WASHINGTON -- Federal regulators have fined Facebook $5 billion for privacy violations and are instituting new oversight and restrictions on its business. But they are only holding CEO Mark Zuckerberg personally responsible in a limited fashion.
The fine is the largest the Federal Trade Commission has levied on a tech company, though it won't make much of a dent for a company that had nearly $56 billion in revenue last year.
As part of the agency's settlement with Facebook, Zuckerberg will have to personally certify his company's compliance with its privacy programs. The FTC said that false certifications could expose him to civil or criminal penalties.
Some experts had thought the FTC might fine Zuckerberg directly or seriously limit his authority over the company.
"The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC," Joe Simons, the chairman of the FTC, said in a statement. He added that the new restrictions are designed "to change Facebook's entire privacy culture to decrease the likelihood of continued violations."
Facebook isn't admitting any wrongdoing.
Two of the five commissioners opposed the settlement and said they would have preferred litigation to seek tougher penalties.
Facebook's top lawyer, Colin Stretch, said the company's FTC settlement will lead to more rigorous management of user privacy -- including more technical controls to better automate privacy safeguards.
Facebook will also pay a separate $100 million fine to the Securities and Exchange Commission to settle charges it made misleading disclosures about the risk of misuse of Facebook user data.
The FTC opened an investigation into Facebook last year after revelations that data mining firm Cambridge Analytica had gathered details on as many as 87 million Facebook users without their permission. The agency said Wednesday that following its yearlong investigation of the company, the Department of Justice will file a complaint alleging that Facebook "repeatedly used deceptive disclosures and settings to undermine users' privacy preferences."
The agency is also suing Cambridge Analytica over the privacy violations and has settled with its former CEO Alexander Nix and an outside researcher, Aleksandr Kogan, who developed the Facebook app that harvested tens of millions of people's personal information. Cambridge Analytica filed for bankruptcy and hasn't settled the allegations, but Kogan and Nix have agreed to restrictions on how they conduct business in the future. The settlement requires them to delete or destroy all personal information gathered.
The SEC fine also pertains to Cambridge Analytica. The SEC said Facebook presented misuse of data as a hypothetical for two years even though it knew the third-party developer had actually misused user data. That misuse was discovered in 2015, according to the SEC, but Facebook did not correct its existing disclosure for more than two years. When the company disclosed the incident in March 2018 its stock price dropped.
Stretch said Facebook's handling of the Cambridge Analytica affair was "a breach of trust between Facebook and the people who depend on us to protect their data."
Three Republican commissioners voted for the fine while two Democrats opposed it, a clear sign that the restrictions on Facebook don't go as far as critics and privacy advocates had hoped. That wish list included specific punishment for Zuckerberg, strict limits on what data Facebook can collect and possibly even breaking off subsidiaries such as WhatsApp and Instagram.
"The proposed settlement does little to change the business model or practices that led to the recidivism," wrote Commissioner Rohit Chopra in his dissenting statement. He noted that the settlement imposes "no meaningful changes" to the company's structure or business model. "Nor does it include any restrictions on the company's mass surveillance or advertising tactics," he wrote.
Ashkan Soltani, a former FTC chief technologist, said the settlement "mounts to essentially a get-out-of-jail free card for Facebook," by indemnifying" the company from government prosecution for all claims prior to June 12.
Simons said in a news conference Wednesday that the agency has limited legal powers to enforce privacy rules. For stiffer penalties, he said, the agency would have faced long odds in drawn-out litigation.
Commissioner Noah Phillips, a Republican, said the purpose of the action isn't "to vindicate every concern that the world has about Facebook," but it sends important messages that the price of privacy violations is getting higher and "paying attention to privacy issues is something that companies ought to consider whether to elevate to the board level."
But despite the record fine and all the public flogging triggered by the Cambridge Analytica scandal, Facebook is worth more than it was before the blowback began. The company's market value on Wednesday was hovering around $575 billion -- roughly $40 billion above where it stood before the news of the Cambridge abuses broke. Those gains make the $5 billion fine easier to swallow for Facebook and its shareholders.
