It doesn't sound like there is any punishment being considered. If a company is new and just needs some tweaks or additions, after the FTC investigates, then you put in place the third-party audits and up to date privacy practice. But in this case, when a company is dishonest and profits by misleading it's customers, there has to be an actual punishment. And besides that, what are they required to do for the customers they mistreated? They made money selling our information and now that they were caught lying about it shouldn't they be paying damages?