Facebook promised control over who sees your data — Canada fined the promise $9M

From August 2012 to June 2018, Facebook told Canadians on Facebook and Messenger that they controlled who could see and access their personal information — through the Privacy Settings page, the About page and the audience selector. The Competition Bureau concluded the claim was false or misleading: personal information, including posted content and Messenger exchanges, was shared with some third-party developers in ways those controls did not reflect.

One claim had an expiry date Facebook did not honour. It said third-party developers could no longer access a user's friends' personal information after 30 April 2015; the Bureau found the practice continued with some developers into 2018. On 19 May 2020 Facebook signed a consent agreement: a $9 million penalty plus $500,000 for the Bureau's costs, and a bar on false or misleading representations about how personal information is disclosed.

The case made privacy claims an advertising matter in Canada: what a company says about its data practices is a claim to consumers, enforceable like any other. Facebook settled while disputing the conclusions. Commissioner Matthew Boswell's line: claims about privacy are no exception to the rule that Canadians deserve truth from businesses.