FTC to claim company misled users about handling of their phone numbers as part of settlement

This article is more than 1 year old

This article is more than 1 year old

The Federal Trade Commission is expected to announce on Wednesday that Facebook has agreed to a sweeping settlement of allegations it mishandled user privacy and pay roughly $5bn, two people briefed on the matter said.

Should tech companies be worried about DoJ's antitrust review? Read more

As part of the settlement, Facebook will agree to create a board committee on privacy and will agree to new executive certifications on user privacy, the people said.

The Washington Post reported on Tuesday that the FTC will allege Facebook misled users about its handling of their phone numbers and its use of two-factor authentication as part of a wide-ranging complaint that accompanies a settlement ending the government’s privacy investigation, citing two people familiar with the matter.

Under the terms of the FTC settlement, Facebook’s CEO, Mark Zuckerberg, will have to personally certify that the company is taking steps to protect consumer privacy, reported the Wall Street Journal.



The deal, which does not require Facebook to admit culpability for its alleged misdeeds in the Cambridge Analytica data breach, requires Zuckerberg to certify quarterly that Facebook’s privacy controls are in place, according to the WSJ report. A false statement in the certifications would be subject to potential penalties.



The deal was approved by the FTC’s five-member board by a 3-2 vote, with three Republicans voting in favor and two Democrats dissenting, the Journal added.

The settlement will need to be approved by a federal judge.

The FTC confirmed in March 2018 it had opened an investigation into allegations Facebook inappropriately shared information belonging to 87 million users with the now-defunct British political consulting firm Cambridge Analytica. The inquiry has focused on whether the data-sharing violated a 2011 consent agreement between Facebook and the regulator and then widened to include other privacy allegations.

A person briefed on the matter said neither the phone number nor two-factor authentication issues were part of the initial Cambridge Analytica investigation.

Reuters contributed reporting