Facebook vs the feds: The tech giant will have to pay a record fine for violating users’ privacy. But the FTC wanted more.

The package of penalties for Facebook’s past privacy scandals includes a record-breaking $5 billion fine and unprecedented government oversight of its business practices. But a review of the 16-month investigation — described by 10 people familiar with the matter — shows that the Federal Trade Commission stopped short of some even tougher punishments it initially had in mind. Those included fining Facebook not just $5 billion, but tens of billions of dollars, and imposing more direct liability for the company’s chief executive, Mark Zuckerberg. Facebook, however, fiercely resisted the government’s demands, and in the end, the FTC, facing a formidable foe whose $55 billion in revenue in 2018 amounted to almost 200 times the budget afforded to the federal regulators, settled for less.

The experience illustrates the challenges facing a 105-year-old agency hamstrung in the kinds of penalties it can pursue by the nation’s lack of a national consumer privacy law. While some lawmakers bemoan the FTC’s inability to punish Facebook, Congress has yet to advance legislation that would give the FTC a stronger hand as it confronts some of the most profitable corporations in the global economy. Under the settlement, which has not yet been made public, Facebook is expected to submit to heightened federal scrutiny. It could be required to certify — through its executives as well as its board of directors— that it is considering privacy risks when it collects information, taps it in new ways or makes it accessible to third parties, including app developers.