Facebook is the subject of a recent media blitz due to the allegations that 50 million people had their information improperly disclosed to Cambridge Analytica, a data research firm that may have played a role in the 2016 election.

The premise of the allegations is that Cambridge Analytica sent out a personality test to roughly 270,000 of Facebook’s users, stating that it would use the test for academic purposes.  However, allegedly, Cambridge Analytica collected the personal information not only of those who replied to the survey, but also of all of those individuals’ Facebook “friends.”  By doing so, the 270,000 users extrapolated to 50 million users.

While this news is only a few days old, already, a Facebook user sued Facebook and Cambridge Analytica in San Jose, California federal court (Price v. Facebook, Inc., N.D. Cal., No. 18-1732, 3/20/18).  In addition to the inevitable wave of law suits, there are now reports that the Federal Trade Commission (FTC) is investigating whether this event violated Facebook’s 2011 Consent Decree.  This Consent Decree required Facebook to notify users and receive affirmative consent before sharing users’ personal data that exceeds the privacy settings that each user individually specifies.  If the FTC finds that Facebook violated its Consent Decree, Facebook could find itself facing a penalty of up to $40,000 per violation.  When considering the sheer number of users that are potentially affected, Facebook could be facing a steep penalty depending on the results of the FTC’s investigation.  If that wasn’t enough, Facebook officials are in the midst of briefing members of congressional intelligence committees.  We will continue to follow developments as they arise.