Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 1 of 17
`
`UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF COLUMBIA
`
`
`UNITED STATES OF AMERICA,
`
`
`
`Plaintiff,
`
`
`v.
`
`FACEBOOK, INC.,
`
`Defendant.
`
`
`
`Civil Action No. 19-2184 (TJK)
`
`MEMORANDUM OPINION
`
`Almost eight years ago, the Federal Trade Commission and Facebook agreed to settle
`
`allegations that Facebook’s information-sharing and privacy practices violated Section 5 of the
`
`Federal Trade Commission Act because they were unfair and deceptive. As part of that
`
`agreement, memorialized in an administrative order entered by the FTC, Facebook committed to
`
`maintaining a privacy program and to not misrepresenting the privacy protections it afforded its
`
`users. But according to the United States, Facebook did not keep its word, and over the next
`
`months and years it violated both the FTC Act and the order in many ways. Last year, the parties
`
`agreed to settle these fresh allegations about Facebook’s privacy practices. Before the Court is
`
`their consent motion to enter a proposed stipulated order. Among other things, the order would
`
`require Facebook to pay a $5 billion civil money penalty—by far the largest penalty ever won by
`
`the United States on behalf of the FTC—and impose injunctive relief in the form of an amended
`
`administrative order to be entered by the FTC that would require Facebook to take a variety of
`
`additional measures to protect its users’ personal information.
`
`In the Court’s view, the unscrupulous way in which the United States alleges Facebook
`
`violated both the law and the administrative order is stunning. And these allegations, and the
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 2 of 17
`
`briefs of some amici, call into question the adequacy of laws governing how technology
`
`companies that collect and monetize Americans’ personal information must treat that
`
`information. But those concerns are largely for Congress; they are not relevant here. Mindful of
`
`its proper role, and especially considering the deference to which the Executive’s enforcement
`
`discretion is entitled, the Court will grant the consent motion and enter the order as proposed.
`
`
`
`Background
`
`A.
`
`Facebook
`
`Facebook, Inc. (“Facebook”) operates a social-networking service through its website and
`
`mobile applications. ECF No. 3 (“Compl.”) ¶ 2. Those applications connect Facebook’s users,
`
`who each create a profile that includes their personal information, with “Friends” who also have
`
`Facebook accounts and profiles. Id. Through its service, Facebook collects and maintains huge
`
`amounts of its users’ information. Id. As of 2018, Facebook had more than 2.2 billion monthly
`
`active users worldwide. Id. And over 100 million Americans use Facebook every day to share
`
`personal information, such as their name, date of birth, hometown, current city, employer,
`
`relationship status, political views, photos of minor children, and membership in health-related
`
`and other support groups. Id. In addition, Facebook users may install and use applications
`
`developed by third parties that allow users to share information with each other. Id. The
`
`collection and maintenance of its users’ personal information is an essential part of Facebook’s
`
`business model. That model monetizes users’ personal information by deploying it for
`
`advertising; indeed, almost all of Facebook’s revenue comes from advertising. Id. ¶ 3.
`
`B.
`
`2012 Consent Agreement and Order
`
`In 2012, the Federal Trade Commission (FTC) filed an administrative complaint alleging
`
`that Facebook engaged in unfair and deceptive acts or practices in violation of Section 5(a) of the
`
`Federal Trade Commission Act, 15 U.S.C. § 45(a) (“FTC Act”). See In the Matter of Facebook,
`
`2
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 3 of 17
`
`Inc., Dkt. No. C-4365, 2012 WL 3518628 (F.T.C.) (July 27, 2012) (“2012 Action”). The FTC
`
`brought eight counts alleging, among other things, that Facebook misled its users about (1) its
`
`privacy settings and privacy policy changes, see id. ¶¶ 10–29; (2) how much it shared its users’
`
`personal information with third-party application developers; id. ¶¶ 30–33; (3) how much it
`
`shared its users’ personal information with outside advertisers, see id. ¶¶ 34–42; (4) the steps it
`
`took to verify the security and privacy practices of third-party application developers, see id.
`
`¶¶ 43–49; (5) how much it shared its users’ personal information, including photos and videos,
`
`with third parties after a user deleted its account, see id. ¶¶ 50–55; and (6) its compliance with
`
`international privacy protocols, see id. ¶¶ 56–63.
