FTC Proposes Blanket Prohibition Preventing Facebook from Monetizing Youth Data

The Federal Trade Commission (FTC) proposed changes to the agency’s 2020 privacy order with Facebook after alleging that the company has failed to fully comply with the order, misled parents about their ability to control with whom their children communicated through its Messenger Kids app, and misrepresented the access it provided some app developers to private user data. As part of the proposed changes, Meta, which changed its name from Facebook in October 2021, would be prohibited from profiting from data it collects, including through its virtual reality products, from users under the age of 18. It would also be subject to other expanded limitations, including in its use of facial recognition technology, and required to provide additional protections for users. This is the third time the FTC has taken action against Facebook for allegedly failing to protect users’ privacy. This action by the FTC alleges that Facebook has violated the 2020 order, as well as the Children’s Online Privacy Protection Act Rule (COPPA Rule). The proposed changes to the 2020 order, which would apply to Facebook and Meta’s other services such as Instagram, WhatsApp, and Oculus, include:

• Blanket prohibition against monetizing data of children and teens under 18: Meta and all its related entities would be restricted in how they use the data they collect from children and teens
• Pause on the launch of new products, or services: The company would be prohibited from releasing new or modified products, services, or features without written confirmation from the assessor that its privacy program is in full compliance with the order’s requirements and presents no material gaps or weaknesses.
• Extension of compliance to merged companies: Meta would be required to ensure compliance with the FTC order for any companies it acquires or merges with, and to honor those companies’ prior privacy commitments.
• Limits on future uses of facial recognition technology: Meta would be required to disclose and obtain users’ affirmative consent for any future uses of facial recognition technology. 
• Strengthening existing requirements: Some privacy program provisions in the 2020 order would be strengthened, such as those related to privacy review, third-party monitoring, data inventory and access controls, and employee training.

The independent assessor, tasked with reviewing whether the company’s privacy program satisfied the 2020 order’s requirements, identified several gaps and weaknesses in Facebook’s privacy program, according to the Order to Show Cause, in which the Commission notes that the breadth and significance of these deficiencies pose substantial risks to the public. The Commission voted 3-0 to issue the Order to Show Cause.