Rules
Facebook and the FTC: Timeline of the 2012 and 2019 Settlements
A dated, step-by-step account of the FTC's 2012 consent order against Facebook and the 2019 settlement that brought a USD 5 billion penalty, with what each order required and what followed.
What to take away
- The first FTC case against Facebook ended in a consent order. The FTC announced the proposed settlement on November 29, 2011, and issued the final decision and order on August 10, 2012.
- The 2012 order carried no stated money penalty. It required a comprehensive privacy program and independent audits every two years for 20 years.
- On July 24, 2019, the FTC announced a USD 5 billion civil penalty and a new 20-year order, after alleging that Facebook violated the 2012 order.
- The 2019 settlement was a stipulated order that took legal force only after a federal district court approved it.
- The story did not end there. On May 3, 2023, the FTC moved to modify the order again, and the proceeding was stayed on July 30, 2025.
Step 1: the 2011 complaint and proposed consent order
The FTC announced its first settlement with Facebook on November 29, 2011. The Commission voted 4-0 to accept the consent agreement for public comment, and the comment period ran through December 30, 2011.
The FTC's press release lists these alleged practices, which it said deceived consumers about privacy:
- In December 2009, Facebook made certain user information public without warning or prior approval.
- It allowed third-party apps to access far more user data than they needed.
- Its "Friends Only" setting did not stop sharing with apps used by friends.
- It claimed to certify app security through a "Verified Apps" programme, without doing so.
- It shared personal information with advertisers despite promising not to.
- It kept photos and videos accessible after users deactivated or deleted accounts.
- It claimed compliance with the US-EU Safe Harbor Framework, which it did not meet.
The proposed settlement barred misrepresentations about the privacy or security of consumers' information. It required affirmative express consent before changes overrode users' privacy preferences, and it required that deleted accounts' material be inaccessible more than 30 days after deletion. It also required a comprehensive privacy program and independent third-party privacy audits, the first within 180 days and then every two years for 20 years.
The press release does not state a monetary penalty. It notes only that violating a final order may bring a civil penalty of up to USD 16,000 per violation. That detail matters later, because it explains why a breach of the order became the basis of the 2019 case.
Step 2: the 2012 final order
The FTC approved the final settlement in a press release dated August 10, 2012. The vote was 3-1-1: Commissioner J. Thomas Rosch dissented and Commissioner Maureen K. Ohlhausen did not participate. The matter carries FTC File No. 092 3184 and Docket C-4365.
Under the final order, Facebook had to give clear, prominent notice and obtain users' express consent before sharing their information beyond their privacy settings. It also had to maintain a comprehensive privacy program and obtain independent audits every two years.
For anyone reading the record, 2012 is the baseline. The terms were behavioural: promise less, ask first, audit regularly. Those same terms became the standard against which the company's later conduct was measured. The Facebook entry in the platform timelines places this order in the longer history of the service.
Step 3: the 2019 complaint and the USD 5 billion penalty
On July 24, 2019, the FTC announced a USD 5 billion penalty, which it called a record for a privacy violation. The Commission voted 3-2 to refer the complaint and stipulated order to the Department of Justice, which files on the FTC's behalf in the US District Court for the District of Columbia (Civil Action No. 19-cv-2184). A stipulated final order takes legal force only after a judge approves and signs it.
According to the FTC, the complaint alleged that Facebook:
- violated the 2012 order by sharing data from users' Facebook friends with third-party apps, even when those friends had restrictive privacy settings;
- failed to police app developers adequately and enforced its platform policies inconsistently;
- misrepresented controls for its facial recognition "Tag Suggestions" feature, which was on by default; and
- used phone numbers collected for two-factor authentication to serve advertising.
The same day, the FTC announced separate actions against Cambridge Analytica, its former chief executive Alexander Nix and app developer Aleksandr Kogan, alleging that they used deceptive tactics to harvest data from millions of Facebook users.
What the 2019 order required
The new order ran for 20 years. According to the FTC's summary, it required:
| Requirement | Detail |
|---|---|
| Board privacy committee | Independent committee whose members can be removed only by a board supermajority |
| Compliance officers | Designated officers approved and removable only by that committee |
| Certifications | Quarterly certifications from the chief executive and compliance officers, plus an annual certification; false certifications carry individual civil and criminal penalties |
| Independent assessment | Biennial third-party assessments, reported quarterly to the privacy committee |
| Product reviews | Privacy reviews of new or modified products before launch, and documentation of incidents affecting 500 or more users |
| Specific limits | Limits on third-party app access, a ban on using security phone numbers for advertising, facial recognition consent, and password encryption |
The shift from 2012 is structural. The earlier order asked the company to run a privacy programme. The later order told the company how to govern one, and attached personal accountability to the certifications.
Step 4: 2020 modification and the 2023 show-cause order
The FTC's case page records that the Commission issued an Order Modifying Order on April 28, 2020, giving final approval to modify the 2012 order with provisions from the 2019 settlement. The page does not list a separate court approval date, so this article does not give one.
On May 3, 2023, the FTC issued an Order to Show Cause why it should not modify the order and enter a proposed new order. The Commission voted 3-0. It alleged that Meta, formerly Facebook, violated the 2020 order, and set out these points:
- From late 2017 to mid-2019, Meta misrepresented that parents could control whom their children contacted on Messenger Kids, which the FTC said violated the 2012 order, the FTC Act and the COPPA Rule.
- Meta kept giving app developers access to users' private data after promising in 2018 to cut off apps unused for 90 days, in some cases until mid-2020.
- The independent assessor found gaps and weaknesses in the privacy programme.
The FTC proposed barring Meta from profiting from data collected from users under 18, pausing new or modified products until the assessor confirms full compliance, and requiring affirmative consent for future facial recognition. It described the action as only the first step, and Meta had 30 days to respond.
The case page lists later developments: oral argument scheduled for September 24, 2024; a Commission decision on its Section 5(b) modification authority on January 10, 2025; and an Order Staying Show Cause Proceeding on July 30, 2025. Check the FTC's docket for anything newer.
How to use this timeline
If you cite these events, keep the distinctions the record draws:
- Announcement versus order.November 29, 2011 is the proposal. August 10, 2012 is the final order.
- Penalty versus consent.The 2012 press release states no money penalty. The 2019 settlement carries the USD 5 billion figure.
- Commission versus court.The 2019 stipulated order needed a district court's signature. The FTC's own modification order is dated April 28, 2020.
- Allegation versus finding.The FTC's summaries describe allegations in a settled case.
The US platform rules explainer shows where consent orders sit among the tools the FTC uses, and the note on COPPA and California's design code covers the children's privacy law cited in 2023. For the longer record on how the company's disputes escalated, see the critiques of social media examples.
Common questions
Did Facebook pay a fine in 2012?
The FTC's 2011 press release states no money penalty. It notes only that violating a final order may bring civil penalties.
What was the 2019 penalty?
USD 5 billion, announced on July 24, 2019, with a new 20-year order.
Did the 2019 settlement replace the 2012 order?
The FTC's case page says the Commission modified the 2012 order on April 28, 2020 with provisions from the 2019 settlement.
