manned up,’” said Scott Sweet, senior managing partner of IPOboutique.com, an IPO advisory firm. “This means one less road-show question. He has quite a story to tell, but sure enough you’d have someone in the back row yelling about his mother’s privacy being invaded.”
In a blog post, Facebook founder Zuckerberg acknowledged that Facebook made a “bunch of mistakes” but said that his company had already fixed many of the lingering privacy concerns and defended the company’s overall record of “providing transparency and control over who can see your information.”
Lisa Noel, 34, an office manager from Chicago who uses Facebook every day, said she was satisfied with the proposed settlement.
“I think that’s the best you can ask for,” Noel said. “Facebook should make a clearer point of letting us know about changes they make. But if you are that worried about the site, you probably shouldn’t be using it.”
According to an eight-count complaint, the FTC alleged that Facebook told users that third-party apps they installed would have access to only as much information as the apps needed to operate but took far more. It also alleged that personal information labeled as to be shared only with friends had been shared with third-party apps when a friend installed the apps. The FTC also accused Facebook of sharing personal information with advertisers.
Facebook did not admit to violating any law. The proposed settlement notes that the company denies the FTC’s allegations. But Facebook has agreed to get express consent from users before changing how it shares their information. The proposed settlement is written broadly to extend to other potential privacy breaches not explicitly covered in the settlement, FTC officials said in a conference call Tuesday.
An issue of growing concern at the FTC is facial recognition, which Facebook rolled out last year. The FTC said it would hold a workshop on facial recognition next week.
“If they unveil a new product that uses facial recognition technology, they would have to address the privacy concerns,” said Maneesha Mithal, associate director in the FTC’s division of privacy and identity protection.
The proposed settlement is open to public comment until Dec. 30 and requires a final vote by the FTC’s commissioners.
It underscores the FTC’s willingness to step up enforcement as anxiety over Internet privacy has increased with the rise of social media and the speed at which personal data can spread on the Internet. The FTC settled a privacy complaint with Google Inc. this year over its social networking service Buzz.
The Facebook order sends a strong signal to Internet companies that they need to build privacy into their products, FTC Chairman Jon Leibowitz said.
“Nothing in this order will restrict Facebook’s ability to innovate,” Leibowitz said. “Facebook’s innovation does not have to come at the expense of consumer privacy.”
Marc Rotenberg, executive director of the Electronic Privacy Information Center, the Washington advocacy group that filed the original complaint against Facebook in 2009, noted that the FTC took action against the world’s two largest Internet companies this year and said he hoped the orders would set a “high bar for privacy protection.”
But, he added, the proposed settlement does not adopt his group’s recommendation that Facebook restore users’ privacy to the more stringent settings before the 2009 changes.
“That means as a practical consequence the company is going to continue to use, market and disclose information from users we believe was improperly obtained,” Rotenberg said.
Although the proposed settlement was mostly met with enthusiasm, some privacy advocates said it would not go far enough in protecting the privacy of Facebook users. They called on Congress to create a comprehensive legal framework to protect consumers on the Web. In the European Union, for example, each member nation has a national privacy law and a data protection authority to protect citizens’ privacy and investigate breaches.
Companies in the United States are far too “secretive,” and the settlement does not require Facebook or other companies to be more open about how they collect and use personal information, said Jeffrey Chester, executive director of Center for Digital Democracy, a Washington privacy advocacy group.
“Facebook has purposefully worked to erode the concept of privacy by disingenuously claiming users want to share all their personal information,” Chester said. “But very few of Facebook’s more than 800 million users understand, let alone can control, the vast amounts of data mining used to propel its advertising business.”
The company that got its start in Zuckerberg’s Harvard dorm room has become one of the world’s most popular Web destinations, taking on Google and Yahoo Inc. for advertising dollars.
Facebook does not disclose its financial results, but research firm EMarketer predicts it will generate $4.27 billion in revenue in 2011, up from $2 billion in 2010.
