The final consent order in In re Facebook, Inc. that we approve today advances the privacy interests ofthe nearly one billion Facebook users around the world by requiring the company to live up to its promises and submit to privacy audits. Notably, Facebook will be subject to civil penalties of up to $16,000 for each violation of the order. We intend to monitor closely Facebook's compliance with the order and will not hesitate to seek civil penalties for any violations. We write to address the arguments raised by our colleague, Commissioner Rosch, who opposes final approval of the order. One of his objections relates to the extent to which the order would reach the activities of third-party "apps" downloaded by consumers while using the Facebook platform. The Order broadly prohibits Facebook from misrepresenting in any manner, expressly or by implication, the extent to which it maintains the privacy or security of any information it collects from or about consumers. For a company whose entire business model rests on collecting, maintaining, and sharing people's information, this prohibition touches on virtually every aspect of Facebook's operations. Further, the Order sets forth clear examples of how this broad prohibition would apply in connection with apps, by prohibiting Facebook from misrepresenting (1) the extent to which it makes its users' information accessible to apps; or (2) the steps it takes to verify the privacy or security protections that apps provide.! A statement from Facebook about an app's conduct may well amount to a promise that Facebook is taking steps to assure the level of privacy or security that the app provides for consumers' information.2 These provisions make clear that Facebook will be liable for conduct by apps that contradicts Facebook's promises about the privacy or security practices of these apps.

Click for Full Text!