Federal regulators investigating Facebook for mishandling its users' personal information have set their sights on the company's CEO, Mark Zuckerberg, exploring his past statements on privacy and weighing whether to seek new, heightened oversight of his leadership.
The discussions about how to hold Zuckerberg accountable for Facebook's data lapses have come in the context of wide-ranging talks between the Federal Trade Commission and Facebook that could settle the government's more than year-old probe, according to two people familiar with the discussions. Both requested anonymity because the FTC's inquiry is confidential under law.
Such a move could create new legal, political and public-relations headaches for one of Silicon Valley's best known - and image conscious - corporate leaders. Zuckerberg is Facebook's co-founder, chief executive, board chairman and most powerful stock owner, and a sanction from the federal government would be seen as a rare rebuke to him and the tech giant's historic "move fast and break things" ethos.
Often, the FTC does not target executives in cases in which it finds a company's business practices have violated web users' privacy. But critics said targeting Zuckerberg could show other tech giants that the agency is willing to hold top executives directly accountable for their firms' repeated data misdeeds.
"The days of pretending this is an innocent platform are over, and citing Mark in a large-scale enforcement action would drive that home in spades," said Roger McNamee, an early investor in the company and one of Zuckerberg's critics.
In past investigations of Facebook, the U.S. government opted to spare Zuckerberg from the most onerous scrutiny. Documents obtained from the FTC under federal open-records rules reflect that the agency considered, then backed down from, putting Zuckerberg directly under order during its last settlement with Facebook in 2011. Had it done so, Zuckerberg could have faced fines for future privacy violations.
Asked about the negotiations, Facebook said in a statement that it "hope(s) to reach an appropriate and fair resolution." The FTC declined to comment for this story.
The FTC began investigating Facebook in March 2018, amid reports that Cambridge Analytica, a political consultancy, improperly accessed data on roughly 87 million of the social networking site's users. The federal probe has focused on whether Facebook violated an agreement, brokered with the FTC in 2011, that required the company to improve its privacy practices. Since then, Facebook has acknowledged a series of additional privacy lapses, including an admission Thursday that it mishandled millions of users' passwords on Instagram, its photo-sharing service.
Appearing before Congress last year, Zuckerberg sought to take personal responsibility for a range of his company's recent missteps, including Facebook's entanglement with Cambridge Analytica. "I started Facebook, I run it and I'm responsible for what happens here," he told lawmakers. But the Facebook chief still maintained that the company did not commit a "violation of the consent decree" it had struck with the FTC.
Settling that federal inquiry, now more than a year old, could force Facebook to make significant concessions, including paying a fine ranging into the billions of dollars, The Washington Post has reported. It could lead to new obligations targeting Zuckerberg, too. One idea that has been raised could require him or other executives to certify the company's privacy practices periodically to the board of directors, two people familiar with the matter said, along with heightened oversight by the FTC.
It is unclear whether the FTC and Facebook are still contemplating such a requirement, or whether they've struck an agreement on these or other outstanding matters. But Facebook has fought fiercely to shield Zuckerberg as part of the negotiations, one of the sources familiar with the probe said. Either Facebook or the FTC could choose to walk away from talks, resulting in the matter heading to court.
The idea of holding Zuckerberg accountable - and even subjecting him to penalties for Facebook's alleged mishandling of users' data - has gained political traction in Washington. On Thursday, Sen. Richard Blumenthal, D-Conn., said the company's top executive "wasn't just aware of Facebook's invasion of consumer privacy, he signed off on it and publicly downplayed legitimate concerns."
"Holding Mark Zuckerberg and other top Facebook executives personally at fault and liable for further wrongdoing would send a powerful message to business leaders across the country: You will pay a hefty price for skirting the law and deceiving consumers," Blumenthal said.
Some of the FTC's own decision-makers also have aired their support for penalties against executives when their companies are under investigation. In a May 2018 memo, Democratic Commissioner Rohit Chopra said the agency "should hold individual executives accountable for order violations in which they participated, even if these individuals were not named in the original orders." He didn't mention Facebook by name, and he did not respond to requests for comment.
Zuckerberg still could escape largely unaffected as a result of negotiations with the FTC. If he does, it would not be the first time. More than eight years ago, when the FTC cobbled together its initial settlement with Facebook, agency staffers weighed whether to target Zuckerberg personally. An early, unreleased and undated draft of the FTC's consent order against Facebook, obtained by The Post through a Freedom of Information Act request, explicitly named Zuckerberg as a respondent - meaning he would have faced heightened federal oversight and the risk of fines and other penalties in the event of future privacy missteps.
In the end, however, the FTC dropped mention of him from a version of the order shared around April 2011, according to email records obtained from the agency under open-records laws. The agency also considered, then removed, a provision from its early settlement that would have required Facebook to pay an unspecified sum to the government, the records show. The form of punishment, called disgorgement, requires a company to return ill-gotten monetary gains. The draft consent decree included only an "xxx" instead of an exact amount, and the language was ultimately removed by the time the FTC announced its agreement with Facebook in November 2011.
This time, FTC veterans have encouraged the agency to take direct aim at Zuckerberg, even putting him personally under order and subjecting him to further federal oversight. David Vladeck, who served as the director of the Bureau of Consumer Protection at the FTC in 2011, criticized the company this week because it "did not take that first consent decree seriously."
"I would hope any future order names Zuckerberg," he said, adding that doing so "ratchets pressure up on the company to make the CEO responsible."
Brokered in 2011, the FTC's consent decree with Facebook requires the company to be more upfront with consumers about the data it collects and give them permission before it overrides their existing privacy settings. Facebook also is barred from misrepresenting what it does with users' data, while submitting to 20 years of privacy checkups.
Talks between Facebook and the FTC have intensified in recent weeks, as the agency's investigation passed its one-year anniversary. Top Facebook officials, including General Counsel Colin Stretch, met with individual Democratic and Republican commissioners in March, according to two additional sources familiar with the agency's work but not authorized to discuss a private probe.
While the FTC probes Facebook, a number of states' attorneys general have embarked on their own investigations. The attorney general of the District of Columbia has filed a privacy lawsuit against the company.