The Federal Trade Commission Settlement Order With Facebook 7-24-19
The Federal Trade Commission Settlement Order With Facebook 7-24-19
Plaintiff
STIPULATED ORDER
v. FOR CIVIL PENALTY,
MONETARY JUDGMENT, AND
FACEBOOK, Inc., INJUNCTIVE RELIEF
a corporation,
Defendant.
The United States of America, acting upon notification and authorization to the Attorney
General by the Federal Trade Commission (“Commission” or “FTC”), filed its Complaint for
Civil Penalties, Injunction, and Other Relief (“Complaint”) for civil penalties and other equitable
relief in this matter, pursuant to Sections 5(a), 5(l), 13(b), and 16(a)(1) of the Federal Trade
Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a), 45(l), 53(b), and 56(a)(1). Defendant has
waived service of the summons and the Complaint. Plaintiff and Defendant stipulate to the entry
of this Stipulated Order for Civil Penalty, Monetary Judgment, and Injunctive Relief (“Stipulated
Order”) to resolve the claims for civil penalties and injunctive relief set forth in the Complaint.
The parties have consented to entry of this Stipulated Order to resolve any and all claims
that Defendant, its officers, and directors, prior to June 12, 2019, violated the Commission’s
Decision and Order in In re Facebook, Inc., C-4365, 2012 FTC LEXIS 135 (F.T.C. July 27,
2012). Furthermore, this Stipulated Order resolves all consumer-protection claims known by the
FTC prior to June 12, 2019, that Defendant, its officers, and directors violated Section 5 of the
1
FTC Act. The FTC and the United States specifically reserve all other claims. For purposes of
this paragraph, “Defendant” shall mean Facebook, Inc., its successors and assigns, acting directly,
or through any corporation, company, subsidiary, division, affiliate, website, or other device that it
FINDINGS
1. This Court has jurisdiction over the subject matter and all of the parties.
3. The Complaint states a claim upon which relief may be granted against Defendant under
Sections 5(a), 5(l), 13(b), and 16(a)(1) of the FTC Act, 15 U.S.C. §§ 45(a), 45(l), 52, 53(b), and
56(a)(1), including for violations of Parts I and IV of the Commission’s Decision and Order in
In re Facebook, Inc., C-4365, 2012 FTC LEXIS 135 (F.T.C. July 27, 2012).
4. Defendant’s activities are “in or affecting commerce,” as defined in Section 4 of the FTC
5. Defendant waives any claim that it may have under the Equal Access to Justice Act,
28 U.S.C. § 2412, concerning the prosecution of this action through the date of this Stipulated
Order, and agrees to bear its own costs and attorney’s fees.
6. Defendant neither admits nor denies any of the allegations in the Complaint, except as
specifically stated in the Decision and Order set forth in Attachment A. Only for purposes of this
7. Defendant and Plaintiff waive all rights to appeal or otherwise challenge or contest the
2
I. MONETARY JUDGMENT FOR CIVIL PENALTY
of Plaintiff against Defendant as a civil penalty pursuant to Section 5(l) of the FTC Act, 15 U.S.C.
§ 45(l).
B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the United
undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such
payment must be made within 7 days of entry of this Stipulated Order by electronic fund transfer
C. In the event of any default in payment, the entire unpaid amount, together with interest, as
computed pursuant to 28 U.S.C. § 1961 from the date of default to the date of payment, shall
D. Defendant relinquishes dominion and all legal and equitable right, title, and interest to all
funds paid pursuant to this Stipulated Order. Defendant shall make no claim to or demand for
E. Defendant agrees that the facts alleged in the Complaint will be taken as true, without
further proof, only in any subsequent civil litigation by Plaintiff to enforce its rights to any
Plaintiff, may be used for collecting and reporting on any delinquent amount arising out of this
3
II. MODIFICATION OF DECISION AND ORDER
IT IS FURTHER ORDERED that Defendant, and its successors and assigns, shall consent
to: (i) reopening of the proceeding in FTC Docket No. C-4365; (ii) waiver of its rights under the
show cause procedures set forth in Section 3.72(b) of the Commission’s Rules of Practice,
16 C.F.R. § 3.72(b); and (iii) modifying the Decision and Order in In re Facebook, Inc., C-4365,
2012 FTC LEXIS 135 (F.T.C. July 27, 2012), with the Decision and Order set forth in
Attachment A.
copies of all of the reports, assessments, notifications, certifications, and other documents required
or requested under Parts VII.E.2.e, VIII.A, VIII.H, IX, XI.A, XI.B, XII.A, and XIII of the
Decision and Order set forth in Attachment A. Such documents shall be furnished to the Director
of the Department of Justice’s Consumer Protection Branch. Defendant agrees that the
Department of Justice shall have the same rights as the Commission (as given in the Decision and
Order set forth in Attachment A) to request such documents, subject to any applicable law or
regulation. Furthermore, Defendant agrees that the Department of Justice shall have the same
Decision and Order set forth in Attachment A, as well as the same right as the Associate Director
for Enforcement for the Bureau of Consumer Protection at the Commission provided under
Part VIII.B to approve the person(s) selected to conduct the Assessments described in Part VIII of
the Decision and Order set forth in Attachment A, subject to any applicable law or regulation. For
purposes of this paragraph, “Defendant” shall have the same definition and scope as the definition
of “Respondent” in Paragraph Q on page 4 of the Decision and Order set forth in Attachment A.
