How the Federal Trade Commission could bankrupt Facebook

Mark Zuckerberg wants you to know he’s sorry.

The Facebook CEO told Congress this on Tuesday: he’s really, really sorry. He screwed up, and he’ll do everything in his power to make sure it won’t happen again. He’s updating Facebook’s privacy policy. He’s “open” to some regulations, he said. He can’t answer everything you want to know about how Facebook collects data from its users, because he “wants to make sure he gets this right,” but he’s willing to follow up later.

Those are the kinds of things you would learn listening to Zuckerberg’s largely uneventful testimony before Congress. Throughout the hearing, which was called as the company is dealing with the blow of the Cambridge Analytica scandal, the tech entrepreneur appeared contrite and willing to make some changes to the platform he runs in order to help protect users privacy. But he was very clear on one point: Facebook does not sell people’s data.

“We do not sell data to advertisers,” Zuckerberg said in response to a question from Sen. John Cornyn (R-Texas). “What we allow is for advertisers to tell us who they want to reach and we do the placement.”

This point might seem relatively trivial alongside bigger questions about the role Facebook might have played in attempts to undermine the 2016 U.S. presidential election, and democracy more generally. However, for Facebook’s critics, the question of whether or not it trades in the sale of data is key to understanding the platform’s problems.

Mark Weinstein, a privacy advocate and the founder and CEO of the pro-privacy Facebook alternative site, MeWe, is one of them.

“Facebook is a data company,” he said in an interview. “They’re not a people company, they’re a data company. Facebook members are the products that they sell, not customers to serve.”

Weinstein says he started MeWe in 2014, because he was concerned about the way that sites like Facebook collect data from their users. He wanted to provide the public with an alternative way to connect with people that would adhere to much stricter privacy guidelines.

These concerns proved to be prescient. On Wednesday, Facebook admitted that as many as 87 million users data had been accessed by the research firm Cambridge Analytica. That data was used by the firm to help elect Donald Trump in 2016. Facebook also admitted that most of its 2 billion users may be vulnerable to having their data stolen or misused.

Since the revelations, Facebook has taken a series of steps to try and quell public concern about how much of their data are being seen, including sending a message to users who’s information was seen by Cambridge Analytica to let them know what happened.

But the reason Facebook is so eager to make amends may be because the company knows that this data collection is key to its business model — and that Facebook appears to have already taken on considerable legal liability through their collection methods.

In 2011, Facebook signed a consent decree with the Federal Trade Commission saying it would follow certain guidelines to keep user data private. Some observers and lawmakers say that by allowing user information to fall into the hands of Cambridge Analytica, Facebook may have violated that consent decree.

The maximum amount that the FTC could charge Facebook for that violation is $41,484 per affected user. Therefore, if the FTC wanted to, it could make the case that Facebook owes $7.1 trillion in fines — which, as the Next Web points out, is more than four times the amount of U.S. currency currently in circulation (not to be confused with the amount of actual wealth in the U.S. which is much greater). In other words, the options the federal government currently has to sanction Facebook range from doing nothing to charging the company four times the sum of every American dollar and coin in existence.

It’s unlikely that the U.S. would ever even consider levying that kind of fine against a company like Facebook. However, it might not take such a drastic measure to truly undermine the company’s business model.

Senators Richard Blumenthal (D-Conn.) and Ed Markey (D-Mass.) recently introduced the Customer Online Notification for Stopping Edge-provider Network Transgressions or CONSENT Act. Among other elements, this would require social networks like Facebook to only collect data on users who actively “opt-in” to having their data collected. Facebook’s current rules automatically collect data, unless users proactively opt-out.

Privacy advocates like the ACLU have already begun highlighting the lack of an opt-in feature on Facebook. But some say that kind of upfront choice about whether or not to allow Facebook to collect users’ data could be the death of of the social media giant.

“If every time Facebook was spying on you and stalking you, you could actually see them like a big image right in your vision, then Facebook would have been out of business 10 years ago,’ Weinstein said.

If Facebook were mandated by law to create an opt-in feature when their mishandling of personal information is garnering so many negative headlines, it’s hard to imagine many users actively deciding to allow Facebook access to their personal information, just so that they’ll see tailored ads in their Facebook feeds.

Perhaps that’s why the conciliatory Zuckerberg would not explicitly endorse an opt-in feature in Wednesday’s hearing, only going as far as saying that he was “open to discuss” the possibility. If Congress decides to pass the CONSENT Act, he might not have a choice.