The FTC will probe whether Facebook violated its consent decree.
The FTC will probe whether Facebook violated its consent decree.

After speculation mounted last week, the Federal Trade Commission (FTC) said Monday that it has launched a probe into Facebook after it was revealed that Cambridge Analytica used the private information of 50 million users without their permission.

Facebook CEO Mark Zuckerberg and other executives spent considerable time last week explaining how the data landed – and remained – in the hands of the data analytics firm used by both the Trump and Brexit campaigns. Zuckerberg issued an apology of sorts, noting that the social media giant had broken trust, and detailed a plan for improving privacy and protecting user data.

But that wasn't enough to mollify the FTC, which is investigating whether Facebook violated a 2011 consent decree, which required it to obtain user consent when privacy settings were changed or risk paying $40,000 per day for each violation.

“The FTC is firmly and fully committed to using all of its tools to protect the privacy of consumers,” which includes “enforcement action against companies that fail to honor their privacy promises, including to comply with Privacy Shield, or that engage in unfair acts that cause substantial injury to consumers in violation of the FTC Act,” Tom Pahl, acting director of the FTC's Bureau of Consumer Protection, said in a statement. “Companies who have settled previous FTC actions must also comply with FTC order provisions imposing privacy and data security requirements.”

Saying that it “takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook,” the commission confirmed “it has an open non-public investigation into these practices."

Bart Lazar, a privacy attorney with Seyfarth Shaw, said “not that much has changed” in the two decades since he was the lead attorney defending GeoCities against the FTC's privacy action. “The issues are really the same. The last decade or so, the focus has been on security as opposed to privacy,” said Lazar. “The Facebook situation brings to bear some very basic privacy issues, such as the clarity of privacy notices, and the importance of serious due diligence with respect to any third party or service provider to whom personal information is disclosed.”

The U.S. hasn't established baseline privacy protections but rather relies on a “hodgepodge” of state and federal laws. “The FTC has made itself out to be the sheriff in the privacy space,” Lazar said, questioning whether “the FTC enforcing its broad Section 5 authority, without real legal guidance” actually helps consumers and businesses.

Confirmation of the FTC probe comes as ABC News reported that Common Cause had filed two complaints – one with the Federal Election Commission (FEC) and the other with the Justice Department – against Cambridge Analytica, its parent company, its CEO, its co-founder, a data scientist and a whistleblower for running afoul of federal election laws that forbid foreign entities from influencing political campaigns in the U.S.

“It defies belief that even after their own attorney warned them that they would be violating the prohibition on performing certain election-related activities in U.S. elections that they did so anyway,” ABC cited Common Cause Vice President for Policy and Litigation Paul S. Ryan as saying in regard to an alleged memo from a Bracewell & Guliani lawyer to company investors Rebekah Mercer and Steve Bannon, warning that foreigners “may not play strategic roles” in elections. “A full investigation must be conducted, and if Cambridge Analytica and its staff did in fact repeatedly violate our laws, then there must be punishment levied sufficient to deter similar lawbreaking in future.”