4
IV. CONTINUING JURISDICTION
IT IS FURTHER ORDERED that this Court shall retain jurisdiction in this matter for
5
SO STIPULATED AND AGREED:
JOSEPH H. HUNT
Assistant Attorney General
Civil Division
ANDREW E. CLARK
Assistant Director
LISA K. HSIAO
Senior Litigation Counsel
PATRICK R. RUNKLE
JASON LEE
Trial Attorneys
Consumer Protection Branch
U.S. Department of Justice
P.O. Box 386
Washington. DC 20044-0386
Telephone: (202) 532-4892
Fax: (202) 514-8742
Lisa. K. H siao@usdoj .gov
[email protected]
[email protected]
Counsel for the United States
6
FOR FEDERAL TRADE COMMISSION
JAMES A. KOHM
Associate Director for Enforcement
LAURA KOSS
A istant Director for Enforcement
7
FOR DEFENDANT
FACE BOOK, INC.
Dated: JulyZ.2.:,-,. 2019 ()r��
C�STR�
Vice President
Facebook, Inc.
8
ATTACHMENT A
[182 3109]
In the Matter of
Docket No. C-4365
FACEBOOK, Inc.,
a corporation.
The Commission considered the matter and determined that it had reason to believe that
Respondent has violated the Decision and Order the Commission previously issued in the matter In
re Facebook, Inc., C-4365, 2012 FTC LEXIS 135 (F.T.C. July 27, 2012) and the FTC Act, and that
a Complaint should issue stating its charges in that respect. After due consideration, the
Commission issues its Complaint, makes the following Findings, and issues the following Order:
FINDINGS
2. The Complaint charges violations of Section 5 of the FTC Act, 15 U.S.C. § 45, and
violations of Parts I and IV of an order previously issued by the Commission, 15 U.S.C.
§ 56(a)(1).
3. Respondent waives any claim that it may have under the Equal Access to Justice Act, 28
U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agrees
to bear its own costs and attorney fees.
4. Respondent and the Commission waive all rights to appeal or otherwise challenge or
contest the validity of this Order.
1
5. Respondent neither admits nor denies any of the allegations in the Complaint, except as
specifically stated in the Decision and Order. Only for purposes of this action, Respondent admits
the facts necessary to establish jurisdiction.
DEFINITIONS
A. “Affected Facial Recognition User” means any User who has a “Tag Suggestions”
setting as of the effective date of this Order, and any User who signs up for Respondent’s service
after the effective date of this Order and has received the “Tag Suggestions” setting.
B. “Clear(ly) and Conspicuous(ly)” means that a required disclosure is difficult to miss (i.e.,
easily noticeable) and easily understandable by ordinary consumers, including in all of the
following ways:
1. In any communication that is solely visual or solely audible, the disclosure must be
made through the same means through which the communication is presented. In any
communication made through both visual and audible means, such as a video or television
advertisement, the disclosure must be presented simultaneously in both the visual and
audible portions of the communication even if the representation requiring the disclosure is
made in only one means.
2. A visual disclosure, by its size, contrast, location, the length of time it appears, and
other characteristics, must stand out from any accompanying text or other visual elements
so that it is easily noticed, read, and understood.
5. The disclosure must use diction and syntax understandable to ordinary consumers
and must appear in each language in which the representation that requires the disclosure
appears.
6. The disclosure must comply with these requirements in each medium through
which it is received, including all electronic devices and face-to-face communications.
2
members of that group.
C. “Covered Incident” means any instance in which Respondent has verified or otherwise
confirmed that the Covered Information of 500 or more Users was or was likely to have been
accessed, collected, used, or shared by a Covered Third Party in violation of Respondent’s
Platform Terms.