`
`Facebook and the FTC reached a settlement in August 2012. Compl. ¶ 28. The FTC
`
`then issued an order (“2012 Order”)—which Facebook’s General Counsel signed on the
`
`company’s behalf—outlining remedial actions Facebook had to take. See id. ¶¶ 28–34.
`
`Facebook was prohibited from making misrepresentations about the extent to which it maintains
`
`the privacy or security of its users’ personal information; the extent to which its users can control
`
`the privacy of that information, and how they can do so; and the extent to which it makes its
`
`users’ personal information accessible to third parties. See id. ¶ 29. Facebook was also required
`
`to establish and maintain “a comprehensive privacy program that [was] reasonably designed to
`
`(1) address privacy risks related to the development and management of new and existing
`
`products and services for consumers, and (2) protect the privacy and confidentiality of [its users’
`
`personal] information.” Id. ¶ 31. Facebook’s privacy program was also required to consider
`
`reasonably foreseeable risks to users’ privacy, and Facebook had to monitor and evaluate the
`
`program on an ongoing basis. See id. The order expires in July 2032, or 20 years from the date
`
`the FTC filed its administrative complaint. See 2012 Action at *83.
`
`3
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 4 of 17
`
`C.
`
`This Action
`
`1.
`
`Complaint
`
`The United States now alleges that Facebook violated the 2012 Order by “subvert[ing]
`
`users privacy choices to serve its own business interests” in several ways, starting almost
`
`immediately after agreeing to comply with the 2012 Order. Compl. ¶ 4. Although Facebook led
`
`its users to believe they could restrict who could view their personal information, it allegedly
`
`shared that information with third parties without the user’s knowledge. See Compl. ¶¶ 35–50.
`
`For example, Facebook allegedly told its users that they could limit those who could see their
`
`posts to just “Friends,” when in reality—and without warning to the user—doing so would also
`
`allow developers of third-party applications used by their “Friends” to access the post. See id.
`
`46–48. Facebook allegedly permitted third-party developers to access these posts even though it
`
`was aware of how that practice compromised its users’ privacy interests. See id. ¶¶ 81–91. And
`
`Facebook allegedly continued to allow a subset of third-party developers to access its users’
`
`personal formation in this way without their users’ knowledge even after it announced, two
`
`different times, that it would stop doing so. See id. ¶¶ 92–100; 106–13. Facebook also allegedly
`
`automatically activated certain facial recognition technologies on a subset of about 60 million
`
`user accounts and maintained that technology’s activation while telling its users that it would
`
`only do so if a user requested it. See id. ¶¶ 144–54.
`
`The United States also alleges that Facebook’s privacy settings and policies compromised
`
`its users’ privacy in various other ways. For example, Facebook allegedly misled its users
`
`through its desktop and mobile interfaces by causing them to default to settings that were not
`
`privacy-protective; removing key disclaimers; and making interfaces hard to navigate, especially
`
`when it came to users’ ability to stop the sharing of their personal information with developers of
`
`third-party applications used by their “Friends.” See id. ¶¶ 51–80. Moreover, Facebook’s so-
`
`4
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 5 of 17
`
`called “Privacy Checkup,” a tool that it represented would allow users to control who had access
`
`to their information, allegedly failed to alert users that third-party developers could continue to
`
`view their information no matter what settings were selected through the “Privacy Checkup.”
`
`See id. ¶¶ 101–105. And even though Facebook agreed to maintain a reasonable privacy
`
`program, it allegedly failed to screen third-party application developers before giving them
`
`access to users’ information and did not consistently enforce the few policies it had about the
`
`protection and use of its users’ information when developers violated those policies. See id.
`
`¶¶ 114–24. In fact, Facebook’s enforcement decisions allegedly “took into account the financial
`
`benefit that Facebook considered the developer to offer.” Id. ¶ 123. Moreover, because of
`
`Facebook’s deficient controls, the company allegedly still did not know at the time the
`
`Complaint was filed how much data it improperly released to third-party application developers,
`
`exactly to which developers the data was released, or the purposes for which the developers used
`
`it. See id. ¶¶ 126–27.
