A billion here and a billion there, and pretty soon you're talking about real money.
Facebook has offered a glimpse of the magnitude of the penalty that it could be facing as it negotiates a settlement with the Federal Trade Commission over improperly offering up users' personal information to the U.K. firm Cambridge Analytica.
How much? Up to $5 billion, a figure that would dwarf any previous settlement the FTC has reached with tech firms involving privacy and their data practices.
In its quarterly earnings report, Facebook posted a charge of $3 billion to account for the potential penalty it will get hit with in a settlement with the FTC. The company said that "the range of loss in this matter" could reach $5 billion.
"The matter remains unresolved, and there can be no assurance as to the timing or the terms of any final outcome," Facebook said in its earnings release.
So even if all the details have yet to be worked out, and even if talks over a deal fall through and the matter ends up getting litigated, it is telling that the FTC appears to be seeking a penalty on that scale.
Facebook, of course, could be considered a recidivist offender in the Cambridge Analytica matter. The firm signed onto a 20-year consent decree with the FTC in 2011, committing to certain privacy protections, including securing users' consent before sharing their information with third parties.
For perspective, in 2012, Google agreed to pay $22.5 million in a settlement over its own violation of a pervious agreement with the FTC, which the agency said at the time was the largest penalty it had ever assessed for a violation of a commission order.
But of all the tech heavyweights, Facebook might have the most baggage with the privacy issue. The firm has had an enduring history of pushing the outer limits of what regulators foreign and domestic will tolerate in terms of how it handles its users' data.
And CEO Mark Zuckerberg's March announcement that he would seek to fundamentally reorient the company around a commitment to user privacy, marked by new sharing limitations and codifying the "right to be forgotten," has been met with a fair measure of skepticism. But in the context of his company negotiating a potentially massive, record-setting settlement with the nation's chief privacy enforcement authority, it's easy to see a political and economic rationale behind the move.
Meantime, Facebook has added to its senior leadership a veteran of the Washington privacy debates. Earlier this week, the company announced that it is bringing on Jennifer Newstead as its general counsel. Newstead, a senior official at the State Department, was a key figure in shepherding the Patriot Act through Congress in the aftermath of the Sept. 11 terrorist attacks. That bill dramatically expanded the government’s surveillance authorities, and helped establish a legal framework that put the government at odds with some leading tech companies, which have protested the bulk collection of metadata about their users under the bill’s authorities.
But for Facebook, Newstead’s hire could signal a new seriousness about the regulatory pressures the company is facing both in the United States and overseas. At the same time, Facebook is also bringing on one of the more prominent critics of the surveillance and data-collection regime created under the Patriot Act in the person of Kevin Bankston, an alum of civil liberties groups like the ACLU and Electronic Frontier Foundation, who is joining the firm as the company’s director of privacy policy in June.
So it is that Facebook heads into a new phase marked by close government scrutiny, it seems to be betting the spread with a diverse legal team. With billions of dollars on the table, that might be wise.