E. “Covered Third Party” means any individual or entity that uses or receives Covered
Information obtained by or on behalf of Respondent outside of a User-initiated transfer of
Covered Information as part of a data portability protocol or standard, other than: (1) a service
provider of Respondent that (i) uses the Covered Information for and at the direction of
Respondent and no other individual or entity and for no other purpose; and (ii) does not disclose
the Covered Information, or any individually identifiable information derived from such Covered
Information, except for, and at the direction of, Respondent, for the purpose of providing services
requested by a User and for no other purpose; or (2) any entity that uses the Covered Information
only as reasonably necessary: (i) to comply with applicable law, regulation, or legal process, or
(ii) to enforce Respondent’s terms of use, or (iii) to detect, prevent, or mitigate fraud or security
vulnerabilities.
3
Independent Privacy Committee.
K. “Nonpublic User Information” means any User profile information (i.e., information that
a User adds to or is listed on a User’s Facebook profile), or User-generated content (e.g., status
updates, photos), that is restricted by one or more Privacy Setting(s).
L. “Platform Terms” means Respondent’s written terms, policies, and procedures relating to
the privacy, confidentiality, or Integrity of Covered Information that apply to Covered Third
Parties.
M. “Principal Executive Officer” shall mean Mark Zuckerberg for so long as he serves as
Chief Executive Officer or President of Respondent, or such other officer (regardless of title) that
is designated in Respondent’s Bylaws or by resolution of the Board of Directors as having the
duties of the principal executive officer of Respondent, acting solely in his official capacity on
behalf of Respondent; or if Mark Zuckerberg no longer serves in such a position, then such other
individual serving as the Chief Executive Officer of Respondent, or such other officer (regardless
of title) that is designated in Respondent’s Bylaws or by resolution of the Board of Directors as
having the duties of the principal executive officer of Respondent, acting solely in his or her
official capacity on behalf of Respondent. In the event that Mark Zuckerberg is not the Principal
Executive Officer and such position is jointly held by two or more persons, then each of such
persons shall be deemed to be a Principal Executive Officer.
N. “Privacy and Compliance Baseline Requirements” shall refer to the requirements that,
in the opinion of the Independent Nominating Committee, a member of the Independent Privacy
Committee has (1) the ability to understand corporate compliance and accountability programs
and to read and understand data protection and privacy policies and procedures, and (2) such other
relevant privacy and compliance experience reasonably necessary to exercise his or her duties on
the Independent Privacy Committee.
O. “Privacy Setting” includes any control or setting provided by Respondent that allows a
User to restrict which individuals or entities can access or view Covered Information.
Q. “Respondent” means Facebook, Inc. (“Facebook”), its successors and assigns, acting
directly, or through any corporation, company, subsidiary, division, affiliate, website, or other
device that it directly or indirectly controls. For purposes of Parts VII and VIII, Respondent
means Facebook, and its successors and assigns, and WhatsApp Inc., and its successors and
assigns.
R. “User” means an identified individual from whom Respondent has obtained information
4
for the purpose of providing access to Respondent’s products and services.
B. The extent to which a consumer can control the privacy of any Covered Information
maintained by Respondent and the steps a consumer must take to implement such controls;
C. The extent to which Respondent makes or has made Covered Information accessible to
third parties;
D. The steps Respondent takes or has taken to verify the privacy or security protections that
any third party provides;
E. The extent to which Respondent makes or has made Covered Information accessible to
any third party following deletion or termination of a User’s account with Respondent or during
such time as a User’s account is deactivated or suspended; and
F. The extent to which Respondent is a member of, adheres to, complies with, is certified by,
is endorsed by, or otherwise participates in any privacy or security program sponsored by a
government or any self-regulatory or standard-setting organization, including but not limited to
the EU-U.S. Privacy Shield framework, the Swiss-U.S. Privacy Shield framework, and the APEC
Cross-Border Privacy Rules.
Nothing in Part II will (1) limit the applicability of Part I of this Order; or (2) require
5
Respondent to obtain affirmative express consent for sharing of a User’s Nonpublic User
Information initiated by another User authorized to access such information, provided that such
sharing does not materially exceed the restrictions imposed by a User’s Privacy Setting(s).
Respondent may seek modification of this Part pursuant to 15 U.S.C. § 45(b) and 16 C.F.R.
§ 2.51(b) to address relevant developments that affect compliance with this Part, including, but
not limited to, technological changes and changes in methods of obtaining affirmative express
consent.
6
IV. LIMITATIONS ON THE USE OR SHARING OF TELEPHONE NUMBERS
SPECIFICALLY PROVIDED TO ENABLE ACCOUNT SECURITY FEATURES
A. Not requesting or requiring, as part of the User log-in, authentication, or account creation
process, User passwords to independent, third-party consumer applications, websites, or other
services;
B. Cryptographically protecting or otherwise securing User passwords when stored and when
in transit over the Internet or other similar transmission channel; and
C. Implementing regular automated scans designed to detect whether any User passwords are
stored in plaintext within Respondent’s data warehouse, and cryptographically protecting,
deleting, or otherwise rendering unreadable any such passwords.