`
`Facebook is also alleged to have misled users about what information it shared with
`
`advertisers. Facebook purportedly encouraged users to provide their telephone numbers so that
`
`they could protect their accounts with two-factor authentication. See id. ¶¶ 128–30. Facebook
`
`did not, however, warn these users that it would also use these telephone numbers for advertising
`
`purposes. See id. ¶¶ 131–43.
`
`Based on this alleged conduct, the Complaint filed by the United States includes five
`
`counts accusing Facebook of violating the 2012 Order by misrepresenting to its users how much
`
`control they had over their personal information and how much third-party application
`
`developers could access that information, see id. ¶¶ 155–75, 183–86, and by failing to maintain a
`
`reasonable privacy program, see id. ¶¶ 176–82. The Complaint also includes one count alleging
`
`5
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 6 of 17
`
`that Facebook violated Section 5 of the FTC Act by failing to disclose to its users that it would
`
`use the telephone numbers they provided to it for two-factor authentication for advertising
`
`purposes as well. See id. ¶¶ 187–90.
`
`2.
`
`Stipulated Order
`
`The parties represent that they have reached a settlement. See ECF No. 4 (“Consent
`
`Mtn.”) at 1. The United States has moved, with Facebook’s consent, for the Court to enter a
`
`stipulated order that imposes a $5 billion civil money penalty on Facebook and imposes
`
`injunctive relief in the form of an amended administrative order to be entered by the FTC. See
`
`ECF No. 4-1 (“Stipulated Order”) at 1–4. The amended administrative order, included as
`
`Attachment A to the Stipulated Order, requires Facebook to take a series of remedial steps,
`
`including: (1) ceasing its misrepresentations about a host of matters, including its collection, use,
`
`and disclosure of its users’ personal information; the extent to which it maintains the privacy or
`
`security of that information; the extent to which users can control the privacy of that information,
`
`and how they can do so; and the extent to which it makes its users’ personal information
`
`accessible to third parties; (2) clearly disclosing when it will share its users’ personal information
`
`with third parties, and obtaining a user’s express consent to do so if the information sharing goes
`
`beyond the restrictions imposed by the user’s privacy settings; (3) deleting or de-identifying
`
`users’ personal information within a reasonable time after a user deletes it or closes her account;
`
`(4) stopping using telephone numbers provided by users for security purposes for advertising
`
`purposes as well; (5) obtaining a user’s specific consent before applying facial recognition
`
`technology to their account; (6) implementing a more robust privacy program, which must
`
`include safeguards that apply to third parties with access to a user’s personal information; (7)
`
`creating an independent committee of Facebook’s board of directors to oversee information
`
`privacy efforts; (8) designating a corporate officer in charge of monitoring its privacy program
`
`6
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 7 of 17
`
`and ensuring the program is effective—and who only can only be removed with a majority vote
`
`of the newly created board committee; (9) commissioning regular, independent assessments of
`
`its privacy practices and providing them to the FTC; (10) alerting the FTC when it discovers that
`
`more than 500 users’ personal information has been compromised in some way; and (11)
`
`undertaking other reporting and recordkeeping obligations, including annually certifying
`
`compliance with the order and facilitating any FTC investigation into its compliance. See id. at
`
`8–29.1 In exchange, under the Stipulated Order, Facebook receives considerable reprieve from
`
`liability. The “Stipulated Order resolves all consumer-protection claims known by the FTC prior
`
`to June 12, 2019, that [Facebook], its officers, and directors violated Section 5 of the FTC Act.”
`
`See id. at 1–2. The amended administrative order terminates 20 years after it is issued, or 20
`
`years after the United States or the FTC files a complaint against Facebook alleging that it
`
`violated the order. See id. at 28–29.
`
`
`
`Legal Standard
`
`“[P]rior to approving a consent decree a court must satisfy itself of the settlement’s
`
`overall fairness to beneficiaries and consistency with the public interest.” Citizens for a Better
`
`Env’t v. Gorsuch, 718 F.2d 1117, 1126 (D.C. Cir. 1983) (internal quotation marks omitted). But
`
`the Court’s role is not to “inquire into the precise legal rights of the parties nor reach and resolve
`
`the merits of the claims or controversy.” Id. (internal quotation omitted). Rather, it “need only
`
`determine that the settlement is fair, adequate, reasonable and appropriate under the particular
`
`facts and that there has been valid consent by the concerned parties.” Id.; see also United States
`
`v. Wells Fargo Bank, NA, 891 F. Supp. 2d 143, 145 (D.D.C. 2012) (“[S]hort of a decree that
`
`
`1 Because the Stipulated Order and the amended administrative order are both included in ECF
`No. 4-1, the Court cites to page numbers in the document’s ECF header.
