The Federal Trade Commission announced its settlement with Facebook on Wednesday morning, ending a more than year-long probe into whether the tech giant violated a 2012 order -- in which the company promised to protect consumers’ information -- about privacy after it inadvertently allowed political consulting firm Cambridge Analytica to access the personal data of millions of users.
The deal also includes a $5 billion penalty for Facebook and a requirement that CEO Mark Zuckerberg will personally certify that the company is meeting the FTC’s requirements on a quarterly and annual basis. A false statement could result in potential penalties, including both criminal and civil charges.
"The accountability required by this agreement surpasses current U.S. law and we hope will be a model for the industry," Facebook said in a statement on Wednesday. "It introduces more stringent processes to identify privacy risks, more documentation of those risks, and more sweeping measures to ensure that we meet these new requirements."
Additional penalties for Facebook include a ban from using phone numbers to enable security features, such as two-factor authentication, and a prohibition on asking for email passwords to other services when consumers first sign-up. Per the agreement, Facebook also must exercise greater oversight of third-party apps.
The privacy demands extend to WhatsApp and Instagram, which Facebook owns, and any new product that it creates.
“We are not relying on Facebook to police itself, and we are no longer relying on Mr. Zuckerberg unilaterally to make decisions that will affect consumer privacy,” FTC Commissioner Christine Wilson said during a FOX Business interview. “The order creates a robust system of checks and balances that spreads responsibility and accountability for consumer privacy and the attendant risks throughout the corporation.”
The FTC is also taking action against Cambridge Analytics, its former CEO Alexander Nix and Alexsandr Kogan, an app developer who worked with the company, alleging the firm used false and deceptive tactics to collect personal information from about 87 million people.
U.S. regulators are expected to settle charges with Alphabet Inc., Google's parent company, over alleged violations by YouTube over children's online privacy rights.