Facebook’s $5 Billion FTC Privacy Penalty Explained

The FTC said Facebook broke a 2012 privacy order and misled users about control of their data.

By Siddharth ShankarUpdated October 24, 2026

Few privacy cases have been as large as this one. This guide sticks to what the FTC itself said in its July 2019 announcement.

The penalty

Facebook agreed to what the FTC called a “record-breaking $5 billion penalty”. The FTC said it was the largest ever imposed on any company for privacy violations and almost 20 times greater than the largest privacy or data security penalty ever imposed worldwide. For comparison, the FTC’s chart listed earlier large penalties including $148 million for Uber (states), $230 million proposed for British Airways and $275 million for Equifax (CFPB and states). The order is a 20-year order. The Commission voted 3-2 to refer the complaint and order to the Department of Justice, with Commissioners Rohit Chopra and Rebecca Kelly Slaughter dissenting.

What the FTC alleged

The FTC said Facebook violated a 2012 FTC order by deceiving users about their ability to control their personal information. The main allegations were:

• Privacy settings. Facebook removed a disclosure about app sharing four months after the 2012 order was finalised. Later tools, such as Privacy Shortcuts and Privacy Checkup, allegedly did not disclose that friends’ data could still go to apps.
• Third-party apps. Facebook allegedly shared friends’ data with app developers even when those friends had restrictive settings. It allegedly did not screen developers before giving access and enforced its policies inconsistently. It allegedly kept sharing friend data until at least June 2018.
• Phone numbers. Facebook allegedly collected phone numbers for a security feature such as two-factor authentication, but did not disclose that it used them for advertising.
• Facial recognition. The Tag Suggestions setting was allegedly on by default, and an April 2018 data policy allegedly misrepresented that users had to opt in.

What the order requires

The FTC listed these main terms:

• An independent board privacy committee, with members chosen by an independent nominating committee, to remove CEO Mark Zuckerberg’s unchecked control over privacy decisions. Members can only be removed by a board supermajority.
• Designated compliance officers to run the privacy program, approved and removable by the privacy committee.
• Quarterly compliance certifications and an annual overall certification by Mr Zuckerberg and the compliance officers, with individual civil and criminal penalties for false certifications.
• An independent assessor who conducts biennial reviews based on independent testing and reports quarterly to the privacy committee.
• Privacy review of new or modified products before launch, with decisions documented.
• Documentation of incidents affecting 500 or more users, delivered to the FTC and the assessor within 30 days of discovery.
• Oversight of third-party apps, a ban on using security-collected phone numbers for advertising and notice and consent before facial recognition goes beyond earlier disclosures.
• A comprehensive data security program, encrypted passwords and scans for plaintext passwords, and a ban on requesting email passwords from other services at sign-up.

What it means for you as a user

The case shows how data can travel through apps connected to an account, even when you did not use those apps yourself. It also shows that the “friends” setting can be as important as your own. Review the apps and websites connected to your account and remove any you do not use. Our guide to off-Facebook activity explains how to see which businesses share data about you, and how to make Facebook private walks through the main privacy settings.

Practical steps

1. Review connected apps in your account settings and remove old ones.
2. Tighten who can see your friends list and posts. See how to hide your friends list on Facebook.
3. Check face recognition and tagging settings if they are available in your region.
4. Prefer an authenticator app for two-factor authentication, as the same phone number concerns appeared in the Twitter case.
5. Know what leaves the platform. Read how People You May Know finds you.

Outside the United States

Regulators in Europe have also acted against the company; see the Irish DPC’s €265 million decision.