FTC Imposes $5B Penalty and Sweeping New Privacy Restrictions on Facebook

If there isn't escalation in price for violations past this in the future, this may just be the new price to play ball.

Can anyone with a firmer understanding of the issue tell me if this is an appropriate penalty or not?

Should we expect to see some of these prohibitions generalized to more companies?

* Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising

* Facebook must encrypt user passwords and regularly scan to detect whether any passwords are stored in plaintext

* Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services

And now that those regulations are in place generally Facebook is locked in at the top. And all it took was a $5 billion dollar single payment. The three gears locked together unable to turn iconography they use in the article represents this well.

A lot of the terms of the settlement deal with organizational changes, but when you look at the very specific privacy restrictions that Facebook agreed to, it's really, really problematic stuff:

* Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising;

* Facebook must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users;

* Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services.

This might, at first blush, seem like a win for users, but consider it from a different perspective.

When a settlement involves promising not to do a bunch of really, really bad stuff, that typically means the settlement doesn't have much bite. It's comparatively easy for a company to agree not to do egregiously bad things, and comparatively harder for it to agree not to do things that are still problematic, but less egregious.

These things that Facebook has agreed to not do are way outside the boundaries of ethical privacy practices -- but there's still a ton of gray area that remains unaddressed.

So from Facebook's perspective, this is probably a big win. The settlement allows the company to give the appearance of taking concrete steps to respect users' privacy. But what it might actually mean is that there were many other less egregious privacy violations that it was able to slip past the FTC's judgment.

>Facebook is prohibited from using telephone numbers obtained to enable a security feature

This is exactly what made me quit Facebook a while back. Started to spam me with notifications when I only wanted to add a backup number.