On July 24, 2019, the FTC filed its Stipulated Order requiring that Facebook comply with newly-imposed privacy requirements for a period of twenty years.  The most noteworthy aspect of this Order, however, does not relate to the specifics of this compliance framework – which can easily be addressed with the right counsel. Rather, the requirement that is more challenging for Facebook is the one creating an “Independent Privacy Committee” within Facebook’s Board of Directors “consisting of Independent Directors, all of whom” have “(1) the ability to understand corporate compliance and accountability programs and to read and understand data protection and privacy policies and procedures, and (2) such other relevant privacy and compliance experience reasonably necessary to exercise his or her duties on the Independent Privacy Committee.” 

Such specific requirements regarding the capabilities of a Board member are more than a bit unusual.    Given the fiduciary responsibilities of Board members as well as the reputations of those willing to become members of this “Independent Privacy Committee”, this novel requirement may actually do something to curtail future privacy transgressions.

There is no doubt the FTC resolution was Facebook’s well-orchestrated attempt at rehabilitating its tattered reputation.  As stated in Facebook’s blog response:  “Billions of people around the world use our products to make their lives richer and to help their organizations thrive. That makes it especially important that the people who use our platform can trust that their information is protected. This agreement is an unambiguous commitment to do that.”  Indeed, this agreement may even be marketed as a way of bolstering dwindling user engagement.

It remains to be seen, however, whether or not the Stipulated Order provides an “unambiguous commitment” to do anything other than resolve specific violations of a prior FTC Decision and Order, In re Facebook, Inc., C-4365, 2012 FTC LEXIS 135 (F.T.C. July 27, 2012). Indeed, Commissioner Rohit Chopra – who assumed office on May 2, 2018, filed a forceful dissent objecting to the lax settlement of this violated Order: “Facebook flagrantly violated the FTC’s 2012 order by deceiving its users and allowing pay-for-play data harvesting by developers” and this settlement “imposes no meaningful changes to the company’s structure or financial incentives, which led to these violations.”

Facebook’s regulatory problems are far from over – the DOJ just announced a wide-ranging antitrust probe that includes Facebook.  Specifically, the Department of Justice’s Antitrust Division will review “whether and how market-leading online platforms have achieved market power and are engaging in practices that have reduced competition, stifled innovation, or otherwise harmed consumers.” This antitrust probe will likely end up being much more interesting and potentially damaging to Facebook than the recent FTC settlement – especially depending on what road is taken by its potential privacy-killing Calibra business unit.