In the Matter of Facebook, Inc.

The Federal Trade Commission (FTC) (plaintiff) instituted an administrative complaint against Facebook, Inc. (defendant) alleging that Facebook had violated the Federal Trade Commission Act (the FTC Act). The FTC alleged the following. Facebook informed its users that they could control who saw their profiles. Facebook users could restrict access to their profiles to, for example, only their friends or only their friends’ friends. In 2009 Facebook implemented certain privacy changes, purportedly to provide its users with additional control over their personal information. Prior to these changes, users could use Facebook’s Search Privacy Settings function to restrict access to their profile pictures and other personal pages. Because of Facebook’s privacy changes, however, users could no longer set their privacy choices through these settings. Further, the privacy changes overrode all prior privacy choices that users had made through these settings. These changes resulted in the disclosure of certain users’ personal information that was previously private. The FTC alleged that Facebook’s failure to adequately disclose these changes and their impacts constituted a deceptive act under the FTC Act. The FTC also alleged that Facebook told its users that it would not share their information with advertisers. Despite this, however, the FTC alleged that Facebook had disclosed to advertisers which users had clicked on their advertisements. Finally, the FTC alleged that Facebook told its users that they could limit access to their pictures and videos by deleting their accounts. The FTC alleged, however, that even after an account was deleted, the pictures and videos could still be accessed by visiting content URLs that Facebook had assigned to pictures and videos when they were uploaded. The FTC alleged that these practices also violated § 5 of the FTC Act.