Judge approves Facebook's settlement with FTC over ‘stunning’ privacy violations | Hacker News Reader

Judge approves Facebook's settlement with FTC over ‘stunning’ privacy violations

lawandcrime.com

151 pointsgreenyoda76 comments

It's interesting that the site presenting this story has, by their own declaration, 382 different marketing-related cookies, which you are required to accept with no alternatives if you want to browse the site.

I'm not trying to say that they are not entitled to report on FB's privacy violations or something, they are reporters and it is very good that they are doing so.

It's just amazing to what extent journalism sites are trying to monetize. Old newspapers could only dream of the kind of advertising revenue that sites like this probably have.

I think it's the opposite, there are so many trackers because each time they sell it their user's data parmys so little .

"Old newspapers could only dream of the kind of advertising revenue that sites like this probably have."

Actually they are struggling for ad revenue hence all the third party crud in their web pages.

Many of them allege that companies like Facebook and Google have "stolen" their ad revenue. Some complained of Craigslist taking away their classified ads business.

Old newspapers, particularly local ones, are going out of business thanks to competition from ad-supported websites that operate as middlemen for news delivered via internet, not to mention the impact of Covid-19.

https://en.wikipedia.org/wiki/Decline_of_newspapers

https://www.poynter.org/business-work/2020/here-are-the-news...

> Old newspapers are going out of business thanks to competition from ad-supported websites that operate as middlemen for news delivered via internet.

And when the newspaper goes out of business, will the aggregators just sprout newsrooms to replace their free sources of information? I doubt it.

Aggregation of news only works if there's news to aggregate. We have already seen local and hyperlocal news wither on the vine, and Google hasn't exactly expressed interest in sending someone down to the local courthouse or county meeting.

You're arguing a different point than the person you're responding to. You're correct of course, on the point that aggregators only function so long as they have content to aggregate. But that doesn't mean that aggregators don't also promote further market consolidation. I don't think many people are arguing that publications like AP, Bloomberg, NYT, Reuters, Fox News (I know I know, but you can't pretend they aren't a major org), CNN, etc. are dying. What's dying is /local/ newspapers that might not offer robust world views but nonetheless often represent the most comprehensive source for stories of local significance like police controversies, local government corruption, community happenings, etc.

NYT has flirted with death before. The Chicago Tribune went through the bankruptcy wringer. Just this year the owner of several regional newspapers, also the second-largest newspaper chain in the country, declared bankruptcy: https://www.cnn.com/2020/02/13/media/mcclatchy-bankruptcy/in... The first biggest was merely acquired.

AP isn't a publication, it's a co-op association that syndicates stories, so it actually also suffers from the aggregators' problems.

> And when the newspaper goes out of business, will the aggregators just sprout newsrooms to replace their free sources of information? I doubt it.

Well that's the longer term problem. Eventually because they run out of real news sources, they have to start regurgitating -some- form of content.

You see it with some of the 'news' sites for tech, especially the 'older' ones. At some point (usually after original owners have left, as they were the ones with a passion for actual journalism) you see the content goes from investigative and genuinely curious to a state where you can tell that just about every article was a regurgitated PR.

IOW in the long term this is a bad thing, as it means that you'll see more 'sponsored' news in the future.

For newspapers: Ask for donation or promote subscriptions, almost no one will mind, but don't spam us with ads and tracking, without consent. Then we can talk. Unless you honest up, there is nothing we will talk about.

I disagree.

If you're speaking about people on HN, then you're possibly right. (Debatable how much though)

But people in general will mind being asked to open their wallets, to enter their payment details into a website that they don't want to trust with sensitive info while they don't mind seeing (and ignoring) a few ads.

Actually I was only taking about myself and how I see it, but perhaps this view is more prevalent on HN than in other communities, yes. I'd like to think that is, because people on HN are more technical and more informed about how this stuff works, than the average Internet visitor.

Anyway, they could offer people to support them for example via GNU Taler, which aims to keep the "buyer" anonymous and the seller not anonymous, so the problem of entering payment detail is out of the way, using a free software solution.

Historically, advertising has always been the main source of income for almost all non-state news organizations, so I don't see any reason to think a non-advertising model would work on the Internet.