`
`
`7
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 8 of 17
`
`‘make[s] a mockery of judicial power,’ the Court should accept an agreement between the
`
`parties.”) (quoting United States v. Microsoft Corp., 56 F.3d 1448, 1462 (D.C. Cir. 1995)). Both
`
`the judiciary and the public at large have an interest in avoiding costly litigation, and so
`
`voluntary settlements are highly favored. Citizens for a Better Env’t, 718 F.2d at 1126.
`
` Analysis
`
`Applying this deferential standard—and despite the underhanded conduct of which the
`
`FTC accuses Facebook—the Court finds that the Stipulated Order passes muster. Specifically,
`
`the Court finds that the parties consented to the order, and that it is fair, reasonable, and in the
`
`public interest.
`
`A.
`
`Consent
`
`The parties represent that they consent to the Court’s entry of the Stipulated Order to
`
`settle the allegations in the Complaint. See Consent Mtn. at 1–2; see also Stipulated Order at 6–
`
`8. They also represent that it emerged from lengthy negotiations, see Consent Mtn. at 7, and the
`
`Court notes that both parties are sophisticated and ably represented by counsel. These facts
`
`amply support the Court’s conclusion that the parties have validly consented to the Stipulated
`
`Order. See Wells Fargo, 891 F. Supp. 2d at 145.
`
`B.
`
`Fairness
`
`Procedurally, “[v]alid consent that resulted from good faith bargaining itself indicates
`
`that the agreement is procedurally fair,” id., and there is no evidence of any conflicts of interest
`
`that might have tainted the negotiating process, see id. Substantively, the Stipulated Order
`
`reflects a compromise and includes benefits to both parties. The United States receives what it
`
`asserts is by far the largest civil money penalty ever obtained on behalf of the FTC, and the
`
`second largest in any context, Consent Mtn. at 4, as well as extensive injunctive relief, described
`
`in more detail below. Facebook obtains a release from Section 5 violations known to the FTC.
`
`8
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 9 of 17
`
`Stipulated Order at 1–2. And both parties avoid the cost and uncertainty associated with lengthy
`
`litigation. That Facebook does not admit the allegations in the Complaint does not suggest that
`
`the resolution is unfair. See Stipulated Order at 2; Microsoft, 56 F.3d at 1461; see also Wells
`
`Fargo, 891 F. Supp. 2d at 145.
`
`C.
`
`Reasonableness
`
`The D.C. Circuit has explained that a district court evaluating a consent agreement should
`
`be cautious about second guessing the parties’ judgments. See Microsoft, 56 F.3d at 1460–61.
`
`After all, “[r]emedies which appear less than vigorous may well reflect an underlying weakness
`
`in the government’s case, and for the district judge to assume that the allegations in the
`
`complaint have been formally made out is quite unwarranted.” Id. at 1461. Although the
`
`allegations the United States levels against Facebook for duplicitous privacy-related
`
`representations to its users are shocking, it is not appropriate for the Court to judge the Stipulated
`
`Order as if it were proposed after the United States had already proven those allegations up at
`
`trial. See id. (noting that it is “inappropriate for the judge to measure the remedies in the decree
`
`as if they were fashioned after trial”). Rather, the Court’s analysis must focus on whether the
`
`proposed order achieves its stated objective. See Envtl. Def. v. Leavitt, 329 F. Supp. 2d 55, 71
`
`(D.D.C. 2004) (“The factors for determining the adequacy, reasonableness and appropriateness
`
`of a consent decree focus on the extent to which the decree is confined to the dispute between the
`
`parties and whether the decree adequately accomplishes its purported goal.”). In other words,
`
`the Court must assess whether the Stipulated Order is a reasonable resolution of the allegations
`
`outlined in the Complaint.
