Strike three: FTC says Meta still failing to protect user privacy
- Reference: 1683216486
- News link: https://www.theregister.co.uk/2023/05/04/strike_three_ftc_says_meta/
- Source link:
The FTC [1]said that Meta has failed to fully comply with [2]the order , and it also alleges Zuckercorp misled parents about safety features in its Messenger Kids app and misrepresented how much access app developers had to private user data.
According to the FTC, Meta's Messenger Kids app includes parental controls that restrict who children are allowed to interact with. There's a simple workaround for such restrictions, though: group chats and group video calls enabled unapproved contacts to get through whitelists, which the FTC said not only violates its previous agreement with Meta, but also the Children's Online Privacy Protection Act ( [3]COPPA ).
[4]
The FTC also alleges that Meta didn't cut off third-party developer access to user data in 2018 as it agreed to do, with some outside developers able to access user data until mid-2020.
[5]
[6]
As a result, the FTC wants to modify its 2020 agreement with Meta to strengthen existing rules as well as adding a blanket prohibition against monetizing data collected from anyone under 18, as well as making any data harvested before an individual's 18th birthday permanently off limits for monetization.
Proposed changes also include a requirement similar to the FTC's [7]agreement with Twitter that would pause the launch of all new products and services pending third-party assessment that the changes comply with the FTC's privacy requirements. The rules imposed on Meta by the FTC would be extended under the new order to include any future acquisitions by Meta and would expand limits on the use of facial recognition technology included in the 2020 order.
[8]
"Facebook has repeatedly violated its privacy promises. The company's recklessness has put young users at risk, and Facebook needs to answer for its failures," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection.
This is strike three for Zuck and friends
"This is the third time the FTC has taken action against Facebook for allegedly failing to protect users' privacy," the FTC said. The Commission added in its latest [9]Order to Show Cause [PDF] that recent investigations turned up "serious deficiencies and [a] sheer number of total gaps and weaknesses [that] overall present substantial risks to the public" in Meta's implementation of the FTC's 2020 order.
If the FTC manages to get its changes approved, and barring a surprise response from Meta there's little reason to assume it won't (there are only 3 commissioners on the FTC, all Democrats, who voted 3-0 to approve the Order to Show Cause), it would be the second time the original 2012 order was modified because Meta failed to follow orders.
The [10]2012 order subjected Meta (then Facebook) to 20 years of biannual privacy reviews and other restrictions, which the FTC said Facebook violated "within months of it being finalized" by "engaging in misrepresentations that helped fuel the Cambridge Analytica scandal."
The 2020 agreement resolved violations of the 2012 agreement and imposed a $5 billion civil penalty and additional rules, like an independent assessor. Now, the FTC says that Meta has not only violated those rules, but [11]COPPA as well.
[12]
In a [13]statement posted to Twitter, Meta spokesperson Andy Stone called the FTC's claims a political stunt that was unprecedented, and said Meta would be fighting the order.
[14]FTC fines Facebook $5bn for making users believe they actually had control over their data
[15]Facebook puts a price on privacy for US users and it's not enough to buy a cup of coffee
[16]Meta, which pays for web scraping, sues to stop web scraping
[17]Meta disbands Responsible Innovation team, spreads it out over Facebook and co
"Let's be clear about what the FTC is trying to do: [18]usurp the authority of Congress to set industry-wide standards and instead single out one American company while allowing Chinese companies, like TikTok, to operate without constraint," Stone said in his tweet.
"We have spent vast resources building and implementing an industry-leading privacy program under the terms of our FTC agreement," Stone added.
