WASHINGTON — Facebook and the Federal Trade Commission are discussing a settlement over privacy violations that could amount to a record, multibillion-dollar fine, according to three people with knowledge of the talks.
The company and the F.T.C.’s consumer protection and enforcement staff have been in negotiations over a financial penalty for claims that Facebook violated a 2011 privacy consent decree with the agency, said the people, who spoke on the condition of anonymity because the investigation is private.
In 2011, Facebook promised a series of measures to protect user privacy after an investigation found it had harmed consumers with its handling of user data.
The current talks have not yet reached the F.T.C.’s five commissioners for a vote and it is unclear how close the two sides are to wrapping up the nearly 11-month investigation. The commissioners met in mid-December and were updated by staff members that they had at that point found considerable evidence of violations of the 2011 consent decree.
The F.T.C. began its investigation into Facebook’s mishandling of data after The New York Times reported in March 2018 that the information of 87 million users had been harvested by a British political consulting firm, Cambridge Analytica, without their permission.
Facebook confirmed the negotiations with the F.T.C., which could still break down and lead to litigation. The discussions were first reported by The Washington Post.
Facebook’s 2011 consent decree requires the company to seek permission from users for plans to share their data with third parties. The trade commission also requires Facebook to notify it when third parties misuse this data.
Some F.T.C. officials have pressed for maximum penalties because of several new reports of potential privacy breaches since the start of the investigation. The agency can seek up to $41,000 for each violation found by the agency. In the case of Cambridge Analytica, 87 million people were affected.
The highest financial penalty imposed by the F.T.C. so far was a $22.5 million fine on Google for violating an agreement to protect consumer data.
Continued news reports of data violations, including a Times report about data sharing between Facebook and partner tech companies in December, have raised concerns among F.T.C. officials of setting the fine too low, according to a person familiar with the discussions.
The agency is under pressure to show teeth in its Facebook investigation, and the company’s missteps over the past two years have made it a target for lawmakers. Members of Congress have complained that the F.T.C. is lagging behind European regulators that have taken a tougher stand with internet companies.