`
`Judged by that standard, the Court concludes the Stipulated Order clears the modest bar
`
`of reasonableness. The allegations in the Complaint reflect many ways in which Facebook
`
`purportedly acted improperly. Some of these allegations represent discrete and poorly
`
`9
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 10 of 17
`
`considered decisions, such as allegedly encouraging users to provide phone numbers to better
`
`secure their accounts, but then using those same numbers for advertising without telling users
`
`beforehand. Others appear to reflect Facebook’s willingness to deceive its users outright, such as
`
`allegedly telling the public that it would not share their personal information with third parties
`
`when it was continuing to do so. And still others represent systemic oversight failures, such as
`
`allegedly allowing third parties to access users’ personal information without the users’
`
`knowledge and without controlling how those third parties would use the information. Most of
`
`these allegations represent violations of the 2012 Order; several are new violations of law. But
`
`all of them suggest that the privacy-related decisionmaking of Facebook’s executives was subject
`
`to grossly insufficient transparency and accountability.
`
`The Stipulated Order appears reasonably calculated to address these allegations. To
`
`begin with, it imposes a $5 billion fine to deter similar conduct by Facebook in the future.
`
`Stipulated Order at 3. That is, by any measure, a significant amount. The United States
`
`contends it is “the largest civil penalty ever obtained . . . on behalf of the FTC—dwarfing the
`
`previous record of $168 million.” ECF No. 28 at 3. The United States also argues that the total
`
`breaks down to $5.56 per violation, “commensurate with . . . civil penalties obtained in contested
`
`cases similarly involving millions of FTC Act violations by large corporations.”2 Consent Mtn.
`
`at 4. Facebook also claims that the fine looms even larger when compared to the largest civil
`
`penalty ever assessed by the FTC where—as here—no consumer harm is alleged to have been
`
`caused: $22.5 million. See ECF No. 30 at 11-12. The fine is also significant when compared to
`
`Facebook’s bottom line; the parties agree it represents nearly a quarter of Facebook’s after-tax
`
`
`2 See, e.g., United States v. Dish Network, 256 F. Supp. 3d 810, 970, 991 (C.D. Ill. 2017) ($168
`million civil penalty on 66 million FTC Act violations, or $2.54 per violation).
`
`
`10
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 11 of 17
`
`profit in 2018. Id. at 3. Facebook also argues that the fine “is orders of magnitude greater than
`
`what the FTC could reasonably have achieved at trial” given the statutory penalties and the
`
`arguments available to it concerning how to calculate its alleged violations. ECF No. 30 at 11.
`
`And the United States, citing the FTC’s “hard-fought” victory in United States v. Dish Network,
`
`256 F. Supp. 3d 810 (C.D. Ill. 2017), appears to acknowledge that it would have been unlikely to
`
`obtain more after a trial. See ECF No. 28 at 7–8. The Court has no reason to doubt that
`
`judgment.
`
`As important, the injunctive relief in the amended administrative order to be entered by
`
`the FTC contains new measures aimed at ensuring that Facebook complies with its legal
`
`obligations going forward. Under the amended administrative order, Facebook will have to
`
`consider privacy at every stage of its operations and provide substantially more transparency and
`
`accountability for its executives’ privacy-related decisions.
`
`The amended administrative order will require Facebook, through its enhanced privacy
`
`program, to consider and document in writing privacy risks, safeguards, training, and procedures
`
`related to each of its products and services—including new safeguards for overseeing third-party
`
`application developers with access to users’ information. At the operational level, the order will
`
`require Facebook to designate one or more corporate officers in charge of monitoring its privacy
`
`policies and ensuring they are effective—and who only a committee of its board of directors can
`
`remove. At the corporate governance level, Facebook must stand up a new independent board
`
`committee dedicated to information privacy—again, whose members enjoy significant removal
`
`protections. Under the order, an independent, third-party assessor approved by the FTC will
`
`evaluate and test Facebook’s privacy efforts, producing annual reports that must be provided to
`
`the FTC and Facebook’s new independent board committee. Significantly, Facebook’s Chief
`
`11
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 12 of 17
`
`Executive Officer will have to certify regularly that Facebook is meeting its obligations under
`
`both its privacy program and the order, potentially subjecting him to civil or criminal penalties.