7
VI. FACIAL RECOGNITION TEMPLATES
IT IS FURTHER ORDERED that Respondent and its Representatives, in connection with any
product or service, in or affecting commerce, shall not create any new Facial Recognition Templates, and
shall delete any existing Facial Recognition Templates within ninety (90) days from the effective date of this
Order, for any Affected Facial Recognition User, unless Respondent Clearly and Conspicuously discloses
(such as in a stand-alone disclosure or notice), separate and apart from any “privacy policy,” “data policy,”
“statement of rights and responsibilities” page, or other similar documents, how Respondent will use, and to
the extent applicable, share, the Facial Recognition Template for such User, and obtains such User’s
affirmative express consent.
B. Provide the written program required under Part VII.A. of this Order, and any evaluations
thereof or adjustments thereto, to the Principal Executive Officer and to the Independent Privacy
Committee created in response to Part X of this Order at least once every twelve (12) months;
D. Assess and document, at least once every twelve (12) months, internal and external risks in
each area of its operation (e.g., employee training and management; developer operations;
partnerships with Covered Third Parties; sharing of Covered Information with Covered Third
Parties or Facebook-owned affiliates; product research, design, and development; and product
marketing and implementation) to the privacy, confidentiality, or Integrity of Covered Information
that could result in the unauthorized access, collection, use, destruction, or disclosure of such
information. Respondent shall further assess and document internal and external risks as
described above as they relate to a Covered Incident, promptly following verification or
8
confirmation of such an incident, not to exceed thirty (30) days after the incident is verified or
otherwise confirmed;
E. Design, implement, maintain, and document safeguards that control for the material
internal and external risks identified by Respondent in response to Part VII.D. Each safeguard
shall be based on the volume and sensitivity of the Covered Information that is at risk, and the
likelihood that the risk could be realized and result in the unauthorized access, collection, use,
destruction, or disclosure of the Covered Information.
1. Specifically with respect to any Covered Third Party that obtains or otherwise has
access to Covered Information from Respondent for use in an independent, third-party
consumer application or website, such safeguards shall include:
9
review (e.g., whether the practice was approved, approved contingent upon
safeguards or other recommendations being implemented, or rejected);
(i) The type(s) of Covered Information that will be collected, and how
that Covered Information will be used, retained, and shared;
(ii) The notice provided to Users about, and the mechanism(s), if any,
by which Users will consent to, the collection of their Covered Information
and the purposes for which such information will be used, retained, or
shared by Respondent;
(iv) The existing safeguards that would control for the identified risks to
the privacy, confidentiality, and Integrity of the Covered Information and
whether any new safeguards would need to be implemented to control for
such risks; and
10
d. The appendices required under Part VII.E.2.c.(ii) and (iii) shall be provided
to the Assessor no fewer than twenty-one (21) days in advance of the quarterly
meeting of the Independent Privacy Committee as specified in Part X.A.5. A copy
of the summary in the Quarterly Privacy Review Report required under
VII.E.2.c.(i) shall be provided to Assessor no fewer than fourteen (14) days in
advance of the quarterly meeting; and
11
F. Assess, monitor, and test, at least once every twelve (12) months and promptly (not to
exceed thirty (30) days) following the resolution of a Covered Incident, the effectiveness of any
safeguards put in place pursuant to Part VII.E. of this Order to address the risks to the privacy,
confidentiality, or Integrity of Covered Information, and modify the Privacy Program based on the
results;
G. Establish regular privacy training programs for all employees on at least an annual basis,
updated to address any internal or external risks identified by Respondent in Part VII.D. of this
Order and safeguards implemented pursuant to Part VII.E. of this Order, that includes training on
the requirements of this Order;
H. Select and retain service providers capable of safeguarding Covered Information they
receive from Respondent, and contractually require service providers to implement and maintain
safeguards for Covered Information;
I. Consult with, and seek appropriate guidance from, independent, third-party experts on data
protection and privacy in the course of establishing, implementing, maintaining, and updating the
Privacy Program; and
J. Evaluate and adjust the Privacy Program in light of any material changes to Respondent’s
operations or business arrangements, a Covered Incident, new or more efficient technological or
operational methods to control for the risks identified in Part VII.D. of this Order, and any other
circumstances that Respondent knows or has reason to believe may have a material impact on the
effectiveness of the Privacy Program. Respondent may make this evaluation and adjustment to
the Privacy Program at any time, but must, at a minimum, evaluate the Privacy Program at least
once every twelve (12) months and modify the Privacy Program as necessary based on the results.
