FTC Takes Aggressive Swing at Tech Giant, Heightens Focus on Children’s Privacy, and Raises Additional Questions about FTC’s Authority

On May 3, 2023, in an aggressive move that pushes the boundaries of its authority, the FTC proposed sweeping changes to Facebook parent Meta’s business practices after alleging that the company violated the commission’s 2012 and 2020 privacy orders.¹https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-proposes-blanket-prohibition-preventing-facebook-monetizing-youth-data

The FTC alleges that Meta violated certain provisions of its 2012 and 2020 orders regarding third-party access to user data and parental control over the company’s messaging app. The FTC further alleges that these privacy violations run afoul of the Children’s Online Privacy Protection Act (“COPPA”).²https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa

Based on these alleged violations, the FTC has proposed dramatic changes to the 2020 order, many of which go substantially beyond rectifying the shortcomings identified in that order. While the 2020 order had built in layers of compliance oversight after finding that Facebook sold data to political consulting firm Cambridge Analytica, it did not ultimately change the way that the company does business. The FTC’s proposed changes would do just that – instead of modifying the terms of the 2020 order, the changes would alter fundamental aspects of the company’s business model. 

The proposed revisions would apply to Facebook as well as Meta’s other popular services such as Instagram, WhatsApp, and Oculus. The sweeping changes include:

• Banning the monetization of data collected from users under 18, which includes putting that data to use once those users become adults;
  
  
• Requiring the privacy-focused independent assessor’s formal written approval before any new products are launched or existing features are modified;
  
  
• Extending responsibility for compliance with the 2012 and 2020 Orders to companies having been acquired or will be acquired in the future;
  
  
• Necessitating affirmative consent from users for the use of facial recognition technology; and
  
  
• Strengthening privacy programs detailed in the 2020 Order related to privacy reviews, third-party monitoring, data inventory and access controls, and employee training.

There is a substantial question as to whether the FTC’s action is lawful. FTC Commissioner Alvaro Bedoya voted in favor of modifying the 2020 order, but nevertheless warned his fellow commissioners that they are taking the FTC into uncharted legal territory. He looked to a ruling by the D.C. Circuit, in Salazar v. D.C., which found that "courts may not, under the guise of modification, impose entirely new injunctive relief" in pursuit of enhancing an existing consent decree. Bedoya specifically pointed out that the dramatic new children’s privacy restrictions represent an entirely novel set of restrictions – what is supposed to be mere modification is instead entirely new regulation. Bedoya expressed that such a move pushes beyond the bounds of the FTC’s authority due to the lack of a ”nexus” between the proposed modification and the 2020 order, since the 2020 order makes no specific reference to children’s privacy concerns.³https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/statement-commissioner-alvaro-m-bedoya-matter-facebook-inc

If successful, the FTC’s attempt to significantly modify an existing consent order in this way will impact companies’ willingness to settle with the FTC. Companies who are contemplating settling with the agency will be disincentivized further from doing so, knowing that the consent order would be subject to modification. Any company currently under a consent order with the FTC should be taking a closer look at its compliance with the order’s terms.

Separately, it is clear that the FTC is heavily focused on protecting the most vulnerable consumer population – children and young adults. The FTC’s move against Meta comes less than six months after Fortnite-maker Epic Games was ordered to pay more than $500 million over FTC allegations related to alleged children’s privacy violations and practices leading young players to make unwanted in-game purchases.⁴https://www.ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations  Companies whose products are used by or directed toward children should pay careful attention to the way in which content is presented to younger audiences, any default settings established, the clarity of their disclosures, the data being gathered, and any monetization strategies.

The FTC has formally requested Meta’s response to the proposed changes to its consent order within 30 days.