The Federal Trade Commission finalized a settlement with Facebook over charges that the company made user information public by default even though the company promised to keep the information private.

The settlement also provided the setting for the latest battle in the ongoing debate over whether agency settlements without an admission of liability are within the public interest.

The Facebook case dates back to 2009 when the social networking site announced that information such as a user name, gender, pictures, geographic location, friend list, and fan pages was all made public by default despite its privacy policy. The company also told users they could restrict the sharing of their data to certain audiences – like their “friends” – but their information was shared with third-party applications used by their friends.

Under the terms of the finalized settlement, Facebook must give users clear and prominent notice and obtain their express consent before sharing information beyond their privacy settings. The site must also establish a comprehensive privacy program and undergo biennial privacy audits.

The settlement was approved by a 3-1-1 vote, with one abstention and Commissioner J. Thomas Rosch dissenting. Echoing his previous concerns about the agency’s settlement with Google, Commissioner Rosch wrote that because of Facebook’s express denial of liability, the FTC should not have made the deal.

Commissioners are “authorized to accept a consent agreement only if there is reason to believe that a respondent is engaging in an unfair or deceptive act or practice and that acceptance of the consent agreement is in the interest of the public,” he wrote. “I cannot find that either the ‘reason to believe’ or the ‘in the interest of the public’ requirement is satisfied when, as here, there is an express denial of the allegations set forth in the complaint.”

Commissioner Rosch also expressed concern that the settlement failed to cover Facebook’s interaction with third-party apps on its platform that may engage in “deceptive information sharing practices.”

In a majority statement, the three other Commissioners who voted in favor of the settlement said that “an extensive investigation and detailed staff recommendation” led the agency to conclude that the complaint and resulting settlement are in the public interest.

“We view the final consent order in this matter to be a major step forward for consumer privacy and hereby approve it,” the Commissioners wrote. “While we do not believe that a respondent’s denial of liability is reason to reject a settlement that is in the public interest, we share Commissioner Rosch’s desire to avoid any possible public misimpression that the Commission obtains settlements when it lacks reason to believe that the alleged conduct occurred.”

Going forward, “express denials will be strongly disfavored,” the Commissioners pledged. In the future, the language “the respondent neither admits nor denies” a complaint’s allegations “may very well be a more effective way to ensure that there are no misimpressions about the Commission’s process,” and the agency will consider in the coming months whether to modify the Commission’s Rules of Practice, according to the statement.

To read more about the settlement, including the FTC’s complaint, the proposed settlement, and statements from the Commission and dissenting Commissioner Rosch, click here.

Why it matters: While the Commissioners may have reached a tentative understanding in the debate over express denials of liability in agency settlements, the argument continues in the courtroom. Federal courts considering settlements with the FTC and with the Securities and Exchange Commission have recently rejected proposed deals in which the defendants expressly denied or declined to admit liability. Advertisers and marketers should keep an eye on the issue, as the courts continue to question the practice and the FTC appears poised to reconsider its position regarding the denial of liability in agency settlements.