IT IS FURTHER ORDERED that, in connection with compliance with Part VII of this Order
titled Mandated Privacy Program, Respondent must obtain initial and biennial assessments
(“Assessments”):
A. The Assessment must be obtained from one or more qualified, objective, independent
third-party professionals (“Assessor(s)”), selected by the Respondent, subject to the reasonable
approval of the Independent Privacy Committee and subject to Part VIII.B, who: (1) uses
procedures and standards generally accepted in the profession; (2) conducts an independent
review of the Mandated Privacy Program; and (3) retains all documents relevant to each
Assessment for five (5) years after completion of such Assessment and furnishes such documents
to the Commission within ten (10) days of receipt of a written request from a representative of the
Commission. No documents may be withheld by the Assessor on the basis of a claim of
confidentiality, proprietary or trade secrets, work product protection, attorney client privilege,
statutory exemption, or any similar claim;
B. For each Assessment, Respondent must provide the Associate Director for Enforcement
for the Bureau of Consumer Protection at the Federal Trade Commission (“Associate Director”)
with the name(s) and affiliation(s) of the person(s) selected to conduct the Assessment, which the
12
Associate Director shall have the authority to approve;
C. The reporting period for the Assessments must cover: (1) the first 180 days after the
Privacy Program has been put in place for the initial Assessment; and (2) each two-year period
thereafter for twenty (20) years after issuance of the Order for the biennial Assessments;
D. Each Assessment must: (1) determine whether Respondent has implemented and
maintained the Privacy Program required by Part VII.A-J of this Order, titled Mandated Privacy
Program; (2) assess the effectiveness of Respondent’s implementation and maintenance of each
subpart in Part VII of this Order; (3) identify any gaps or weaknesses in the Privacy Program; and
(4) identify specific evidence (including, but not limited to, documents reviewed, sampling and
testing performed, and interviews conducted) examined to make such determinations,
assessments, and identifications, and explain why the evidence that the Assessor examined is
sufficient to justify the Assessor’s findings. To the extent that Respondent revises, updates, or
adds one or more safeguards required under Part VII.E. of this Order in the middle of an
Assessment period, the Assessment shall assess the effectiveness of the revised, updated, or added
safeguard(s) for the time period in which it was in effect, and provide a separate statement
detailing the basis for each revised, updated, or additional safeguard;
E. Respondent and its Representatives must disclose all material facts to the Assessor(s), and
must not misrepresent in any manner, expressly or by implication, any fact material to the
Assessor(s)’ (1) determination of whether Respondent has implemented and maintained the
Mandated Privacy Program required by Part VII of this Order; (2) assessment of the effectiveness
of the implementation and maintenance of subparts VII.A-J of this Order; or (3) identification of
any gaps or weaknesses to the Mandated Privacy Program;
F. Respondent and its Representatives, whether acting directly or indirectly, must provide or
otherwise make available to the Assessor all information and material in their possession, custody,
or control that is relevant to the Assessment for which there is no reasonable claim of privilege;
H. Each Assessment must be completed within sixty (60) days after the end of the reporting
period to which the Assessment applies. Unless otherwise directed by a Commission
representative in writing, Respondent must submit each Assessment to the Commission within ten
(10) days after the Assessment has been completed via email to [email protected] or by overnight
courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of Consumer
Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.
The subject line must begin, “In re Facebook, Inc., FTC File No. 182-3109.” Each Assessment
shall be retained by Respondent until this Order is terminated, and shall be provided to the
Associate Director within ten (10) days of Request; and
13
I. The Assessor may only be removed by Respondent from such position, subject to Part
VIII.B, with the affirmative vote of a majority of the Independent Privacy Committee.
IT IS FURTHER ORDERED that Respondent must submit a report within thirty (30) days
following Respondent’s verification or confirmation of a Covered Incident, and subsequently
updated every thirty (30) days until the incident is fully investigated and any remediation efforts
are fully implemented, to the Assessor(s) and to the Commission, that includes, to the extent
possible:
A. The date, estimated date, or estimated date range when the Covered Incident occurred;
B. An overview of the facts relating to the Covered Incident, including the causes of the
Covered Incident;
C. A description of each type of Covered Information that was accessed, collected, used,
destroyed, or shared without the User’s authorization or consent;
D. The number of Users whose Covered Information was accessed, collected, used,
destroyed, or shared without the User’s authorization or consent; and
E. An overview of the acts, if any, that Respondent has taken to date to remediate the
Covered Incident and protect Covered Information from further exposure or access.
