The past week has seen numerous sources report that Facebook, Inc., the world’s largest social networking website, is on the verge of finalizing a settlement agreement with the Federal Trade Commission. The settlement agreement allegedly relates to charges from privacy advocates that certain 2009 changes to Facebook’s privacy policies misled users about how the company used their personal information. Specifically, the 2009 changes implemented privacy settings that required specific types of personal profile information (including a user’s gender and city of residence) to be viewable to everybody, whereas Facebook users previously had the ability to limit which individuals were able to view such information in their personal profiles. Facebook did not obtain “opt-in” consent from users prior to implementing the new privacy settings, which led privacy advocates to allege that Facebook had engaged in an unfair or deceptive business practice in violation of Section 5 of the FTC Act (see, e.g., http://epic.org/privacy/inrefacebook/EPIC-FacebookComplaint.pdf).
Although both Facebook and the FTC have declined to comment on these reports, it is believed that the proposed settlement agreement would (i) prevent Facebook from making “material retroactive changes” to its privacy practices without first obtaining user consent; and (ii) subject Facebook to independent privacy audits for 20 years. Such terms would be consistent with several recent settlement agreements between the FTC and other high profile internet companies, including Google, Inc. and Twitter. The Facebook settlement agreement is reportedly awaiting final approval by the FTC, at which point its exact terms will be available to the general public.