Latest leak could mean Facebook violated 2019 FTC settlement

A leak of 500 million Facebook users' personal information might have exposed the company to a violation of a 2019 settlement with the Federal Trade Commission.

The data includes the phone numbers, email addresses, biographical details and more that was the subject of the FTC's $5 billion penalty against the social media giant for misleading users on why it gathers and how much control they have over the information. It was previously leaked and is now more widely available.

The leak reported Saturday night could trigger further enforcement action by the consumer protection agency, which has pledged to aggressively enforce existing antitrust laws against big tech and craft new ones.

Facebook did not reply to requests for comment. It admitted it knew of the breach but did not inform users.

"This is old data that was previously reported on in 2019," tweeted Facebook communications executive Liz Bourgeois on Saturday. "We found and fixed this issue in August 2019."

The FTC declined to comment.

It was reported in January that access to a database of phone numbers belonging to Facebook users was being illegally sold online. That data is now available for free online, exposing it to further circulation.

Facebook was accused of engaging in misleading practices to collect the phone numbers exposed in the breach. United States of America v. Facebook Inc., 19-cv-02184 (D.D.C., filed July 24, 2019).

In the 2019 settlement with the FTC that was partially spurred by the Cambridge Analytica scandal, the company resolved claims that it falsely told users it needed phone numbers for heightened authentication measures when it also collected them to target users with additional advertising, among other claims, in violation of a 2012 agency order prohibiting it from further misrepresenting its privacy practices.

The settlement did not release Facebook, which did not admit or deny guilt, for violations the FTC was unaware of when it struck the deal.

"The release does not bar the commission from bringing a claim for a Section 5 violation it did not know about prior to this order," said FTC Chairman Joe Simons in a 2019 statement, referring to a policy barring unfair or deceptive business practices.

The FTC didn't detail in the deal any known claims it was releasing against the social media giant.

Facebook never informed users of the breach or how they could safeguard against fraud using their data. The leak includes the physical addresses, Facebook IDs, locations and birthdays of 533 million users in 106 countries.

Alon Gal, co-founder of Israeli cybercrime intelligence company Hudson Rock, who flagged the data breach, wrote on Twitter on Saturday, "I have yet to see Facebook acknowledging this absolute negligence of your data."

FTC Acting Chair Rebecca Slaughter voted against the settlement in 2019, denouncing it for letting Facebook off the hook despite the company flagrantly violating agreements in a prior order over the same practices. She favored initiating litigation to reform Facebook, including naming chief executive Mark Zuckerberg in the complaint.

Slaughter argued that litigation, even if the FTC loses, could push Congress to craft new laws to address the company's privacy violations.

"A hard-fought litigation against Facebook produced a result that fell short of public expectations. The public would have every incentive to demand that Congress take steps to address deficiencies in the law," she wrote in a dissent.

She, along with former commissioner Rohit Chopra, who similarly voted to instead pursue a lawsuit against Facebook, also objected to the immunity the settlement granted to the company and its directors for unspecified violations.

"Allowing blanket immunity for unknown claims effectively rewards Facebook for not proactively disclosing its failures, even as the company is still not admitting those failures," Chopra wrote, calling the scope of release "unprecedented" in commission history.