It's not journalism, it's the web. Every protocol and layer in the stack has been subverted to the will of advertisers and trackers. The whole platform is a total nightmare. The standards bodies were completely subverted by corporations, most notably the W3C.

When I try to explain to young people that I spent years browsing the web before there was any advertising at all on it they often don't believe me.

I use Brave. What advertising?

Most big websites are now in this state.

AdBlock uMatrix etc. Use the tools to remove these.

Life is so much better on the Web without being bombarded by banners.

I've not seen an ad in over 2 and a half years.

In the absense of capital punishment for corporations, fines can and will be seen as merely the cost of doing business. It feels like the only way to address this is by holding the decision makers (executives) responsible, but that would require piercing the corporate veil[1], which has disappointingly low precedent in the US

[1]Edit: piercing the veil refers to holding shareholders responsible, which is a different (but related) way of keeping companies accountable. Thanks for the clarification wnoise.

>In the absense of capital punishment for corporations

That's an interesting analogy that I've never considered, given we treat corporations as personlike entities. Why don't we have a capital punishment equivalent?

Perhaps our rules regarding social harm are too loose. But I'm not sure that I would trust a government, especially our government, to make and enforce the right rules.

In any case our legislation desperately needs to catch up to the tech. Communication has changed exponentially for the last few hundred years - printing, radio, telephone, television, cell phone, dialup, cable, smartphone, gigabit...many of our laws are simply not written for an era where decentralized communication of this bandwidth and latency is possible. Article is case in point.

It does exist. The state can cause an involuntary dissolution of your corporation [0] if circumstances dictate. That would include such things as not paying your corporate taxes.

[0] https://www.upcounsel.com/involuntary-dissolution

"Why don't we"

Way too many people ask "why don't we" before figuring out what they are talking about.

Arthur Andersen got the death penalty. If you point that out, people will argue with you, no the death penalty would be something different.

It doesn't matter what you think a word or phrase means, you should have a good idea of what you mean by it before advocating it.

What? I'm identifying a need and a possible solution. Now we have a civil discussion with the goal of exchanging information.

Sorry if I sounded hostile, but I'm saying that when you use a phrase and assume everyone knows what it means just because everybody uses it, that's not identifying a solution and it's not a starting point for a discussion.

I'd love to have a discussion about the corporate death penalty, as long as it's based on some concrete idea of what it is and why it should help.

It's a topic that comes up over and over and I wouldn't even comment if I wasn't interested in something substantive and different from the norm.

Corporate charters can be revoked. It doesn't happen because of the jobs factor but in theory it can be.

We punish corporations in ways which adversely impact jobs all the time, even though we don't do charter revocation.

True, but once you start applying that at the level of Facebook the jobs factor starts to really add weight.

Personally I'd much prefer executives to become automatically liable for wrongdoing by their companies.

> That's an interesting analogy that I've never considered, given we treat corporations as personlike entities. Why don't we have a capital punishment equivalent?

We do, it's called charter revocation. It's basically never done any more because even though the corporate form is a privilege granted by the public, it's become essentially an unconditional gift.

Piercing the corporate veil is a different thing, connecting the corporation to its owners (e.g. stockholders for public corporations, or the conglomerate for subsidiaries.)

Who are the owners of big public corporations?

If you have an IRA, maybe you're an owner of Facebook as part of an index fund.

But do you really own the fund? Or does the broker/bank own it for you?

Does the index fund manager own the stock, such as Vanguard or Blackrock? Or is it really owned by The Depository Trust & Clearing Corporation for the fund?

It means holding employees, directors, CEO... Responsible for their actions instead of the company.

The shareholders only come into play in they work for the company.

> fines can and will be seen as merely the cost of doing business

There's nothing inherently wrong with that.

The answer, of course, is that fines can be increased to the point where businesses change.

Just recently, Amazon was forced to completely shut down in France because the level of fines made it impossible to run their business at all.

Businesses respond to incentives. Fines are an incentive. They can be set at any level. It's the responsibility of government to figure out the right level.

