Facebook’s future: What the FTC order means for consumer privacy

The FTC’s complaint against Facebook outlines eight separate areas where the FTC says Facebook’s privacy practices were deceptive or unfair. What provisions does the proposed order put in place to protect people in the future?

One key provision is a broad ban on deception. Facebook can’t misrepresent the privacy or security protections that apply to any “covered information.” The order defines that as information “from or about” an individual consumer like:

• a first or last name;
• address, including street name and city;
• email address or other online contact information — like a screen name or IM user identifier;
• phone number;
• photos and videos;
• IP address, user ID, or other persistent identifier;
• physical location;
• or any combination of those things.

Here are just a few examples of what the company can’t do under the proposed order:

► Facebook can’t misrepresent what covered information it collects or discloses.

► When Facebook offers privacy settings on its site, it has to honor them. For example, it can’t offer settings that restrict information to “Only Friends” and then share it with others.

► Facebook can’t mislead people about the extent to which it shares covered information with third parties, like apps or advertisers.

► Facebook can’t mislead people about the steps it takes to verify the privacy or security that third parties provide — for example, apps used on its site.

► Facebook can’t mislead people about the extent to which their covered information is accessible after they’ve deactivated or deleted their accounts.

► Facebook can’t mislead people about the extent to which the company complies with government or third-party privacy programs — like the US-EU Safe Harbor Framework.

What if Facebook wants to share someone’s nonpublic user information — defined as covered information restricted by a privacy setting — in a way that materially exceeds the restrictions imposed by that person’s setting? Facebook will have to clearly and prominently disclose what it wants to do and then get each user’s affirmative express consent.

What about just saying something in a privacy policy, data use policy, statement of rights and responsibilities, or other document like that? Nope, not good enough, according to the proposed order. That’s not “clear and prominent.”

The order also requires Facebook to set things up so that within 30 days after users have deleted or terminated their accounts, their covered information can’t be accessed from servers under the company’s control.

In addition, Facebook will have to put in place a comprehensive program to protect the privacy of covered information. The program has to address privacy risks posed both by existing products and by new ones. For the next 20 years, the company has to get every-other-year privacy assessments conducted by a qualified, independent third-party professional. To ensure compliance, the order imposes strict monitoring and reporting requirements.

What are the consequences if Facebook violates the order? Hefty civil penalties.

Looking for more? Read the transcript of the FTC’s Twitter Chat about the Facebook case.

Next: What the proposed Facebook settlement means for your company