Facebook broke its own 2012 privacy promise to the FTC — the fine was $5 billion

In 2012 Facebook settled with the FTC over an earlier privacy complaint and agreed to an order requiring clear disclosure of how user data was shared and used. In 2019 the FTC found Facebook had violated that order in multiple ways: misrepresenting how much control users actually had over their privacy settings, and misrepresenting what data it made accessible to third-party app developers.

The clearest violation was continuing to let app developers pull data on a user's Facebook Friends well past 2014, the date Facebook had told the FTC this access would end — in some cases the access lasted through June 2018. The FTC also found Facebook enforced its own developer policies inconsistently, going easier on developers who generated significant revenue, and that it had taken phone numbers users provided for two-factor authentication and used them for ad targeting instead.

The FTC's order, filed 24 July 2019, imposed a $5 billion civil penalty — a record at the time and equivalent to about 9% of Facebook's 2018 revenue — plus new privacy-governance requirements including outside assessment of its data practices. The order affected roughly 210 million American Facebook accounts.