A. Within one hundred and twenty (120) days after entry of this Order, Respondent shall
create the Independent Privacy Committee, including adopting a new committee charter or
amending the charter of an existing committee. The adopted or amended charter for such
committee shall include the following qualifications, authority, and responsibilities, including:
1. The committee shall hold at least four regularly-scheduled meetings each year;
2. Each member of the committee shall be an Independent Director, and each of the
members of the committee shall meet the Privacy and Compliance Baseline Requirements;
3. Each quarter, the Respondent shall cause the committee to receive a briefing from
14
management regarding (i) the state of the Privacy Program, (ii) Respondent’s compliance
with the Order, and (iii) material risks to the privacy, confidentiality, and Integrity of the
Covered Information that have been discovered since the most recent meeting of the
committee or that were raised by management in a prior meeting with the committee and
continue to persist;
4. On at least an annual basis, management shall conduct a review for the committee
of the Privacy Program and discuss Respondent’s assessment of material risks to the
privacy, confidentiality, and Integrity of the Covered Information and the steps
Respondent has taken or plans to take to monitor or mitigate such risks, including
Respondent’s procedures and any related policies with respect to risk assessment and risk
management;
5. The committee shall meet with the Assessor at least quarterly, and at the
conclusion of each biennial Assessment;
a. At each quarterly meeting, the Assessor shall review with management and
the committee (i) the Assessor’s ongoing assessment of the Privacy Program, and
(ii) any material risks to the privacy, confidentiality, and Integrity of the Covered
Information that have been identified by the Assessor since the Assessor’s most
recent meeting with the committee, or that were raised by the Assessor in a prior
meeting with the committee and continue to persist;
c. At the meeting to review the biennial Assessment with the Assessor, the
Assessor and the committee shall review the various elements of the Assessment,
as well as (1) any material issues raised by the most recent Assessment or material
unresolved issues from prior Assessments, and (2) in an executive session without
management present, any problems or difficulties with management. Following
the review of the biennial Assessment (at either the same meeting or the following
meeting), management shall review with the committee its proposed remediation
plans to address any such issues raised in the Assessment; and
6. The committee shall evaluate the independence of the Assessor, and the Assessor
shall not be appointed or removed by Respondent, subject to Part VIII.B, without the prior
approval of a majority of the committee;
B. Within one hundred and twenty (120) days after entry of this Order, Respondent shall
create the Independent Nominating Committee, including adopting a new committee charter or
amending the charter of an existing committee to provide that such committee shall have the
following authority and responsibilities, including:
1. The committee shall have the sole authority to recommend the appointment of
directors, or the nomination of candidates for election, to Respondent’s Board of Directors,
15
such that Respondent’s Board of Directors may not approve any such appointment or
nomination in the absence of a favorable recommendation from the committee;
2. The committee shall have the sole authority to recommend the appointment of
directors to, or the removal of directors from, the Independent Privacy Committee, such
that Respondent’s Board of Directors may not approve any such appointment or removal
in the absence of a favorable recommendation from the committee; and
3. The committee shall determine whether the members of the Independent Privacy
Committee qualify as Independent Directors and whether each member of the Independent
Privacy Committee meets the Privacy and Compliance Baseline Requirements. The
foregoing determinations shall be made prior to, or concurrent with, the formation of the
Independent Privacy Committee for the initial members; and prior to, or concurrent with,
the appointment of each new director to the Independent Privacy Committee for future
members;
C. Within one hundred and eighty (180) days after entry of this Order, Respondent shall
adopt and file an amendment to Respondent’s Certificate of Incorporation (the “Charter
Amendment”) in accordance with applicable Delaware law modifying the provisions of Article
VI, Section 4 thereof with respect to the removal of directors as set forth in the form attached
hereto as Exhibit 1, for the purpose of adding a new Article VI, Section 4(b) (hereafter
“Supplemental Removal Provision”). Respondent shall not further alter or amend the
Supplemental Removal Provision of Respondent’s Certificate of Incorporation for the term of the
Order. Notwithstanding the foregoing, in the event that, prior to the effectiveness of the Charter
Amendment, any person commences any legal or administrative proceeding or action (an
“Action”), or any governmental or regulatory entity or body, or any court, tribunal, or judicial
body, in each case whether federal, state, or local, issues or grants any order, judgment, decision,
decree, injunction, or ruling that has the effect of delaying, restraining, enjoining, prohibiting, or
otherwise preventing the approval, filing, or effectiveness of the Charter Amendment
(individually or collectively, a “Restraint”) within 180 days after entry of this Order, that time
period shall be extended and Respondent shall be deemed to be in compliance with the Order so
long as: (a) Respondent diligently pursues in good faith the favorable resolution of such Action,
and (b) Respondent adopts and files the Charter Amendment in accordance with applicable
Delaware law as promptly as reasonably practicable following the resolution of the Action and at
such time as such Restraint (if any) is withdrawn, vacated, or terminated; and
D. Nothing in this Order shall be construed to expand, modify, or alter the fiduciary duties of
the members of the Respondent’s Board of Directors or any committee thereof.