`
`Facebook will have to alert the FTC when significant privacy-related breaches occur. And the
`
`order will empower both the Department of Justice and the FTC to demand extensive
`
`information from Facebook to evaluate its compliance for themselves.
`
`Finally, it bears mentioning that the requirements in the Stipulated Order are clear. See
`
`Microsoft, 56 F.3d at 1461–62 (observing that “the district judge who must preside over the
`
`implementation of the decree is certainly entitled to insist on that degree of precision concerning
`
`the resolution of known issues as to make his task, in resolving subsequent disputes, reasonably
`
`manageable”). The Stipulated Order spells out Facebook’s obligations precisely, it defines key
`
`terms in detail, and it incorporates specific deadlines for completion of its obligations.
`
`Amici urge the Court to reject the Stipulated Order in part because they argue it does not
`
`go far enough. For example, the Electronic Privacy Information Center (EPIC) argues that the
`
`$5 billion penalty is too low and that the injunctive relief is insufficient. ECF No. 26 at 18–22.
`
`EPIC complains that the Stipulated Order does not “require meaningful changes in Facebook’s
`
`business practices or establish new privacy protections for Facebook users.” Id. at 16. It
`
`suggests, for example, that the United States should have required Facebook to adopt the “Code
`
`of Fair Information Practices,” which “have been incorporated into other privacy laws and
`
`frameworks across the world,” id. at 22–23, or forced Facebook to unwind its acquisitions of
`
`WhatsApp and Instagram. Id. at 24. Other amici would have liked to see more protections
`
`related to children included. See ECF No. 25 at 16–20.
`
`As the United States concedes, amici raise some “broad and conceptually interesting
`
`policy questions about data-privacy law in the United States generally.” ECF. No. 28 at 1. But
`
`12
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 13 of 17
`
`the overall terms of the Stipulated Order are not unreasonable simply because they do not apply
`
`an entirely different privacy-focused legal regime to Facebook or require the company to be
`
`broken apart. And the Court’s role is not to play the Executive’s part in deciding how to enforce
`
`the law. See Microsoft, 56 F.2d at 1462 (cautioning that “when the government is challenged for
`
`not bringing as extensive an action as it might, a district judge must be careful not to exceed his
`
`or her constitutional role”); see also Ass’n of Irritated Residents v. EPA, 494 F.3d 1027, 1031
`
`(D.C. Cir. 2007) (“Although the Supreme Court’s decision in Chaney applies directly to agency
`
`decisions not to enforce a statute, we have also applied it to an agency’s decision to settle an
`
`enforcement action.”) (citing Heckler v. Chaney, 470 U.S. 821, 838 (1985)). As noted above, in
`
`evaluating the Stipulated Order’s reasonableness, the Court may not even assume that Facebook
`
`violated the FTC Act or the 2012 Order in the first place. See Microsoft, 56 F.3d 1461. While
`
`the Court might well have fashioned different remedies were it doing so out of whole cloth after
`
`a trial, none of amici’s criticisms call into question the Stipulated Order’s reasonableness, or
`
`whether it is otherwise appropriate.
`
`For these reasons, the Court finds that proposed remedies in the Stipulated Order are
`
`reasonable in light of the allegations in the Complaint.
`
`D.
`
`Public Interest
`
`Finally, the Court must consider whether entering the Stipulated Order accords with the
`
`public interest; “in other words, that the agreement is ‘not unlawful, unreasonable, or against
`
`public policy.’” Wells Fargo, 891 F. Supp. 2d at 146 (quoting United States v. District of
`
`Columbia, 933 F. Supp. 42, 47 (D.D.C. 1996). As discussed above, the Stipulated Order
`
`contains an unprecedented civil money penalty as well as a series of measures designed to
`
`address the allegations in the Complaint.
`
`13
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 14 of 17
`
`In addition, though, this inquiry calls on the Court to consider whether entering the order
`
`will “automatically affect the rights of third parties.” Id. Amici spill considerable ink on this
`
`point. As discussed above, the Stipulated Order would release Facebook from all claims that it
`
`violated the 2012 Order as well as “all consumer-protection claims known by the FTC prior to
`
`June 12, 2019 that [Facebook], its officers, and directors violated Section 5 of the FTC Act.”
