A lot of the terms of the settlement deal with organizational changes, but when you look at the very specific privacy restrictions that Facebook agreed to, it's really, really problematic stuff:

* Facebook is prohibited from using telephone numbers obtained to enable a security feature (e.g., two-factor authentication) for advertising;

* Facebook must provide clear and conspicuous notice of its use of facial recognition technology, and obtain affirmative express user consent prior to any use that materially exceeds its prior disclosures to users;

* Facebook is prohibited from asking for email passwords to other services when consumers sign up for its services.

This might, at first blush, seem like a win for users, but consider it from a different perspective.

When a settlement involves promising not to do a bunch of really, really bad stuff, that typically means the settlement doesn't have much bite. It's comparatively easy for a company to agree not to do egregiously bad things, and comparatively harder for it to agree not to do things that are still problematic, but less egregious.

These things that Facebook has agreed to not do are way outside the boundaries of ethical privacy practices -- but there's still a ton of gray area that remains unaddressed.

So from Facebook's perspective, this is probably a big win. The settlement allows the company to give the appearance of taking concrete steps to respect users' privacy. But what it might actually mean is that there were many other less egregious privacy violations that it was able to slip past the FTC's judgment.