Also, finding the executives responsible for any decision is not nearly as clear-cut as you might suppose. Ultimately shareholders are responsible. Then they elect a board which elects the C-suite which hires the VP's who staff their divisions and so on. And approvals happen at every level but with varying degrees of granularity and attention.

The C-suite will collectively sign off on a strategic plan for the following year. Different members are aware of implementation details at different levels. There's very often no clear "the buck stops here" for any policy except ultimately with the shareholders themselves. (A manager approved the plan, but final sign-off was with their VP, but that was part of the package presented to the CEO, who brought it to the board...) Which is why fines work well -- they punish the shareholders.

This sounds pathological. Why have different C suites if none takes responsibility for anything that happens on their watch?

If this is really an inevitable state then perhaps the only solution is to limit the size of companies: by head count and market power.

So cripple American companies, making it impossible to compete with countries that don't have the same restriction?

The only issue with the fines in this country is that they are too low to actually affect behavior. There is definitely a number that would be effective.

> It's the responsibility of government to figure out the right level.

Which is simply impossible when companies openly pay legislators millions of dollars not to.

Rather than a outright death sentence for a corp, something like a 30 day "timeout" would be interesting. No network traffic for 30 days, in or out. Would a 30 day loss of service be equivalent to a death sentence? We know certain companies can survive hours to up to a day without service just due to tech glitches. After 30 days, people would be suffering withdrawal like symptoms, but would start using the service as soon as it came back. It's not like a FB replacement could start up in 30 days and acquire their users.

This of course would incur collateral damage from companies that "require" offending service to operate.

I think even if we had a corporate “death penalty”, companies would find a way around it with help from the government.

A great example is Pfizer’s punishment for off-label marketing. In addition to fines, the gov’t can ban a company from doing business with Medicare and Medicaid. That’s a death knell for a company as those public insurers typically pay for half of all drugs.

So what did the gov’t do? They did ban the manufacturer! But which one? Oh yeah, the empty shell company called Pharmacia and Upjohn (which Pfizer has acquired years earlier and stripped of products).[1]

So everyone is happy! Government mets out a ban and the company can pay the fine and go back to business as usual.

[1]http://narpa.org/reference/pharma_too_big_to_nail

> In other words, this had better be the end of Facebook’s shenanigans, or the FTC won’t be the only one to drop the hammer.

Pretty much no-one expects this to be the end of Facebook's "shenanigans".

So, what's suitable for the next go around?

it's frustrating. 5 billion for a fine over the course of 8 years of operation?

They made $17 billion this quarter.

The judge did threaten Facebook with harsher treatment if they ever ended up in his court again.

From the end of the court decision:

> The Court ends by noting that under the Stipulated Order it retains jurisdiction over this matter, including to enforce its terms. See Stipulated Order at 5. In the event that the parties return to this Court because the United States alleges—once again—that Facebook has reneged on its promises and continued to violate the law or the terms of the amended administrative order, the Court may not apply quite the same deference to the terms of a proposed resolution. As the D.C. Circuit has explained, a district court must be especially deferential “when the proposed decree comes to a district judge in the first instance as a settlement between the parties.” Microsoft, 56 F.3d at 1461. But, on the other hand, when “a district judge has administered a consent decree for some period of time,” and is therefore likely more familiar with the relevant context, “the lack of an initial trial is, at least marginally, less of an inhibition” when weighing the appropriateness of a proposed remedy.[1]

[1] https://assets.documentcloud.org/documents/6876914/4-23-20-F... (linked in the first sentence of the article)

They'll just use that as proof the judge is biased and ask him to recuse.

Honestly, if I had another life, I would become the tech-savvy judge. Give Facebook a 300% revenue fine.

The problem is that threatening doesn't mean much. The $5b isn't much in the grand scheme of things, and I doubt we'll be as "lucky" to get a judge that feels similarly next time.

Agreed. That's as if someone who makes $100k/year, and made that money while operating for 8 years doing something illegal, then was ordered to pay a fine of $900 and told not to do it again or else.

I disagree in part. The articles notes:

> The settlement also obligates Facebook to pay $5 billion in civil penalties; that penalty is significantly larger than the next-closest penalty the FTC has ever won–which topped out at $22.5 million.

