News reports about Facebook’s role in the aggressive form of data collection have raised serious questions about whether the company violated a landmark consent decree with a federal watchdog agency designed to prevent privacy violations.
U.S. and European officials Sunday called for Facebook Chief Executive Mark Zuckerberg to explain how personal information about tens of millions of users ended up in the hands of a data-analysis firm that worked for President Donald Trump’s 2016 campaign — without the permission or knowledge of the vast majority of those affected.
News reports about Facebook’s role in the aggressive form of data collection also have raised serious questions about whether the company violated a landmark consent decree with a federal watchdog agency designed to prevent privacy violations.
Two former U.S. officials who negotiated the 2011 agreement between the Federal Trade Commission (FTC) and Facebook say the company may have broken its promises, potentially triggering many millions of dollars in fines.
“I would not be surprised if at some point the FTC looks at this. I would expect them to,” said David Vladeck, a former director of the FTC’s Bureau of Consumer Protection. In that role, he oversaw the investigation of alleged privacy violations by Facebook and the resulting consent decree.
Most Read Nation & World Stories
- Federal judge in Texas rules Obama health-care law unconstitutional
- George Conway calls Trump a liar after Kellyanne Conway defends president on TV
- Interior Secretary Zinke resigns amid investigations
- 'Nobody should work here — ever': Teen uses intercom to quit Walmart
- 12-year-old in China kills his mother, then returns to school, igniting an outcry
Vladeck said the law allows fines up to $40,000 per violation. With a reported 50 million people affected, he said, the “maximum exposure” could reach into the billions of dollars. It is more likely that, if the FTC found violations, Facebook would face far smaller but still substantial fines as well as other consequences.
Facebook has denied violating the agreement with the FTC, which did not respond to requests for comment Sunday. But the surge of political and regulatory scrutiny over the weekend again turned a harsh spotlight on a company that has been scrambling to protect its reputation since allegations emerged about Russian agents using the social-media platform in an attempt to manipulate American voters during the 2016 election season and beyond.
The latest revelations concern how people working for Cambridge Analytica, which the Trump campaign paid at least $6 million to assist in its digital operations, used an app to gather research on 270,000 users in 2014 and 2015.
But the number of affected people was many more — likely in the tens of millions — because the data routinely available to app developers in that era also included information on a user’s list of friends, including names, education, work histories, birthdays, likes, locations, photos, relationship statuses, and religious and political affiliations. That kind of information is extremely valuable to political campaigns for tailoring messages, ads and fundraising pitches.
Though both Facebook and Cambridge Analytica have been embroiled in investigations in Washington and London for months, some of this weekend’s demands have taken on a more personal tone, focusing explicitly on Zuckerberg, who has not testified publicly on these matters in either capital.
“They say ‘trust us,’ but Mark Zuckerberg needs to testify before the Senate Judiciary Committee about what Facebook knew about misusing data from 50 million Americans in order to target political advertising and manipulate voters,” Sen. Amy Klobuchar, D-Minn., said in a statement.
Rep. Adam Schiff of California, the highest-ranking Democrat on the House Intelligence Committee, echoed the call for Zuckerberg to personally appear for questioning on Capitol Hill.
“I think it would be beneficial to have him come testify before the appropriate oversight committees, and not just Mark but the other CEOs of the other major companies that operate in this space,” Schiff said in an interview Sunday. “There’s still a lot we’re learning about foreign issues on these platforms.”
Similar calls for official investigation came from several other U.S. lawmakers, the European Union’s justice commissioner and a British lawmaker, Damian Collins, head of a parliamentary committee that has been investigating Facebook and Cambridge Analytica.
“I will be writing to Mark Zuckerberg asking that either he or another senior executive from the company appear to give evidence in front of the committee as part our inquiry,” Collins said Sunday. “It is not acceptable that they have previously sent witnesses who seek to avoid asking difficult questions by claiming not to know the answers.”
At least two state attorneys general, from Massachusetts and Pennsylvania, also have announced plans to investigate.
Facebook declined to comment on the requests for Zuckerberg to testify. The company said in a statement Sunday afternoon that it was renewing efforts to investigate what happened with the data that reached Cambridge Analytica.
Facebook executives throughout the weekend also resisted allegations that Cambridge Analytica’s actions amounted to a “breach” of its systems because Facebook’s systems were not compromised and the app developer worked within the company’s terms of service, at least initially.
Facebook suspended the parent company of Cambridge Analytica and two of its former employees Friday for improperly sharing the data that was collected through the app and not destroying it at Facebook’s request in 2015. Cambridge Analytica has repeatedly denied wrongdoing or improper use of Facebook data.
“We worked with Facebook over this period to ensure that they were satisfied that we had not knowingly breached any of Facebook’s terms of service and also provided a signed statement to confirm that all Facebook data and their derivatives had been deleted,” Cambridge Analytica said in a statement Saturday.
Facebook said it also is investigating its hiring of Joseph Chancellor, who is identified in corporate documents as an official of the parent company of Cambridge Analytica and is now at the social network, focusing on virtual reality. Facebook would not say whether it was aware of Chancellor’s role at Cambridge Analytica at the time of his hiring.
The consent decree the agency signed with Facebook in 2011 required that users be notified and that they explicitly give their permission before data about them is shared beyond the privacy settings they have established. The developer of the app that collected data for Cambridge Analytica in 2014 sought permission from those who downloaded the app but not their Facebook friends. The app, called “thisisyourdigitallife,” offered personality predictions and billed itself on Facebook as “a research app used by psychologists.”
A key question now is what was allowed under Facebook’s privacy settings at the time Cambridge Analytica’s app was active, and whether those permissions were so broad that they allowed routine violations of the consent decree with the FTC.
In a 2014 news release announcing new restrictions to its developer policies, a Facebook executive wrote, “We’ve heard from people that they are often surprised when a friend shares their information with an app.” That admission may indicate that Facebook users had not been given adequate understanding of how their data and their friend’s data were used by third-party developers such as Cambridge.
In November 2011, the FTC faulted Facebook for making some information, such as users’ friends lists, viewable by the public without first obtaining those users’ explicit permission. The FTC also found that Facebook shared personal information with advertisers despite promising not to do so. The agency raised other issues about apps on Facebook that regulators said had access to more information than they needed to operate.
As a result, the FTC required Facebook to obtain consumers’ consent before “enacting changes that override their privacy practices,” the agency said at the time. It also subjected Facebook to 20 years of independent, third-party privacy checkups to ensure that it followed the settlement.
Years later, though, the latest controversy is spurring demands for action, with consumer advocates saying the FTC is partly to blame because it did not penalize the social-media giant for other privacy mishaps.
“This is the consequence of the Federal Trade Commission’s failure to enforce the 2011 consent order with Facebook,” said Marc Rotenberg, president of the Electronic Privacy Information Center. “The United States needs a dedicated privacy agency and a comprehensive privacy law. The FTC can’t do the job.”