UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA,

Plaintiff,

v. Civil Action No. 19-2184 (TJK)

FACEBOOK, INC.,

Defendant.

MEMORANDUM OPINION

Almost eight years ago, the Federal Trade Commission and Facebook agreed to settle

allegations that Facebook’s information-sharing and privacy practices violated Section 5 of the

Federal Trade Commission Act because they were unfair and deceptive. As part of that

agreement, memorialized in an administrative order entered by the FTC, Facebook committed to

maintaining a privacy program and to not misrepresenting the privacy protections it afforded its

users. But according to the United States, Facebook did not keep its word, and over the next

months and years it violated both the FTC Act and the order in many ways. Last year, the parties

agreed to settle these fresh allegations about Facebook’s privacy practices. Before the Court is

their consent motion to enter a proposed stipulated order. Among other things, the order would

require Facebook to pay a $5 billion civil money penalty—by far the largest penalty ever won by

the United States on behalf of the FTC—and impose injunctive relief in the form of an amended

administrative order to be entered by the FTC that would require Facebook to take a variety of

additional measures to protect its users’ personal information.

In the Court’s view, the unscrupulous way in which the United States alleges Facebook

violated both the law and the administrative order is stunning. And these allegations, and the briefs of some amici, call into question the adequacy of laws governing how technology

companies that collect and monetize Americans’ personal information must treat that

information. But those concerns are largely for Congress; they are not relevant here. Mindful of

its proper role, and especially considering the deference to which the Executive’s enforcement

discretion is entitled, the Court will grant the consent motion and enter the order as proposed.

Background

A. Facebook

Facebook, Inc. (“Facebook”) operates a social-networking service through its website and

mobile applications. ECF No. 3 (“Compl.”) ¶ 2. Those applications connect Facebook’s users,

who each create a profile that includes their personal information, with “Friends” who also have

Facebook accounts and profiles. Id. Through its service, Facebook collects and maintains huge

amounts of its users’ information. Id. As of 2018, Facebook had more than 2.2 billion monthly

active users worldwide. Id. And over 100 million Americans use Facebook every day to share

personal information, such as their name, date of birth, hometown, current city, employer,

relationship status, political views, photos of minor children, and membership in health-related

and other support groups. Id. In addition, Facebook users may install and use applications

developed by third parties that allow users to share information with each other. Id. The

collection and maintenance of its users’ personal information is an essential part of Facebook’s

business model. That model monetizes users’ personal information by deploying it for

advertising; indeed, almost all of Facebook’s revenue comes from advertising. Id. ¶ 3.

B. 2012 Consent Agreement and Order

In 2012, the Federal Trade Commission (FTC) filed an administrative complaint alleging

that Facebook engaged in unfair and deceptive acts or practices in violation of Section 5(a) of the

Federal Trade Commission Act,

(a) (“FTC Act”). See In the Matter of Facebook,

2 Inc., Dkt. No. C-4365,

(F.T.C.) (July 27, 2012) (“2012 Action”). The FTC

brought eight counts alleging, among other things, that Facebook misled its users about (1) its

privacy settings and privacy policy changes, see

¶¶ 10–29; (2) how much it shared its users’

personal information with third-party application developers;

¶¶ 30–33; (3) how much it

shared its users’ personal information with outside advertisers, see

¶¶ 34–42; (4) the steps it

took to verify the security and privacy practices of third-party application developers, see

¶¶ 43–49; (5) how much it shared its users’ personal information, including photos and videos,

with third parties after a user deleted its account, see

¶¶ 50–55; and (6) its compliance with

international privacy protocols, see

¶¶ 56–63.

Facebook and the FTC reached a settlement in August 2012. Compl. ¶ 28. The FTC

then issued an order (“2012 Order”)—which Facebook’s General Counsel signed on the

company’s behalf—outlining remedial actions Facebook had to take. See

¶¶ 28–34.

Facebook was prohibited from making misrepresentations about the extent to which it maintains

the privacy or security of its users’ personal information; the extent to which its users can control

the privacy of that information, and how they can do so; and the extent to which it makes its

users’ personal information accessible to third parties. See

. Facebook was also required

to establish and maintain “a comprehensive privacy program that [was] reasonably designed to

(1) address privacy risks related to the development and management of new and existing

products and services for consumers, and (2) protect the privacy and confidentiality of [its users’

personal] information.”

. Facebook’s privacy program was also required to consider

reasonably foreseeable risks to users’ privacy, and Facebook had to monitor and evaluate the

program on an ongoing basis. See

The order expires in July 2032, or 20 years from the date

the FTC filed its administrative complaint. See 2012 Action at *83.