XI. CERTIFICATIONS
A. Within forty-five (45) days after the end of each full fiscal quarter (but in no event later
than the first meeting of the Independent Privacy Committee with respect to such fiscal quarter (as
provided in Part X.A)) following the anniversary of the effective date of this Order, provide the
Commission with its certification, signed by the Principal Executive Officer and the Designated
16
Compliance Officer(s) on behalf of Respondent, that, with respect to such fiscal quarter: (1)
Respondent has established, implemented, and maintained a Privacy Program that complies in all
material respects with the requirements of Part VII of this Order; and (2) Respondent is not aware
of any material noncompliance with Part VII that has not been corrected or disclosed to the
Commission. In making this certification on behalf of Respondent, the Principal Executive
Officer shall rely, and be entitled to rely, solely on the following: (a) his or her personal
knowledge; (b) sub-certifications regarding compliance with Part VII, provided by knowledgeable
personnel charged with implementing the Privacy Program; and (c) the Principal Executive
Officer’s review of the summaries in the Quarterly Privacy Review Report required under Part
VII.E.2.c.(i) for such fiscal quarter, as well as any material issues raised in Covered Incident
Reports required under Part IX for such fiscal quarter. The Designated Compliance Officer(s)
shall rely, and be entitled to rely, solely on the following: (a) his or her personal knowledge; (b)
sub-certifications regarding compliance with Part VII, provided by knowledgeable personnel
charged with implementing the Privacy Program; (c) material issues identified in the Quarterly
Privacy Review Report required under Part VII.E.2.c.; and (d) material issues raised in the
Covered Incident Reports required under Part IX for such fiscal quarter; and
B. Within forty-five (45) days after the end of the first full fiscal quarter (but in no event later
than the first meeting of the Independent Privacy Committee with respect to such fiscal quarter (as
provided in Part X.A.)) following the anniversary of the effective date of this Order and every
year thereafter, provide the Commission with its certification, signed by the Principal Executive
Officer and the Designated Compliance Officer(s) on behalf of Respondent, that: (1) Respondent
has established, implemented, and maintained the requirements of this Order in all material
respects; and (2) Respondent is not aware of any material noncompliance with this Order that has
not been corrected or disclosed to the Commission. In making this certification on behalf of
Respondent, the Principal Executive Officer shall rely, and be entitled to rely, solely on the
following: (a) his or her personal knowledge; (b) sub-certifications regarding compliance with
Part VII of this Order, provided by knowledgeable personnel charged with implementing the
Privacy Program; and (c) the Principal Executive Officer’s review of the written program required
under Part VII.A. of this Order and the summaries in the Quarterly Privacy Review Reports
required under Part VII.E.2.c.(i) for the preceding year, as well as any material issues raised in
Covered Incident Reports required under Part IX for the preceding year. The Designated
Compliance Officer(s) shall rely, and be entitled to rely, solely on the following: (a) his or her
personal knowledge; (b) sub-certifications regarding compliance with Part VII, provided by
knowledgeable personnel charged with implementing the Privacy Program; (c) material issues
identified in the Quarterly Privacy Review Reports required under Part VII.E.2.c. for the
preceding year; and (d) material issues raised in the Covered Incident Reports required under Part
IX for the preceding year.
Unless otherwise directed by a Commission representative in writing, Respondent shall submit all
certifications to the Commission pursuant to this Order via email to [email protected] or by
overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington,
DC 20580. The subject line must begin, “In re Facebook, Inc., FTC File No. 182-3109.”
17
XII. ORDER ACKNOWLEDGMENTS
A. Respondent, within seven (7) days of entry of this Order, must submit to the Commission
an acknowledgment of receipt of this Order sworn under penalty of perjury;
B. For five (5) years after entry of this Order, Respondent must deliver a copy of this Order
to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees
having managerial responsibilities for conduct related to the subject matter of the Order and all
agents and representatives who participate in conduct related to the subject matter of the Order;
and (3) any business entity resulting from any change in structure as set forth in the Part titled
Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for
current personnel. For all others, delivery must occur before they assume their responsibilities;
and
C. From each individual or entity to which Respondent delivered a copy of this Order,
Respondent must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of
this Order.
