Facebook faces pivotal decision in settlement talks with FTC, as Google did in 2012

As Facebook prepares to mark the unhappy one-year anniversary of its acknowledgement of the Cambridge Analytica privacy leak, the company faces a fateful and difficult legal decision.

Facebook is believed to be attempting to negotiate a settlement with the US Federal Trade Commission over claims the Cambridge Analytica breach was a violation of the terms of an existing privacy consent decree, a pact that would be a record settlement that former FTC officials say could reach $1 billion and would easily eclipse the record $22.5 million Google paid  in 2012 to settle claims it violated its FTC consent decree.

Under standard FTC procedure, lawyers in the agency’s enforcement division would have already delivered a proposed legal complaint and settlement document to Facebook. The two sides are having daily conversations by phone or in person — debates really — about what Facebook did, how its business practices must change and what penalty it must pay. The process could easily last for months.

Facebook has insisted from the beginning that it didn't violate its consent decree by misleading its users about how it shares data with third parties. Now, it's approaching the fateful fork in the road where it must choose between two paths, only one of which involves maintaining that stance.

On one path, Facebook could settle, pay a civil fine and accept injunctive changes to its business, as well as consequences that could spill into existing litigation in US and California courts over Cambridge Analytica, and investigations by other state and federal regulators.

On a second path, Facebook could maintain that its conduct was lawful and allow the FTC to sue, likely in US District Court in San Francisco or San Jose, California. Facebook would be able to defend itself on its home turf.  It could theoretically walk away with no penalty at all. But that move would carry risk: A federal judge or jury would determine whether Facebook is liable, with a judge then having wide latitude to impose a potentially massive penalty on the Menlo Park, California, company.

The dynamics of a privacy settlement in the US are unlike other parts of the world. Unlike Europe, where data protection authorities under the General Data Protection Regulation can impose privacy fines, the FTC lacks the authority to unilaterally impose penalties. It must get a defendant to agree to pay the fine or go to court and convince a federal judge or jury that the company is liable.

Filing a lawsuit in one sense could be the easy way out for the FTC, in that it would shift the political pressure to punish Facebook to a court of law. Facebook’s potential liability in a trial is extremely difficult to compute, but if a judge were to rule under the Federal Trade Commission Act that there had been a “continuing failure to obey or neglect to obey a final order” of the FTC by Facebook, the company could face a penalty of $10,000, multiplied by factors under the Federal Civil Penalties Inflation Adjustment Act.

But given that Facebook’s potential exposure would appear to be limited to the effective date of its FTC consent decree in 2012, and the 2014 date when it changed its data-sharing policies, it’s hard to see how Facebook could face $1 billion in penalties.

— Google talks —

Don’t count on Facebook settlement immediately. In the Google settlement in 2012, arguably a far less complex situation with less revenue at issue than in Facebook’s case, talks lasted for more than two months. By the FTC’s standards, that was a lightening-quick resolution.

Over a period of months with Google, “the parties engaged in frequent, often daily, debates over the details of the settlement,” FTC lawyer Megan A. Bartley said in a court filing in 2012.

Similar daily conversations are likely happening today between the FTC’s enforcement division and Facebook. Back in 2012, a study by the FTC’s Bureau of Economics found that Google had profited by no more than $4 million from its decision to modify Apple’s Safari browser to make it easier to track Safari users for advertising purposes.

The FTC has almost certainly commissioned a similar study by its economists to measure how much Facebook profited from the liberal data-sharing policies the company had prior to 2014, which arguably led to the Cambridge Analytica leak.

The FTC in 2012 considered a stronger penalty against Google, including blocking the search and advertising giant from setting certain types of cookies on users’ web browsers, according to court filings in that case. But, just as it is no doubt doing with Facebook, the FTC had to balance what it wanted with what it could get from Google in the settlement talks.

Ultimately, the FTC elected to allow Google to settle and pay $22.5 million without making those cookie changes and while still denying liability for its actions with Safari — drawing the dissent of one member of the commission and legal challenges from critics.

— Facebook risks —

Facebook’s executives and the company’s legal team are likely making the same sorts of legal calculations now on decisions that are more involved than just paying a civil penalty of $1 billion or more.

Facebook’s lawyers are likely exploring whether the company could settle without accepting liability, as Google did in 2012, a decision that drew legal challenges from Consumer Watchdog and Silicon Valley lawyer Gary Reback. The FTC imposed only temporary, not permanent, injunctive relief on Google. Facebook would no doubt seek a similar outcome.

Facebook also must consider other pieces on a highly complicated legal chessboard. Facebook’s early defense of class-action litigation on the Cambridge Analytica affair in US District Court in San Francisco could hardly be going better. Facebook would not want to muck that up. Earlier this month, Facebook users suing over the Cambridge Analytica scandal were forced to amend their claims after a federal judge questioned what right to privacy Facebook users had if their default privacy settings were public.

This month, US District Judge Vince Chhabria expressed doubt that Facebook users have sufficiently claimed they were injured by the Cambridge Analytica leak.  Chhabria encouraged the plaintiffs to add more specific details about how Facebook users were harmed. “Well before a year, you’ll have a ruling on whether you have a case or not,” the judge told the plaintiffs at a recent hearing.

Facebook wouldn't want to agree to a settlement that admitted to practices that would give ammunition to the plaintiffs in that case, or to those in another case being heard in a California state court in San Mateo County aimed at forcing changes to Facebook’s business practices.

Facebook is also being investigated by the US Securities and Exchange Commission and multiple state attorneys general over the Cambridge Analytica privacy leak. It will not want to admit to practices, as part of any settlement, that could harm its standing in those probes.

— FTC risks —

There is also pressure on the FTC to settle.

The agency has limited resources. Gearing up for a protracted court fight against Facebook, an opponent with essentially bottomless pockets, would be a huge risk for the FTC — the agency could come away with nothing if it loses in court. Settling rather than litigating would free up resources for the FTC to pursue other cases, particularly if the FTC could trumpet a record civil penalty paid by Facebook.

Negotiating settlements is a tricky business for the FTC staff, which is sandwiched between the defendant and the politically appointed commissioners, whose support the staff must have. The FTC’s standard practice is to draft a proposed initial order and send it to the defendant, such as Facebook, to begin settlement negotiations.

With critics like US Senator Richard Blumenthal, a Connecticut Democrat, saying the FTC has “been asleep at the switch” on privacy, and a new member, Commissioner Rohit Chopra, who has been vocal about avoiding settlements that don’t include a significant financial penalties, the FTC staff is certainly under massive pressure in the Facebook case as well.

The FTC staff also would want to structure a settlement that won’t draw a legal challenge from critics, as the $22.5 million Google settlement did.

While that settlement was ultimately approved by US District Judge Susan Illston, who found it “both procedurally and substantively fair, adequate, and reasonable”, the FTC must consider the chances of challenges to a settlement, given Facebook’s growing list of critics.

A judge’s rejection of a Facebook settlement would be a nightmare scenario for the FTC.