The Federal Trade Commission voted Friday to finalise its settlement with Facebook, resolving charges that the social network exposed details about users' lives without getting the required legal consent.
Facebook Inc. agreed to submit to government audits of its privacy practices every other year for the next two decades. The company also committed to getting explicit approval from users before changing the types of content it makes public.
The settlement, announced in November, is similar to agreements the FTC reached separately with Google Inc. and Myspace.
The FTC approved the settlement Friday after a public comment period. It came a day after the FTC fined Google $22.5 million to resolve allegations that Google didn't comply with the earlier settlement.
Facebook didn't admit any wrongdoing in the settlement, though CEO Mark Zuckerberg conceded in November that the company had made "high-profile mistakes" on privacy over the years.
Both Facebook and Google have vast amounts of data on their users - Facebook through the things people share on the site, and Google through the searches and other things people do. Such information is valuable because it can be used to improve the lucrative targeted advertising pitches that both companies aim at users.
Over the years, Facebook has been pushing users to voluntary share more about themselves. That ultimately encourages users and their friends to spend more time on the site, which in turn allows Facebook to sell more ads. Although Facebook boasts that it gives users a variety of software settings so they can decide which photos, links and updates to share with whom, the company changes those options on a regular basis.
Much of the FTC's complaint against Facebook centres on a series of changes that the company made to its privacy controls in late 2009. The revisions automatically shared information and pictures about Facebook users, even if they previously programmed their privacy settings to shield the content. Among other things, people's profile pictures, lists of online friends and political views were suddenly available for the world to see, the FTC alleged.
The complaint also charges that Facebook shared its users' personal information with third-party advertisers from September 2008 through May 2010 despite several public assurances from company officials that it wasn't passing the data along for marketing purposes.
Facebook believes that happened only in limited instances, generally when users clicked on ads that appeared on their personal profile pages. Most of Facebook's users click on ads when they are on their "Wall" - a section that highlights their friends' posts - or while visiting someone else's profile page.
Under the settlement, Facebook must get explicit consent - a process known as "opting in" - before making changes that override existing privacy preferences. The company also may not make misrepresentations about the privacy or security of users' personal information - a broad clause that led to Google's fine on Thursday.
Violations will be subject to civil penalties of up to $16,000 per day for each infringement.
The FTC approved the settlement 3-1, with one commissioner not participating. Commissioner J. Thomas Rosch dissented, as he did with the Google deal on Thursday, partly because it didn't require an admission of wrongdoing. He also worried the settlement was too vague on whether it applied to Facebook apps written by outside parties. The three commissioners who approved the deal believe it covers apps.
Facebook had no comment beyond a statement that it is pleased the settlement received final approval.
Facebook's stock gained 80 cents, or 3.8 percent, to close Friday at $21.81. The company, based in Menlo Park, Calif., began trading publicly in mid-May, after the settlement with the FTC was reached. The stock is now trading 43 percent below its initial public offering price of $38.