A. One hundred eighty (180) days after entry of this Order, Respondent must submit a
compliance report, sworn under penalty of perjury, which: (1) identifies the primary physical,
postal, and email address and telephone number, as designated points of contact, which
representatives of the Commission may use to communicate with Respondent; (2) identifies all of
Respondent’s businesses by all of their names, telephone numbers, and physical, postal, email,
and Internet addresses; (3) describes the activities of each business; (4) describes in detail whether
and how Respondent is in compliance with each Part of this Order; and (5) provides a copy of
each Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the
Commission;
B. For twenty (20) years after entry of this Order, Respondent must submit a compliance
notice, sworn under penalty of perjury, within fourteen (14) days of any change in the following:
(1) any designated point of contact; (2) Respondent’s corporate structure; or (3) the structure of
any entity that Respondent has any ownership interest in or controls directly or indirectly that may
affect compliance obligations arising under this Order, including: creation, merger, sale, or
dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices
subject to this Order;
C. Respondent must submit to the Commission notice of the filing of any bankruptcy petition,
insolvency proceeding, or similar proceeding by or against Respondent within fourteen (14) days
of its filing;
18
D. Any submission to the Commission required by this Order to be sworn under penalty of
perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I
declare under penalty of perjury under the laws of the United States of America that, to the best of
my knowledge and reasonable belief, the foregoing is true and correct. Executed on: _____” and
supplying the date, signatory’s full name, title (if applicable), and signature; and
XIV. RECORDKEEPING
IT IS FURTHER ORDERED that Respondent must create certain records for twenty (20)
years after entry of the Order, and retain each such record for five (5) years. Specifically,
Respondent must create and retain the following records:
B. Records sufficient to identify the types of Covered Information that Respondent provides
or makes available to any Covered Third Party that is subject to the requirements of Part VII.E.1.,
including records identifying: (1) the specific data fields to which access was granted; (2) the
means by which the information was provided or made available; (3) the identity of the Covered
Third Party to which access was granted; (4) the self-certifications provided by the Covered Third
Party (as described in Part VII.E.1); and (5) the date(s) when access was provided;
E. Each materially different document relating to Respondent’s attempt to obtain the consent
of Users referred to in Part II titled Changes To Sharing Of Covered Information, along with
documents and information sufficient to show each User’s consent; and documents sufficient to
demonstrate, on an aggregate basis, the number of Users for whom each such Privacy Setting was
in effect at any time Respondent has attempted to obtain and/or been required to obtain such
consent;
19
F. All materials relied upon to prepare the Assessment, whether prepared by or on behalf of
Respondent, including but not limited to all plans, reports, studies, reviews, audits, audit trails,
policies, training materials, and assessments, for the compliance period covered by such
Assessment; and
G. All records necessary to demonstrate full compliance with each Part of this Order,
including all submissions to the Commission.
A. Within fourteen (14) days of receipt of a written request from a representative of the
Commission, Respondent must: submit additional compliance reports or other requested
information, which must be sworn under penalty of perjury; appear for depositions; and produce
documents for inspection and copying. The Commission is also authorized to obtain discovery,
without further leave of court, using any of the procedures prescribed by Federal Rules of Civil
Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69;
B. For matters concerning this Order, the Commission is authorized to communicate directly
with Respondent. Respondent must permit representatives of the Commission to interview any
employee or other person affiliated with Respondent who has agreed to such an interview. The
person interviewed may have counsel present; and
C. The Commission may use all other lawful means, including posing, through its
representatives, as consumers, suppliers, or other individuals or entities, to Respondent or any
individual or entity affiliated with Respondent, without the necessity of identification or prior
notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, pursuant
to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.
IT IS FURTHER ORDERED that this Order is final and effective upon the date of its
publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate 20
years from the date of its issuance, or 20 years from the most recent date that the United States or
the Commission files a complaint (with or without an accompanying settlement) in federal court
alleging any violation of this Order, whichever comes later; provided, however, that the filing of
such a complaint will not affect the duration of:
B. This Order’s application to any Respondent that is not named as a defendant in such
complaint; and
20
C. This Order if such complaint is filed after the Order has terminated pursuant to this Part.
Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent
did not violate any Part of the Order, and the dismissal or ruling is either not appealed or upheld
on appeal, then the Order will terminate according to this Part as though the complaint had never
been filed, except that the Order will not terminate between the date such complaint is filed and
the later of the deadline for appealing such dismissal or ruling and the date such dismissal or
ruling is upheld on appeal.
By the Commission.
April Tabor
Acting Secretary
SEAL:
ISSUED:
21
LOCAL RULE 7(k) CERTIFICATION:
Names of Persons to Be Served with Proposed Order
Pursuant to LCvR 7(k), the following attorneys are entitled to be notified of the entry of
the foregoing Stipulated Order:
M. SEAN ROYALL
Gibson, Dunn & Crutcher LLP
2100 McKinney Avenue, Suite 1100
Dallas, TX 75201-6912
phone: (214) 698-3256
fax: (214) 571-2923
email: [email protected]
LISA K. HSIAO
Consumer Protection Branch
U.S. Department of Justice
P.O. Box 386
Washington, DC 20044-0386
phone: (202) 532-4892
fax: (202) 514-8742
email: [email protected]