WASHINGTON, D.C.—The Federal Trade Commission has alleged that Facebook has failed to fully comply with a 2020 privacy order and proposed new protections that would better protect kids and teens.
The FTC said the social media giant misled parents about their ability to control with whom their children communicated through its Messenger Kids app, and misrepresented the access it provided some app developers to private user data.
“Facebook has repeatedly violated its privacy promises,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection. “The company’s recklessness has put young users at risk, and Facebook needs to answer for its failures.”
As part of the proposed changes, Meta, which changed its name from Facebook in October 2021, would be prohibited from profiting from data it collects, including through its virtual reality products, from users under the age of 18. It would also be subject to other expanded limitations, including in its use of facial recognition technology, and required to provide additional protections for users.
The agency noted that this is the third time it has taken action against Facebook for allegedly failing to protect users’ privacy. The Commission first filed a complaint against Facebook in 2011, and secured an order in 2012 barring the company from misrepresenting its privacy practices.
According to a subsequent complaint filed by the Commission, Facebook violated the first FTC order within months of it being finalized – engaging in misrepresentations that helped fuel the Cambridge Analytica scandal. In 2019, Facebook agreed to a second order—which took effect in 2020—resolving claims that it violated the FTC’s first order.
The new FTC action alleges that Facebook has violated the 2020 order, as well as the Children’s Online Privacy Protection Act Rule (COPPA Rule).
The 2020 privacy order required Facebook to pay a $5 billion civil penalty. The 2020 order also expanded the required privacy program, as well as the independent third-party assessor’s role in evaluating the effectiveness of Facebook’s program.
The independent assessor, tasked with reviewing whether the company’s privacy program satisfied the 2020 order’s requirements, identified several gaps and weaknesses in Facebook’s privacy program, according to the Order to Show Cause, in which the Commission notes that the breadth and significance of these deficiencies pose substantial risks to the public.
The Order to Show Cause also alleges that Facebook violated both the 2012 and 2020 orders by continuing to give app developers access to users’ private information after promising in 2018 to cut off such access if users had not used those apps in the previous 90 days. In certain circumstances, Facebook continued to allow third-party app developers to access that user data until mid-2020.
The proposed changes to the 2020 order, which would apply to Facebook and Meta’s other services such as Instagram, WhatsApp, and Oculus, include:
- Blanket prohibition against monetizing data of children and teens under 18: Meta and all its related entities would be restricted in how they use the data they collect from children and teens. The company could only collect and use such data to provide the services or for security purposes, and would be prohibited from monetizing this data or otherwise using it for commercial gain even after those users turn 18.
- Pause on the launch of new products, services: The company would be prohibited from releasing new or modified products, services, or features without written confirmation from the assessor that its privacy program is in full compliance with the order’s requirements and presents no material gaps or weaknesses.
- Extension of compliance to merged companies: Meta would be required to ensure compliance with the FTC order for any companies it acquires or merges with, and to honor those companies’ prior privacy commitments.
- Limits on future uses of facial recognition technology: Meta would be required to disclose and obtain users’ affirmative consent for any future uses of facial recognition technology. The change would expand the limits on the use of facial recognition technology included in the 2020 order.
- Strengthening existing requirements: Some privacy program provisions in the 2020 order would be strengthened, such as those related to privacy review, third-party monitoring, data inventory and access controls, and employee training. Meta’s reporting obligations also would be expanded to include its own violations of its commitments.
As part of the action, the FTC has formally asked Meta to respond in 30 days to the proposed findings from the agency’s investigation.
The Commission voted 3-0 to issue the Order to Show Cause.
The full Order to Show Cause is available here.
