FTC commissioner has no records to support Facebook privacy improvement claims

A member of the US Federal Trade Commission has made claims that the regulator’s $5 billion settlement with Facebook has already resulted in meaningful privacy gains, despite not having any proof of such changes, GDR has found.

Facing widespread criticism that the FTC let Facebook off the hook for its role in the Cambridge Analytica scandal, the three Republican commissioners who voted to settle last July have responded by touting the privacy benefits of the terms of the settlement. And on at least two occasions last year, FTC Republican member Christine Wilson – one of the three who voted yes – said that the agreement was already driving change at Facebook.

Speaking at a Brookings Institution event on data privacy last October, Wilson said Facebook was already taking proactive steps to improve data privacy, even though the settlement had yet to be approved by a district court; the approval came only last week.

“Mark Zuckerberg now has to essentially enter into Sarbanes-Oxley representations every quarter [certifying] that he and his company are abiding by the constraints and obligations of the order,” Wilson said at the time. “Early reports indicate that there are many other changes taking place behind the scenes, and I look forward to being able to talk about those publicly at the appropriate time.”

About two months later, Wilson again reported big things happening at Facebook.

“What we have heard is that they’re implementing and strengthening their privacy and review process,” the commissioner said last December at the National Association of Attorneys General conference in Washington, DC. “For all new products and services, they are embedding restrictions on sharing user data within their programming … They’re implementing practices to allow people to access and delete their data.”

The basis for Wilson’s statements was unclear. GDR filed a Freedom of Information Act request seeking access to any non-public records Wilson had used to make her statements.

An FTC Freedom of Information Act attorney said on Tuesday that the commission “has not received any reports or documents regarding Facebook’s privacy adjustments.”

GDR asked Wilson what information underpinned her public statements. The commissioner clarified that her statements were based on Facebook’s public announcements, as well as communications apparently taking place between the company and FTC staffers.

“Prior to the court’s formal entry of the order last week, Facebook and Mr Zuckerberg made several announcements about the settlement and their implementation of the order,” she said.

“Although the judge had not yet entered the order, they made clear they were taking steps to implement it and detailed the steps they were taking. Facebook also is in regular contact with our staff.

“Based on this information, I concluded that, while I could not vouch for Facebook’s representations, early signs validate the FTC’s decision to enter this settlement. At the same time, the FTC is monitoring Facebook’s compliance closely and will not hesitate to take action if the company fails to comply with the FTC order.”

Facebook indeed made several prominent announcements about its privacy policy changes after the settlement was announced last July. Facebook chief executive Mark Zuckerberg also testified before the US House Committee on Financial Services on 23 October, promising that the FTC settlement will hold him and other company executives accountable as caretakers of user data.

But for some, relying on public statements from Facebook isn’t good enough. The Washington, DC-based Electronic Privacy Information Center – which opposed the settlement in court – said there’s no evidence to show that Facebook is now protecting user privacy.

“Commissioner Wilson’s claim that Facebook is making improvements is not enough, we have no evidence to support it. Vague assurances that Facebook has cleaned up its privacy practices won’t cut it,” EPIC told GDR. “If the FTC wants to reassure the public, it must force real changes in Facebook’s business practices to protect the privacy of consumers — starting with proactively publishing the detailed reports that Facebook is required to make under the consent decree.”

It may be nearly six more months before the “detailed reports” sought by EPIC have the chance to become public. The stipulated order between the FTC and Facebook says that the company has 180 days from 23 April to implement its mandated privacy programme.

Get unlimited access to all Global Data Review content