In the settlement reached with the FTC, Facebook has agreed to obtain users’ express consent before sharing their information beyond their privacy settings, maintain a comprehensive privacy program to protect consumers' information, and conduct biennial privacy audits by an independent third party.
Going forward, Facebook will be liable to civil penalties of up to $16,000 for each violation of the order, which wil last for 20 years.
“The order broadly prohibits Facebook from misrepresenting in any manner, expressly or by implication, the extent to which it maintains the privacy or security of any information it collects from or about consumers. For a company whose entire business model rests on collecting, maintaining, and sharing people’s information, this prohibition touches on virtually every aspect of Facebook’s operations”, the commission said in a statement.
The preliminary settlement was first reached in November of last year. The settlement concluded investigations begun by the FTC in 2009 when Facebook changed settings to expose user profiles and activities to a wider audience and leaving it up to users to reinstate more conservative privacy settings.