Meta has 30 days to respond to the FTC's order to show cause (explain why it shouldn't go ahead with the motion), at which time the Commission will "carefully consider the facts and any arguments" before ultimately, [19]in all likelihood , putting its foot down on Meta yet again. ®
Get our [20]Tech Resources
[1] https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-proposes-blanket-prohibition-preventing-facebook-monetizing-youth-data
[2] https://www.theregister.com/2019/07/24/facebook_fined_5bn_over_privacy_snafu_by_federal_trade_commission/
[3] https://www.theregister.com/2022/05/20/ftc_children_data/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZFQrAjFO@RXkP3AoXJpD8wAAABY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZFQrAjFO@RXkP3AoXJpD8wAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZFQrAjFO@RXkP3AoXJpD8wAAABY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/03/08/eu_us_regulators_concerned_twitter/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZFQrAjFO@RXkP3AoXJpD8wAAABY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.ftc.gov/system/files/ftc_gov/pdf/C4365-Commission-Order-to-Show-Cause-%28Redacted-Public%29.pdf
[10] https://www.theregister.com/2011/11/30/zuckerberg_ftc_privacy_mea_culpa/
[11] https://www.theregister.com/2022/05/20/ftc_children_data/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZFQrAjFO@RXkP3AoXJpD8wAAABY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://twitter.com/andymstone/status/1653812002819649536
[14] https://www.theregister.com/2019/07/24/facebook_fined_5bn_over_privacy_snafu_by_federal_trade_commission/
[15] https://www.theregister.com/2023/04/19/us_facebook_users_class_action/
[16] https://www.theregister.com/2023/02/02/meta_web_scraping/
[17] https://www.theregister.com/2022/09/09/meta_disbands_responsible_innovation_team/
[18] https://www.theregister.com/2022/11/10/republican_senators_ftc_privacy/
[19] https://www.theregister.com/2021/06/16/lina_khan_ftc/
[20] https://whitepapers.theregister.com/
Re: "This is the third time"
Fie years ? Surely under the USA 'three strikes & out' laws he should be eating porridge for much longer than that.
Any "penalties" they impose amount to mere hours or days of revenue, so it isn't going to stop Meta, or Google, or Microsoft, or any of the big internet vacuum cleaners.
I agree. Instead of these stupid fixed dollar fines, they need to be made proportional to the company's gross revenue for the previous FY. Not only does it make the whole thing more fair, applying equally to big and small companies alike, but it would actually hurt big companies. I don't care if you're Facebook or a single person startup running out of someone's garage, if you get fined 10% of your gross revenue for the previous FY, it's going to hurt.
According to https://investor.fb.com/investor-news/press-release-details/2021/Facebook-Reports-Fourth-Quarter-and-Full-Year-2020-Results/default.aspx their total costs and expenses in 2020 were 53,294 million $.
A 5,000 million$ civil penalty for violations from 2012 - 2020 would come to 625 million$ per year on average and thus could be considered to increase their operation costs by less than 1.2%. Hardly a big incentive to get them to play by the rules.
It is however enough money to spend a few millions on lawyers trying to reduce the fine and keep the FTC busy.
I'm shocked
A company whose entire business model is based on collecting user's personal info and then selling it is not fully complying with an order to do something detrimental to its business, and might be misleading people to get MORE personal info? I'm shocked! This is my shocked face. ----->
I find it very odd that Faecesbook takes to Twitter to tell the world that in their view the FTC is doing this for political reasons.
Crying "witchhunt" is very popular in the US these days though.
only on one side of the political spectrum.
Two decades of it
Facebook has been aggressively violating user privacy (and even the privacy of people who don't use it!) for nearly 20 years now. And it's been lying for nearly as long about its privacy protections, how it deliberately turns off your privacy protections, how it buys up data from every online source you go near and all your financial info*, and what it does with that data. Every time Zuck or whassername gets called before Congress they spout new Big Lies about what they've done, why they've done it, and what they're going to be doing. And for that entire time the members of Congress have been slack jawed stupid suckers and nod and believe the lies they've been told. That seems to be fraying lately, though.
* For instance, even if you're reading this but not on Facebook, they know you exist, and they have a unique profile for you associated with your tax data, your employment history, all your credit card transactions, your bank transactions, your health history, your car insurance, where you live, what car you drive, who else is in your family, etc. etc. If they have any photos of you (say from the DVLA or DMV) then they are quietly tagging you in every photo a Facebook member uploads. If you have a forum history, they may have that. They do this for being a 'third party partner' that pays other companies to pass on all their data about everyone. If there's some entity who knows something about you, Facebook knows it. Often even an entity that wouldn't sell their data directly to Facebook (the DVLA might have a twinge about it) usually has other third parties they're using as consultants, and Facebook gets it from them. I hate Facebook, I've never used it, but they know more about me than my mum does.
"This is the third time"
And the only answer will be "We're sorry, we goofed. Won't do it again. No need to fine us."
Of course The Zuck is going to fight. Selling access to data is what made his fortune, and that is more important to him than anything else.
Slap him in prison for five years, that might shake some sense into his thick skull.