With $5 billion, I believe we're within a factor of ten of the right fine, which isn't something I always believe about these settlements. Compared to e.g. Janet Jackson at the Superbowl, resulting in a fine of $27 thousand - $5 billion is at least a line on the spreadsheet.

That is a good point. We're getting closer to fines that actually hurt the companies enough not to do it again.

Not there yet, but closer.

The frustrating part is that they kept doing it even after they said they wouldn't. And FB amassed a sizeable revenue breaking a law while snuffing out competition, growing bigger, and reaping the benefits whilst still paying a fine that was essentially "worth it".

I heard in a podcast the idea how the next "Facebook" can't do what FB did to grow -- because all that stuff is now regulated, closely watched, and fined.

Made? Revenue is not profit. Their net income was just under $5B this quarter

Edit: quarter, not half

Hard to nail any international company on a real number. All that tax dodging[1] makes it hard to know how much they actually make and how much they are moving through shell companies. Better just stick all the executives and stock owners into prison, that is harder to fake.

[1]https://www.theverge.com/2020/2/19/21144291/facebook-irs-law...

Now that you mention it, wouldn't click fraud be an excellent money laundering environment? All these bullshit content farms (taboola, outbrain, etc) that provide no value to the people actually using the web -- it's just a paycheck to publishers, where is the value coming from?

People are buying and selling click traffic (likes, follows, youtube views), suppose you just buy advertising and it gets placed on domains all over the web -- if I want to transfer money to you, you just need to spin up a domain, get taboola recommending some gut health articles, and I can buy ad placements and point my botnet at your domain, clicking on the ads I paid for so you get all the kickbacks -- something like that I'm not in the ad brokering business myself! Or the money laundering business for that matter :)

You mean that this quarter alone, they made $5B in pure profit? I'm not sure if that helps any argument against what I said.

Hmm Facebook paid quite a lot of fines in the last two years. (worldwide) would be interesting how much, when you add them up.

If you want corporations like Facebook to care about breaking the law, you need start handing out jail time for the CEOs. Fining a significant percentage of revenue might work, but they'd probably cook the books.

the best two things that can happen in my opinion (based on a book called 'the chickenshit club') are

0. make corporations admit wrongdoing. almsot every one of them that gets out of a protracted settlement like this without having to own any responsibility at the corporate level for this. They can take the fine. They cannot take the risk to their business and loss of reputation in the market.

1. Stop offering settlements and start prosecuting. Chain up their C levels, withhold bail, deny parole and do not under any circumstances allow the argument of 'hurting the market' sway you. Do the same thing you do to street criminals: freeze their assets and punish companies doling out golden parachutes (AKA bankrolled hush money.) Yes this means you wont always have a perfect record as a prosecutor, yes this means you wont get your shiny DC penthouse after you 'retire' from government life with a law firm in the beltway. and yes it means youll do real work.

The reason you don't have crazy nonsense like this is that it would be a field-day for political persecution. Prefect for corruption.

A politician with clout doesn't like what some CEO said, or that he bankrolled your opponent?

Destroy their business by setting the prosecutors on them, jail their CEO, destroy their business by seizing the cashflow, and then 2 years down the line, charges dropped. Whoops.

So if making people responsible for what their companies do is, as you put it "crazy nonsense", what would you suggest instead?

You can make them responsible, just keep innocent until proven guilty in mind.

No reason to do asset seizures or withhold bail or any of the other things he's listed as necessary to hold them responsible. Those are extreme measures that they use in the drug war because they've been losing it for decades and are giving up on the principal of fair laws in a desperate attempt to look effective.

Another reason you don't have this is that if an executive knew they become personally responsible for such wrongdoing they would refuse the position. Today the bar is pretty high to punish the executive personally.

And if they do take the job they would be hyper-cautious. This is not conducive to high profit. So companies via lobbyists make sure legislation is passed "as it should". The balance of power is incredibly tilted in the favor of corporations, and some governments really did their best to maintain this status-quo.

Gee, what country does that sound like? It just occurred to me, seriously.

Well this is why the judiciary should be independent, not political as in the US

The executive is responsible for prosecuting cases, not the judiciary.