`
`Stipulated Order at 1–2. Amici argue that the breadth of this release is unprecedented and reason
`
`alone to reject the Stipulated Order. See ECF No. 25; ECF No. 26 at 13. They point to the
`
`statements of two dissenting FTC Commissioners who both cited the scope of the release as a
`
`reason they voted against the Stipulated Order. See ECF No. 25 at 13 n.3, 16; ECF No. 26 at 13,
`
`15. Amici also argue that the they will be harmed by the scope of the Stipulated Order because it
`
`would preclude the FTC from bringing other enforcement actions based on complaints amici and
`
`others have filed with the agency, including for alleged violations of the 2012 Order. See ECF
`
`No. 25 at 15–25; ECF No. 26 at 15–16.
`
`These arguments by amici do not ultimately cast doubt on whether the Stipulated Order is
`
`in the public interest. First, the Stipulated Order does not strip amici—or anyone else in a
`
`similar situation—of any rights, because they have no right to enforce either Section 5 of the
`
`FTC Act or the 2012 Order. As even they acknowledge, Section 5 of the FTC Act does not
`
`contain a private right of action. See ECF No. 25 at 31; see also United States v. Philip Morris
`
`Inc., 263 F. Supp. 2d 72, 78 (D.D.C. 2003). And as for the FTC’s administrative orders, the D.C.
`
`Circuit “has opted for a bright line rule . . . that third parties to government consent decrees
`
`cannot enforce those decrees absent an explicit stipulation by the government to that effect.”
`
`SEC v. Prudential Sec. Inc., 136 F.3d 153, 158 (D.C. Cir. 1998). Finally, amici do not suggest
`
`that the Stipulated Order will somehow preclude them from doing what they have a right to do:
`
`14
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 15 of 17
`
`file complaints with the FTC accusing Facebook of violating the FTC Act or any applicable
`
`administrative order.
`
`Second, the admittedly broad scope of the release does not mean that the settlement is not
`
`in the public interest. As the United States explains, the Stipulated Order does not stop the FTC
`
`from bringing new enforcement actions against Facebook should it learn of additional violations
`
`of Section 5 of the FTC Act, even if those violations occurred before July 12, 2019. See ECF
`
`No. 28 at 11. And the United States represents that the proposed settlement “does not in fact
`
`release any actual violations of the FTC Act beyond those discussed in the Complaint.” Id. That
`
`is so because, after “extensive investigation and review of submitted consumer complaints, the
`
`FTC [knows] of no other cognizable violations that occurred before June 12, 2019.” Id.; see also
`
`id. at 11 n.4 (adding that “the vast majority of submitted consumer complaints involving
`
`Facebook did not even address a privacy issue or implicate the 2012 Order, and none known to
`
`the FTC raised a potential issue not covered by the proposed settlement”). Additionally, a
`
`majority of the agency’s Commissioners have represented that the Stipulated Order sufficiently
`
`addresses all known violations of the 2012 Order as well. Statement of Chairman Joe Simons
`
`and Commissioners Noah Joshua Phillips and Christine S. Wilson Regarding the Matter of
`
`Facebook, Inc., at 7–8 (July 24, 2019),
`
`https://www.ftc.gov/system/files/documents/public_statements/1536946/092_3184_facebook_m
`
`ajority_statement_7-24-19.pdf. Thus, it seems evident that the United States made a carefully
`
`considered judgment to resolve these violations as it proposes through the Stipulated Order, a
`
`judgment this Court is ill-equipped to second-guess.3 Amici and even some FTC Commissioners
`
`
`3 Unlike violations of the FTC Act, the Stipulated Order also releases Facebook from violations
`of the 2012 Order that are unknown to the United States, see Stipulated Order at 1–2. That is,
`
`
`15
`
`

`

`Case 1:19-cv-02184-TJK Document 34 Filed 04/23/20 Page 16 of 17
`
`may disagree with that decision, but it does not follow that the Stipulated Order is not in the
`
`public interest. See United States v. W. Elec. Co., 900 F.2d 283, 309 (D.C. Cir. 1990) (“The
`
`Court’s function is not to determine whether the resulting array of rights and liabilities is the one
`
`that will best serve society, but only to confirm that the resulting settlement is within the reaches
`
`of the publ