The Federal Trade Commission voted Friday to finalize its settlement with Facebook, resolving charges that the social network exposed details about users' lives without getting the required legal consent.
Facebook Inc. agreed to submit to government audits of its privacy practices every other year for the next two decades. The company also committed to getting explicit approval from users before changing the types of content it makes public.
The settlement, announced in November, is similar to agreements the FTC reached separately with Google Inc. and Myspace.
The FTC approved the settlement Friday after a public comment period. It came a day after the FTC fined Google $22.5 million to resolve allegations that Google didn't comply with the earlier settlement.
Facebook didn't admit any wrongdoing in the settlement, though CEO Mark Zuckerberg conceded in November that the company had made "high-profile mistakes" on privacy over the years.
Both Facebook and Google have vast amounts of data on their users Facebook through the things people share on the site, and Google through the searches and other things people do. Such information is valuable because it can be used to improve the lucrative targeted advertising pitches that both companies aim at users.
Over the years, Facebook has been pushing users to voluntary share more about themselves. That ultimately encourages users and their friends to spend more time on the site, which in turn allows Facebook to sell more ads. Although Facebook boasts that it gives users a variety of software settings so they can decide which photos, links and updates to share with whom, the company changes those options on a regular basis.
Much of the FTC's complaint against Facebook centers on a series of changes that the company made to its privacy controls in late 2009. The revisions automatically shared information and pictures about Facebook users, even if they previously programmed their privacy settings to shield the content. Among other things, people's profile pictures, lists of online friends and political views were suddenly available for the world to see, the FTC alleged.
The complaint also charges that Facebook shared its users' personal information with third-party advertisers from September 2008 through May 2010 despite several public assurances from company officials that it wasn't passing the data along for marketing purposes.
Facebook believes that happened only in limited instances, generally when users clicked on ads that appeared on their personal profile pages. Most of Facebook's users click on ads when they are on their "Wall" a section that highlights their friends' posts or while visiting someone else's profile page.
Under the settlement, Facebook must get explicit consent a process known as "opting in" before making changes that override existing privacy preferences. The company also may not make misrepresentations about the privacy or security of users' personal information a broad clause that led to Google's fine on Thursday.
Violations will be subject to civil penalties of up to $16,000 per day for each infringement.
The FTC approved the settlement 3-1, with one commissioner not participating. Commissioner J. Thomas Rosch dissented, as he did with the Google deal on Thursday, partly because it didn't require an admission of wrongdoing. He also worried the settlement was too vague on whether it applied to Facebook apps written by outside parties. The three commissioners who approved the deal believe it covers apps.
Facebook had no comment beyond a statement that it is pleased the settlement received final approval.
Facebook's stock gained 80 cents, or 3.8 percent, to close Friday at $21.81. The company, based in Menlo Park, California, began trading publicly in mid-May, after the settlement with the FTC was reached. The stock is now trading 43 percent below its initial public offering price of $38.
Some recent US gov't actions related to privacy
The federal government has finalized its settlement with Facebook to resolve charges that the social network exposed details about users' lives without getting the required legal consent. It isn't the only tech company to have dealings with the government over privacy.
Here are some recent government actions related to privacy:
Nov. 29: The FTC announces settlement with Facebook Inc. The social-networking site agrees to submit to government audits of its privacy practices every other year for the next two decades. The company commits to getting explicit approval from its users a process known as "opting in" before changing their privacy controls. Facebook doesn't admit any wrongdoing.
Feb. 16, 2012: The FTC issues a report complaining that software companies producing games and other mobile applications aren't telling parents what personal information is being collected from kids and how companies are using it. It says apps could quietly be collecting a child's location, phone number, call logs and lists of friends.
Feb. 22: California announces a crackdown on nosy mobile applications, telling them they must give people advance warning if they want to keep pulling sensitive information from smartphones and tablet computers. Leading companies in mobile services, including Google, Apple and Microsoft, agree to require mobile apps seeking to collect personal information to forewarn users by displaying privacy policies before their services are installed on a device.
Feb. 23: The Obama administration calls for stronger privacy protections for consumers as mobile gadgets, Internet services and other tools are able to do a better job of tracking what you do and where you go. The administration issues a report in which it outlines a proposed "Consumer Privacy Bill of Rights" and urges technology companies, consumer groups and others to jointly craft new protections. Such guidelines will initially be voluntary for companies, but those that agree to abide by them could be subject to FTC sanctions for any violations.
April 13: The Federal Communications Commission fines Google $25,000, saying the online search leader "deliberately impeded and delayed" an investigation into how it collected data while taking photos for its "Street View" mapping feature. The FCC also says it will not take action against Google over its data collection. Part of the reason for that is that it still has "significant factual questions" about the Street View project that haven't been answered.
April 26: Google disputes the FCC's characterization of the probe and says the FCC was the party that took its time. Google argues that the 17-month inquiry would have gone much more quickly if the FCC hadn't dawdled so much. In some instances, Google says the FCC took seven to 12 weeks to respond to information that the company had submitted. Google says it accepted the fine to close the case.
May 8: Myspace reaches settlement with FTC with terms similar to agency's deals with Google and Facebook. The FTC says that despite telling users it would not share personally identifiable information with others, Myspace gave advertisers users' "Friend ID" numbers. That allowed advertisers to find users' publicly available personal information, often including full names, and could lead advertisers to discover users' Web-browsing activity. In the settlement, Myspace agreed not to misrepresent its privacy policies. It also agreed to implement a comprehensive privacy program and to submit to independent privacy assessments every other year for two decades.
Aug. 9: The FTC announces that Google has agreed to pay a $22.5 million fine to settle allegations that it broke a privacy promise by secretly tracking the online activities of millions of people who use Apple's Safari web browser. It's the largest penalty ever imposed by the FTC. Google isn't admitting any wrongdoing. The fine isn't over Google's data collection, but for misrepresenting what was happening, in violation of an October agreement to settle the Buzz case.
Aug. 10: The FTC finalizes November settlement with Facebook after public comment period.
Explore further: Google, FTC reach Google Buzz privacy settlement