META Meta Platforms Inc

By Brent Kendall and John D. McKinnon 

WASHINGTON -- The Federal Trade Commission's coming resolution of its yearlong investigation of alleged privacy lapses at Facebook Inc. looms as a defining moment for U.S. policy on consumer data, one with lasting ramifications for companies that collect it.

The social media giant said Wednesday it was setting aside $3 billion to pay for any potential settlement with the FTC -- and estimated the figure could go as high as $5 billion.

A sum that large would far exceed any previous FTC penalty and could establish the commission -- derided by some as toothless in the past -- as a key cop on the Big Tech beat, an area where the European Union has taken a harder line.

The penalty could also serve as an important warning shot, particularly for tech firms that are already operating under FTC consent decrees from past missteps. Such companies face the possibility of large fines for repeat-offender violations.

In addition to Facebook, other major online platforms like Alphabet Inc.'s Google unit, Twitter Inc. and Snap Inc. are covered under previous FTC privacy and data security settlements, increasing pressure on them to maintain strong privacy practices.

Perhaps more important, the new conditions the FTC imposes on Facebook's future behavior could set privacy benchmarks for other companies.

FTC orders are "a primary driver of best practices," said Joseph Jerome, a privacy policy counsel for the Center for Democracy & Technology. "Whatever Facebook agrees to are things other companies will look at, and certainly any privacy lawyer would advise their clients to follow in the future."

That's particularly true if the FTC uses the Facebook case to set out specific obligations that the company must meet to safeguard consumer privacy, something it hasn't done extensively in past cases.

FTC remedies could include limits on tracking and other data collection; limits on sharing of individuals' data, including more stringent rules for obtaining user consent; and some restrictions on data use for particular kinds of ad targeting.

The commission has been expanding its remedies in recent cases -- and has insisted on more rigorous auditing of data-security practices and required that some senior executives personally certify their companies are meeting their data-protection obligations.

That could signal the FTC's direction in the Facebook case. The social-media giant has resisted having CEO Mark Zuckerberg's role defined in an FTC consent decree, according to people familiar with the matter.

Any eventual settlement is expected to influence the broader debate in Congress over privacy policy, which has been energized by Facebook's problems.

Several lawmakers from both parties said the FTC case against Facebook only underscores the need for strong action by Congress.

"I'm sure Facebook thinks this is going to get them off the hook, but it's not," said Sen. Marsha Blackburn (R., Tenn.), a frequent critic of big technology companies. Major platforms "are not going to change their behavior until we change the law," she added.

The FTC could use its Facebook penalties to make the case to Congress that it could do even more if it had additional authority to pursue privacy violations. However, some advocates said that strong FTC action could give lawmakers an excuse to delay the difficult job of piecing together privacy legislation.

If that happens, "it takes some of the air out of the balloon in terms of wanting to pass strong privacy legislation," said Ashkan Soltani, a privacy expert and former chief technologist at the FTC.

Some Democrats, for their part, already are dismissing the possible settlement as inadequate. Rep. David Cicilline (D., R.I.) said the jump in Facebook's stock following its Wednesday announcement showed that Wall Street viewed the potential punishment as "a slap on the wrist."

"If the FTC won't act, Congress has to," he added.

The FTC announced its investigation last year in the wake of disclosures that tens of millions of Facebook users' data was shared improperly with Cambridge Analytica, a political consultancy that later did work for President Trump's campaign. A wide range of other privacy concerns have surfaced since then, complicating the FTC's investigation.

The FTC generally has very limited authority to impose monetary fines for first-time offenses, including for privacy violations, but its power to sanction companies financially expands considerably for second-time transgressions if they violate the terms of an earlier settlement with the FTC.

Facebook is in its current predicament with the commission because of an agreement it finalized in 2012 to resolve FTC allegations that the company deceived its users by telling them they could keep their information on the social media site private, when in fact the company repeatedly allowed it to be shared or made publicly accessible.

The prior case included a laundry list of instances in which the commission alleged Facebook made privacy promises and broke them, including on data sharing with third-party apps and advertisers, as well as public exposure of data like users' lists of Facebook friends.

The social media giant didn't admit wrongdoing as part of the earlier settlement and agreed to refrain from making deceptive privacy claims.

There is no broad consumer privacy legislation in the U.S. comparable to Europe. The EU's General Data Protection Regulation went into effect last year, placing a host of privacy obligations on companies and giving consumers more control over the use of their personal data. The FTC generally protects consumer privacy through its power to stop unfair or deceptive trade practices.

The Facebook fine could give U.S. enforcers a leg up on their European counterparts, who generally have taken a harder line against U.S. tech giants. Under the EU privacy law, regulators there couldn't impose penalties as high as the FTC is contemplating.

Congress has long considered comprehensive privacy legislation, but has yet to agree on anything, including whether to give the FTC additional enforcement tools like greatly expanding its ability to fine first-time privacy offenders. Most of the focus right now is on the Senate Commerce Committee, which has been attempting to craft a bipartisan bill.

Tech subcommittee chairman John Thune (R., S.D.) said Thursday that the latest developments show that the "backlash to Facebook's attitude of `move fast and break things' with respect to consumer privacy is only intensifying."

Jeff Horwitz contributed to this article.

Write to Brent Kendall at brent.kendall@wsj.com and John D. McKinnon at john.mckinnon@wsj.com

(END) Dow Jones Newswires

April 25, 2019 19:12 ET (23:12 GMT)

Copyright (c) 2019 Dow Jones & Company, Inc.