Regulators on four continents are preparing for a long-awaited showdown with Facebook, after years of disinterest and half-steps.
They largely have the same goal: changing the social media company’s behavior. Figuring out how is the hard part.
Members of the Federal Trade Commission in the United States are weighing what sorts of constraints they would put on Facebook’s business practices. But there is not agreement on those terms within the FTC, according to two people familiar with the internal talks who were not allowed to discuss them publicly.
Facebook said this week that it expected that the agency would impose a fine of $3 billion to $5 billion for violations of a privacy settlement from 2011. It would be the highest penalty in the United States against a tech company.
The company and FTC officials have discussed additional mandates that would constrain how Facebook’s handles data, strengthens security and monitors its privacy practices, according to the two people familiar with the discussions.
Joseph J. Simons, the FTC chairman, has been determined to get consensus from the five-member commission and is facing resistance on the proposed settlement from within the agency, according to the people.
The potential settlement is seen as a landmark privacy decision and a referendum on the nation’s ability to police the powers of Big Tech and protect consumers. The conditions on a deal with Facebook would have far-reaching effects, setting standards for future privacy violations and influencing the creation of privacy regulations in the United States and other countries, legal experts say.
“It will set the bar,” said David C. Vladeck, former head of consumer protection at the FTC. “Once the FTC creates a consent order, it levels the playing field so that any other party that engages in the same behavior will have every expectation that the prior order will apply to them.”
In Europe, officials in Britain, France, Germany and Ireland are scrutinizing the social media company’s practices. Governments in Australia, India, New Zealand and Singapore have passed or are considering new restrictions on social media.
Facebook has shown its willingness to fight charges of privacy violations. On Thursday, Facebook disputed findings by Canada’s privacy commissioners in an investigation into how Cambridge Analytica, a British political consulting firm that worked for the Trump presidential campaign, gained access to information about Facebook users.
The privacy commissioner of Canada and the information and privacy commissioner for British Columbia said Facebook violated national and local laws in allowing third parties access to private user information through “superficial and ineffective safeguards and consent mechanisms.”
The Canadian regulators, who have limited power to force Facebook’s compliance, plan to take the company to a Canadian federal court. The court, which focuses on regulatory issues and lawsuits against the government, may impose fines.
The revelations of data misuse by Cambridge Analytica also set off the investigation at the FTC. But regulators expanded it to include other privacy violations by Facebook that were reported, almost monthly, according to a person familiar with the investigation.
Among conditions that are being discussed by the FTC are stronger monitoring of Facebook’s privacy practices and greater restraints on how the company shares data with third parties, according to the two people familiar with the discussions.
But the conditions are not finalized and could change, as could the amount of the fine, which Facebook said was a projection. The agency and Facebook could decide to go to court over charges if an agreement is not reached.
The two sides were close to concluding settlement talks earlier this month, according to a person familiar with the talks. The company’s guidance to investors of the financial penalty also indicated a conclusion is near. But disagreements over final terms of a settlement have complicated the conclusion of the FTC’s one-year investigation.
At least one member of the five-person commission has called for direct punishment of Facebook’s chief executive, Mark Zuckerberg, and believes the proposed fine would not change Facebook’s behavior, the people said. In fact, the member would be willing to fight in court for stronger controls over the company, the two people said.
Agency officials are determined to keep the discussions with Facebook private, and the FTC’s inspector general has started an investigation into leaks of the talks, according to a person familiar with the investigation.
Also Thursday, the New York attorney general’s office said it was investigating how Facebook gained access to the email address books of more than 1.5 million users without permission.
Facebook is already fighting a lawsuit by the attorney general of Washington, D.C., Karl Racine, for the misuse of data by Cambridge Analytica.
Immediately after Facebook’s announcement of the projected fine, Democratic lawmakers and privacy advocates said the punishment was too weak. Marc Rotenberg, president of nonprofit privacy group EPIC, said a large fine was an insufficient solution to Facebook’s repeated privacy violations.
He and others have called for constraints on the structure of Facebook’s business. Zuckerberg has come out in support of global privacy and content regulations, joining a growing chorus of tech chief executives who now hope to shape federal and global regulations for the internet.
“The real challenge facing the FTC right now is whether to allow Facebook to integrate WhatsApp and Instagram with Messenger,” Rotenberg said. “The commission has the opportunity — because of the pending enforcement action — to stop that. If they don’t, Facebook’s dominance of the internet economy will only increase.”
Dipayan Ghosh, a former economic adviser on tech issues during the Obama administration, said the conditions laid out in the FTC order would also guide federal legislation.
“Enforcement actions have a broad impact on the entire industry. They can set norms,” Ghosh said.
The FTC action foreshadows problems for Facebook across the Atlantic, where European regulators have sharply criticized the social media giant’s handling of user data, harmful influence on elections and vulnerability to the spread of extremist ideologies.
In Ireland, home to Facebook’s European headquarters, the company is facing several investigations into whether it is complying with European data protection laws. Just this week, the Irish Data Protection Commission started a fresh inquiry into Facebook exposing user passwords. Under European privacy law, Facebook could be fined up to 4% of global revenue, or about $2.23 billion.
British authorities last year gave Facebook the maximum possible fine of 500,000 pounds, worth about $645,000, for allowing Cambridge Analytica to harvest the information of millions of users without their consent. The country is also considering naming a new internet regulator who could issue fines and hold individual executives legally liable for harmful content spread on their platforms.
In France, where the government has passed laws to stop the spread of misinformation on social media close to elections, officials are investigating Facebook’s content moderation policies.
And in Germany, which adopted an anti-hate speech law that requires Facebook to screen out posts considered harmful, antitrust authorities forced Facebook to adjust its data-collection policies after determining the company was exploiting its market dominance to profile its users and sell advertising.
The efforts are part of a broader effort to clamp down on social media around the world.
Ben Scott, a former State Department official in the Obama administration, said the global scrutiny represented “a massive wave of outrage that will crash straight into the central premise of the company’s business model.”