Proposed Consent Agreement In the Matter of Facebook, Inc., FTC File No. 0923184
This is a completely-inadequate settlement that amounts to a wrist-slap and does little to improve the state of affairs. There are three points that I see as absolutely essential: (1) Facebook users must be able to examine and request deletion of any and all personal information retained by Facebook about themselves, including both information that they have entered, and information that Facebook has derived from provided materials, e.g. pictures identified by Facebook's automatic face-detection based on user-contributed photographs, (2) Facebook users must be able to examine a complete audit trail for any and all information disclosure related to their account — it is not enough for users to be told what information may be shared, they must be able to see what information has been shared, when, and with whom, (3) audits must be randomly-scheduled and unannounced, and not scheduled by Facebook in such a way that allows them to prepare for each audit at their discretion. Without #1 and #2, users cannot be expected to reason about how Facebook is using their personally-identifying information and contributed content in accordance with the terms of this settlement and publicly-stated business practices. #3 is necessary to ensure the integrity of the audits, as Facebook has been consistently lax in meeting even their own internally-set standards and publicly-stated business practices, except when an outside party has intervened. This period of auditing will not serve to increase the integrity and honesty of Facebook operations if it is a mere oscillation between the normal state of being and the audited state of being. Facebook must not simply clean up its act whenever there is going to be an audit, but definitively and consistently. The proposed settlement is absolutely unsatisfying insofar as it lacks the safeguards and integrity in these three points. With these small changes, the settlement terms would be effective and satisfactory.