The FTC alleges that Meta has “repeatedly violated” privacy rules and is proposing to toughen the agency’s 2020 order against the company, completely banning it from monetizing data from anyone under 18 in any way, among other new restrictions.
The order in question went into effect in 2020 but was created in 2019 as part of a $5 billion Facebook settlement after the company breached former to request. The FTC now says Facebook/Meta violated the new order, as well as the Children’s Online Privacy Protection Act.
“The company’s recklessness has put young users at risk, and Facebook needs to respond to its failures,” Samuel Levine, director of the Federal Trade Commission’s Office of Consumer Protection, said in a press release. (Due to the demand and failures mentioned covering both of my company names, both are also used throughout.)
The 2020 order created an independent, third-party evaluator that assesses whether or not Meta adheres to privacy rules, such as that new products are subject to privacy reviews and restrictions on how facial recognition data and phone numbers are used.
This evaluator recently submitted his report to the Federal Trade Commission, and it appears to be no good, containing evidence of numerous deficiencies or violations: “The commission notes that the breadth and significance of these deficiencies pose significant risks to the public,” the agency wrote.
Specifically, Facebook has promised (in 2018 – the timeline is long and confusing) to cut off app developers’ access to users’ data if that user does not use the app in 90 days. But it hasn’t, the FTC claims, and allowed some of that data to be used well into 2020.
The company also “misrepresented that parents can control who their children communicate with through the Messenger Kids product”. Communication controls put in place by Facebook were inadequate, allowing children to communicate with unapproved contacts via group video calls and chats.
This may not sound like the most egregious of failures, but regulations around technology for kids are strict for good reason, and violations of the Children’s Online Privacy Protection Act (COPPA) are serious. When one considers that Facebook was not only put on a decade-long warning for its sloppy privacy practices, but that it knew the FTC was monitoring its every move especially with sensitive data such as that of users under 13, One is less inclined to offer grace. .
This apparently cavalier approach to complying with the FTC’s order prompted the agency to tighten the screws, with a number of proposed changes to the order—something it might do when justified by “changing circumstances of fact, law, or public interest.” Companies may consider themselves warned that FTC orders are largely living documents.
In this case, the 2020 order, which affects all Meta businesses (Facebook, Instagram, WhatsApp and Oculus), will be amended to add the following:
- Total prohibition on monetizing data from anyone under 18 years of age. This data can only be used to provide services or for security purposes. (And it doesn’t become legal retroactively when a user turns 18, either.)
- No new or modified products or services are launched without the Independent Evaluator confirming that the new features comply with privacy restrictions.
- If Meta happens to buy a cool new company, this privacy rule now applies to them, too.
- Extended restrictions on facial recognition require disclosure and affirmative consent.
- Enhanced requirements in all aspects related to privacy audits, data inventory, access controls, etc.
Meta strongly denied the FTC’s approach, calling it a “political stunt” in a statement. accusing FTC Chair Lena Khan of “a new low” in allowing TikTok to run for free while antagonizing Meta, said Christopher Sgroe, a Meta policy spokesperson. “We have spent tremendous resources building and implementing an industry-leading privacy program under the terms of our FTC agreement. We will vigorously fight this work and expect it to prevail.”
Today sees the FTC post a show-of-cause order, which details the issues mentioned in a brief above and was not publicly available at the time of writing. Meta has 30 days to respond, after which the agency will carefully study the facts and arguments put forward by the parties and decide if the expanded order is justified (not a foregone conclusion; one commissioner questions the tactics). I asked when the new order is likely to take effect and will update this post if I hear back.