Privacy & Information Security Law Blog

On August 10, 2012, the Federal Trade Commission announced that it has accepted the final settlement with Facebook which resolves allegations “that Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.” As we previously reported, the settlement requires Facebook to (1) not misrepresent how it maintains the privacy or security of users’ personal information; (2) obtain users’ “affirmative express consent” before sharing their information with any third party that “materially exceeds the restrictions imposed by a user’s privacy setting(s);” (3) implement procedures to prevent a third party from accessing users’ information no later than 30 days after the user has deleted such information or terminated his or her account; (4) establish, implement and maintain a comprehensive privacy program; and (5) obtain initial and biennial assessments and reports regarding its privacy practices for the next 20 years.

The final order was approved by a 3-1-1 vote by the Commissioners. Commissioner J. Thomas Rosch issued a dissenting statement questioning whether the settlement was “in the interest of the public” or covered “all representations made in the Facebook environment.”