America's Federal Trade Commission (FTC) has finalised a settlement with Facebook over charges that the social network deceived consumers by failing to keep their information private, despite assurances that it would.
The deal, first announced in November, requires Facebook to: give consumers clear and prominent notice and obtain their express consent before sharing their information beyond their privacy settings, maintain a comprehensive privacy program to protect consumers' information, and submit to independent, third-party privacy audits every two years for the next 20 years.
Following a public comment period, the FTC approved the settlement by a vote of three against one, with Commissioner Thomas Rosch dissenting and Commissioner Maureen K. Ohlhausen not voting.
"Based on the extensive investigation of the staff, there is a strong reason to believe that the settlement is in the public interest, and that the order's provisions make clear that Facebook will be liable for a broad range of deceptive conduct," the commission said in its majority opinion.
In dissenting, Rosch took issue with the fact that Facebook did not admit to any wrongdoing in accepting the settlement. He was also concerned that the deal did not cover the privacy-related activity on third-party apps.
The issue dates back to 2009 when Facebook rolled out changes intended to provide users with more control over access to profile content. But that came as Facebook moved towards a more open format, expanding beyond the confines of Facebook.com. As a result, users were confused as to what information on their profiles was public and private.
The FTC deal says that Facebook made certain information, like Friends Lists, public without consent. "They didn't warn users that this change was coming, or get their approval in advance," the FTC said.
Facebook also misrepresented how users' data was used by third-party apps. The social network said apps would only access the bare minimum of data needed, but those apps "could access nearly all of users' personal data—data the apps didn't need," the FTC said.
In a statement, Facebook said it is "pleased that the settlement, which was announced last November, has received final approval."
After the deal was first announced in November, Facebook CEO Mark Zuckerberg addressed it in a blog post, in which he acknowledged that Facebook has "made a bunch of mistakes" since its inception. Facebook "can do better," he said at the time. "I'm committed to making Facebook the leader in transparency and control around privacy."
Last week, the FTC also handed down a $22.5 million fine against Google for misrepresenting how it tracked users on Apple's Safari browser. Commissioner Rosch also voted against that deal.