The agreement Facebook struck with the Federal Trade Commission this week to end the agency's investigation into its alleged privacy violations was a good deal for the company.

Facebook can easily afford the $5 billion penalty, and the FTC could have legitimately assessed it a much higher fine.

The supposed restrictions in the agreement on its business are fairly meaningless — they generally don't limit its ability to collect personal data from consumers.

Likewise, the governance reforms don't represent any real check on Mark Zuckerberg's control over the company.

Visit Business Insider's homepage for more stories.

The Federal Trade Commission would like to have you believe that its settlement with Facebook over the latter's alleged privacy violations was a great deal.

And it was — for Facebook.

The FTC — or at least its Republican majority that approved the agreement announced Wednesday — touted the "record" $5 billion penalty the company will pay as part of it and the "unprecedented" new restrictions the agency is putting in place to oversee the social media giant's privacy practices going forward. The agency also argued that the settlement was far better than it could have gotten — and agreed to much sooner than would have happened — if it had gone to court.

Maybe so. But the deal is much more show than substance. And, given the scope of Facebook's alleged misdeeds, is far too lax on the company and CEO Mark Zuckerberg.

The $5 billion penalty is all-but-inconsequential to a company as profitable as Facebook. The new oversight structure has some major flaws and weaknesses. The settlement does little to limit Zuckerberg's power and doesn't hold him personally accountable for the actions of a company that he alone controls. And the agreement does almost nothing to stop the collection and sharing of data — or the use of it for targeted advertising — that was at the heart of the company's privacy violations.

The agreement "lets Facebook off the hook," said FTC Commissioner Rohit Chopra, who joined with fellow Democrat Rebecca Kelly Slaughter in voting against the deal, in a written dissent. "The fine print in this settlement," he continued, "gives Facebook a lot to celebrate."

Chopra wasn't the only one lambasting the agreement. Consumer groups including Free Press and the Electronic Privacy Information Center, which for years has been criticizing Facebook's privacy practices, blasted it as inadequate. So too did Republican Sen. Josh Hawley, a frequent Facebook critic, who called it disappointing, saying that it "utterly fails to penalize Facebook in any effective way."

Facebook can easily afford $5 billion

For all the patting on the back the FTC's majority gave itself for the agreement, it's not hard to understand why many see it as a bad deal.

Take the monetary penalty. A $5 billion fine sounds like a lot, and the FTC's majority certainly trumpeted it as such. After all, the biggest prior penalty the agency had imposed in a case like Facebook's was the $22.5 million fine it slapped on Google in 2012.

But compared to Facebook's revenue, profits, cash flow, market capitalization, or cash on hand, $5 billion is fairly small. In its second quarter alone, for example, Facebook posted $16.9 billion in sales, generated $8.6 billion in cash from its operations, and ended the quarter with $48.6 billion in cash and marketable securities. It "only" posted a profit of $2.6 billion for the period, but that amount included a deduction for the FTC fine. In other words, even with the fine, it earned billions of dollars of profit in the period.

Read this: The FTC's $5 billion fine for Facebook is so meaningless, it will likely leave Zuckerberg wondering what he can't get away with

And that was just one quarter. Facebook's alleged violations date back years, meaning that over the period in question, it's generated easily hundreds of billions of dollars in revenue and tens of billions of dollars in profits.

Meanwhile, comparing the fine to past penalties is not actually supposed to be part of the FTC's methodology, as Chopra noted in his dissent. The FTC has a well defined set of factors it's supposed to take into account when determining financial penalties. Among other things, the agency is supposed to take into account a company's ability to pay, its good or bad faith in dealing with the agency, and the profits it made that can be attributed to its offending conduct.

"In my view, a rigorous analysis of unjust enrichment alone ... would likely yield a figure well above $5 billion," Chopra said.

The company can keep on collecting consumer data

But it's not just the penalty where the agreement is far less than it seems on the surface. The new privacy oversight Facebook will have to put in place as part of the deal is also more impressive in the abstract than it's likely to be in reality.

Under the deal, the company will have to set up a new privacy committee comprised of independent directors. It will also have to establish a new nominating committee, also composed of independent board members, that will name people to the privacy committee.

FTC Chairman Joe Simons announces the penalty. REUTERS/Yuri Gripas

Facebook's new chief privacy officer, Michel Protti, whose naming was also required by the agreement, will have to give quarterly reports to the privacy committee about the company's privacy practices under the deal. It will also have to name an independent person to assess its compliance with the privacy program laid out in the deal on a biannual basis to the FTC.

