Facebook proposed settlement with FTC over privacy breaches

This news skipped my notice last week, but I saw it today (thanks to the timely blog post by @Jason).

The Federal Trade Commission offered a proposed settlement with Facebook Inc. over its many breaches of personal privacy for its users. The announcement from the Feds read:
"The social networking service Facebook has agreed to settle Federal Trade Commission charges that it deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public. The proposed settlement requires Facebook to take several steps to make sure it lives up to its promises in the future, including giving consumers clear and prominent notice and obtaining consumers' express consent before their information is shared beyond the privacy settings they have established."

You remember all the hiccups and curve balls that Facebook implemented without user consent over the last few years, don't you? Well, the FTC ruled that Facebook has to change its practices. It cited:

Specifically, under the proposed settlement, Facebook is:

- barred from making misrepresentations about the privacy or security of consumers' personal information;
- required to obtain consumers' affirmative express consent before enacting changes that override their privacy preferences;
- required to prevent anyone from accessing a user's material more than 30 days after the user has deleted his or her account;
- required to establish and maintain a comprehensive privacy program designed to address privacy risks associated with the development and management of new and existing products and services, and to protect the privacy and confidentiality of consumers' information; and
- required, within 180 days, and every two years after that for the next 20 years, to obtain independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order, and to ensure that the privacy of consumers' information is protected.

Audits for the next 20 years! That's more than a slap in the wrist. Click here for the FTC attorney's more editorial opinion of "Where Facebook Went Wrong." The short of it? "The agency’s 8-count complaint boils down to this: Facebook’s privacy practices often flew in the face of its stated policies and, as one count alleges, the company made material retroactive changes to its privacy practices, without getting users’ consent."

I wonder if this will stifle further innovation at Facebook. Mark Zuckerberg and his corporate communications team crafted this response at the FB blog that reiterated their company stance that in the past 18 months, Facebook has enacted "20 new tools and resources designed to give you more control over your Facebook experience", as well as to announce the establishment of new jobs (Chief Privacy Officer, Policy and Chief Privacy Officer, Products).

There is a bit more to come, as well. According to the release, "The Commission vote to accept the consent agreement package containing the proposed consent order for public comment was 4-0. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through December 30, 2011 after which the Commission will decide whether to make the proposed consent order final."

So I guess we'll learn more in the coming weeks. Watch for THAT announcement to come likely on Christmas Eve around 11:30pm.