Reminds me years ago I stumbled on an essay by Richard Posner ex Chief Justice of the 7th Circuit. In it he discussed his belief that.

a) The only way to keep poor people in line is the threat of prison.

b) Middle class people can be kept in line by the threat of fines.

c) However the wealthy are kept in line by the threat of losing their good reputation.

https://en.wikipedia.org/wiki/Richard_Posner

C Totally doesn't scale in the age of Trump and Moscow Mitch

Let's not take the conversation down this direction please.

From that list/summary it almost sounds like he's trying to protect the rich by saying that the typical forms of "keeping people in line", don't work with the wealthy.

Maybe he should have been more sincere by explaining how the wealthy can buy or trade their way out of trouble, by unduly (or at least unfairly) influencing the legal system to their advantage.

He was saying fines and prison aren't usually needed to keep the wealthy from doing bad things. Poor people have neither reputation or money to lose so prison is the only way to motivate them. Which tells you how much Posner knows about actual poor people. For most poor people their good reputation is the only thing of value they have.

This is why some countries do income-based fines. Get a speeding ticket in some Scandinavian countries and you may be on the hook for six figures if you’re rich.

I used to live in Stockholm. Every now and then,on our way to the water, we used cross Östermalm-a pretty expensive area. One day,we noticed Mercedes SLS outside an apartment block. The guy must have been one of the earliest adopters,as it was only released for sales a few weeks earlier. After seeing the car for some time,one day it was gone.Oh,well,maybe the owner moved somewhere else or he sold it,etc.Turns out,this happened instead: www.motor1.com/news/23266/1-million-speeding-fine-in-switzerland-for-swedish-sls-owner/amp/

And the Swiss apparently keep your car until you fork out the fine..

That seems like utter nonsense. The threat of jail is much more daunting for middle-class people than poor people, and fines are often the other way around. However, the rich can afford fines and can generally buy their way, more or less legally, from jail sentences, so they don't see it as a realistic probability for themselves. This would be the only reason that the rich can't usually be kept in line by the threat of jail.

I mean..everyone can be kept in line with a).

Those things affect most people, it's just that poor people don't have any reputation to worry about, and won't afford the fees.

Rich people can also be punished by fees if they got them as much as the middle class (i.e. they need to be based on net worth), prison time will affect everyone.

The biggest issue is that rich can use their money and influence to escape justice, I suppose maybe it means that reputation is the only thing left to control the rich, but that hardly helps, there are many rich people with horrible reputation that still do very well, one even got the highest office in the land.

Why jail time? Hit them where it hurts: their company stock. Corporate malfeasance should (in part) be punished by clawing back some portion of executive stock compensation FBO the victims and/or the government. Some portion of their compensation was “earned” by decisions that violated the law and directly harmed others. Take it away.

Zuckerberg doesn't receive any compensation (besides private security for him and his family)

There is no greater privacy violation than the BSA act. Can’t wait for that to be on the table of some judge one day.

Compare HN title with actual titles given by the author/publisher:

"og:title" content="Federal Judge Stunned by Facebook's `Unscrupulous' Violation of the Law, Warns of Much Deeper Problems"

<title>Judge Timothy Kelly Stunned by Facebook's Violation of Law

One could argue the HN title suggests the important point of the news story is that the settlement was accepted despite "stunning" privacy violations.

One could argue the author's titles suggest the important point of the news story is that a federal judge was "stunned" by Facebook's violations when approving the FTC settlement.

For the record, I submitted the article with the original title (the text before the comma, due to HN's 80 character limit). The title was later edited by an HN moderator.

The article and especially the title seem a bit tendentious to me, so I googled to try to find another story that quoted the same judge's remarks. I found https://www.mediapost.com/publications/article/350552/facebo... and almost changed the URL to that, but decided in the end to adapt that title instead. Clearly the news here is not just what the judge said during a ruling, but the ruling itself.

The ideal post then might be a link to the ruling itself:

https://epic.org/privacy/facebook/epic2019-challenge/US-v-Fa...

Through an FOIA request, EPIC found there were over 29,000 outstanding complaints to the FTC against Facebook since the 2012 Consent Order.

https://epic.org/privacy/facebook/epic2019-challenge/

Reply on news.ycombinator.com