What's more, Facebook will have to assess and report on the risk to privacy of each new product or service it launches.

All of that sounds pretty onerous. But it's likely to be more of a bureaucratic headache than a meaningful restriction on Facebook's activities. That's because the order generally doesn't preclude Facebook from implementing new products and services that infringe on users' privacy or from collecting their personal information.

Under the order Facebook can no longer use members phone numbers that they've supplied it for the purpose of its two-factor authentication feature to target them with ads. It also has to get their express consent before applying its facial recognition technology to pictures of their faces. But other than those exceptions, it's free to continue collecting, using, and sharing whatever personal data it wants on its users, as long as it makes an assessment of the risks involved and describes what safeguards it puts in place — if any — to mitigate them.

"The order allows Facebook to evaluate for itself what level of user privacy is appropriate, and holds the company accountable only for producing those evaluations," Chopra wrote. "What it does not require is actually respecting user privacy."

The agreement doesn't check Zuckerberg's power

The new governance structure similarly seems more about trying to give the semblance that the FTC was doing something rather than meaningfully constraining Zuckerberg's power. For all the talk in the order about "independent" directors, it's hard for any Facebook board member to be truly independent when Zuckerberg controls the company.

Thanks to his ownership of a special class of stock that give him 10 votes per share, Zuckerberg has about 58% of the voting power at Facebook. By himself, he can determine the outcome of any shareholder vote or board election. The agreement did nothing to limit that fundamental power.

The agreement purports to limit that control by barring the removal of any member of the privacy committee without the support of shareholders representing two-thirds of the voting power at the company, or more than what Zuckerberg alone controls. But that's not really a meaningful constraint.

As Chopra noted in his dissent, it's rare for corporate directors to be removed from office midway through their term. Generally, they get replaced when their term is up, when companies hold a vote for directors at their annual shareholder meeting. If Zuckerberg doesn't approve of a supposedly independent director's work on Facebook's new nominating or privacy committees, he could name and vote in alternative board members at the annual meeting all by himself.

"The proposed settlement ratifies Facebook's governance structure instead of changing it," Chopra said. "The 'Independent Privacy Committee' has little independence, no meaningful powers, and no buy-in from shareholders."

The FTC let Zuckerberg off the hook — without interviewing him

But perhaps the worst part about the settlement is that with it, the FTC is essentially wiping the slate clean for Facebook and its executives unnecessarily and before it even finished its work.

The agency could and probably should have held individual Facebook executives and directors responsible for allegedly breaking the terms of the 2012 agreement. But it didn't. Even though Zuckerberg, Chief Operating Officer Sheryl Sandberg, and the company's directors were responsible for ensuring that Facebook hewed to that agreement, the settlement doesn't hold any of them personally accountable for allegedly failing to do so. That's in sharp contrast to the actions the FTC has taken against smaller companies, including Cambridge Analytica. In that case, which the agency settled on the same day, it did actually hold the company's executive personally responsible.

Relatedly, despite investigating Facebook for 16 months, the agency never interviewed Zuckerberg. The agency's enforcement director said the FTC feared Facebook would have gone to court rather than allow Zuckerberg to be deposed and that the agency felt it had all the information it needed without him.

But that assertion seems ludicrous on its face. Zuckerberg controls the company. He was the one who announced or was intricately involved in the major steps that affected the ability of companies including Cambridge Analytica to access the personal data of Facebook users without their knowledge.

The agency likely could have learned at least something about his involvement and thinking in those decisions by interviewing him. And even if it still chose not to hold him personally responsible for those decisions, the interview itself would have been a way of holding him accountable.

Given Zuckerberg's control over Facebook, the FTC failure to uncover his role in the company's myriad alleged privacy violations — including by interviewing him — was a "critical" missed step in the investigation, Chopra said.

"It is hard to imagine that any of the core decisions at issue were made without his input," he said. "The FTC Act," he continued, "does not include special exemptions for executives of the world's largest corporations, but this settlement sends the unfortunate message that they are subject to another set of rules."

And that's precisely why they're likely celebrating at Facebook's headquarters.

Got a tip about Facebook or the tech industry? Contact this reporter via email at twolverton@businessinsider.com, message him on Twitter @troywolv, or send him a secure message through Signal at 415.515.5594. You can also contact Business Insider securely via SecureDrop.