3 C. This Action

1. Complaint

The United States now alleges that Facebook violated the 2012 Order by “subvert[ing]

users privacy choices to serve its own business interests” in several ways, starting almost

immediately after agreeing to comply with the 2012 Order. Compl. ¶ 4. Although Facebook led

its users to believe they could restrict who could view their personal information, it allegedly

shared that information with third parties without the user’s knowledge. See Compl. ¶¶ 35–50.

For example, Facebook allegedly told its users that they could limit those who could see their

posts to just “Friends,” when in reality—and without warning to the user—doing so would also

allow developers of third-party applications used by their “Friends” to access the post. See

46–48. Facebook allegedly permitted third-party developers to access these posts even though it

was aware of how that practice compromised its users’ privacy interests. See

¶¶ 81–91. And

Facebook allegedly continued to allow a subset of third-party developers to access its users’

personal formation in this way without their users’ knowledge even after it announced, two

different times, that it would stop doing so. See

¶¶ 92–100; 106–13. Facebook also allegedly

automatically activated certain facial recognition technologies on a subset of about 60 million

user accounts and maintained that technology’s activation while telling its users that it would

only do so if a user requested it. See

¶¶ 144–54.

The United States also alleges that Facebook’s privacy settings and policies compromised

its users’ privacy in various other ways. For example, Facebook allegedly misled its users

through its desktop and mobile interfaces by causing them to default to settings that were not

privacy-protective; removing key disclaimers; and making interfaces hard to navigate, especially

when it came to users’ ability to stop the sharing of their personal information with developers of

third-party applications used by their “Friends.” See

¶¶ 51–80. Moreover, Facebook’s so-

4 called “Privacy Checkup,” a tool that it represented would allow users to control who had access

to their information, allegedly failed to alert users that third-party developers could continue to

view their information no matter what settings were selected through the “Privacy Checkup.”

See

¶¶ 101–105. And even though Facebook agreed to maintain a reasonable privacy

program, it allegedly failed to screen third-party application developers before giving them

access to users’ information and did not consistently enforce the few policies it had about the

protection and use of its users’ information when developers violated those policies. See

¶¶ 114–24. In fact, Facebook’s enforcement decisions allegedly “took into account the financial

benefit that Facebook considered the developer to offer.”

. Moreover, because of

Facebook’s deficient controls, the company allegedly still did not know at the time the

Complaint was filed how much data it improperly released to third-party application developers,

exactly to which developers the data was released, or the purposes for which the developers used

it. See

¶¶ 126–27.

Facebook is also alleged to have misled users about what information it shared with

advertisers. Facebook purportedly encouraged users to provide their telephone numbers so that

they could protect their accounts with two-factor authentication. See

¶¶ 128–30. Facebook

did not, however, warn these users that it would also use these telephone numbers for advertising

purposes. See

¶¶ 131–43.

Based on this alleged conduct, the Complaint filed by the United States includes five

counts accusing Facebook of violating the 2012 Order by misrepresenting to its users how much

control they had over their personal information and how much third-party application

developers could access that information, see

¶¶ 155–75, 183–86, and by failing to maintain a

reasonable privacy program, see

¶¶ 176–82. The Complaint also includes one count alleging

5 that Facebook violated Section 5 of the FTC Act by failing to disclose to its users that it would

use the telephone numbers they provided to it for two-factor authentication for advertising

purposes as well. See

¶¶ 187–90.

2. Stipulated Order

The parties represent that they have reached a settlement. See ECF No. 4 (“Consent

Mtn.”) at 1. The United States has moved, with Facebook’s consent, for the Court to enter a

stipulated order that imposes a $5 billion civil money penalty on Facebook and imposes

injunctive relief in the form of an amended administrative order to be entered by the FTC. See

ECF No. 4-1 (“Stipulated Order”) at 1–4. The amended administrative order, included as

Attachment A to the Stipulated Order, requires Facebook to take a series of remedial steps,

including: (1) ceasing its misrepresentations about a host of matters, including its collection, use,

and disclosure of its users’ personal information; the extent to which it maintains the privacy or

security of that information; the extent to which users can control the privacy of that information,

and how they can do so; and the extent to which it makes its users’ personal information

accessible to third parties; (2) clearly disclosing when it will share its users’ personal information

with third parties, and obtaining a user’s express consent to do so if the information sharing goes

beyond the restrictions imposed by the user’s privacy settings; (3) deleting or de-identifying

users’ personal information within a reasonable time after a user deletes it or closes her account;

(4) stopping using telephone numbers provided by users for security purposes for advertising

purposes as well; (5) obtaining a user’s specific consent before applying facial recognition

technology to their account; (6) implementing a more robust privacy program, which must

include safeguards that apply to third parties with access to a user’s personal information; (7)

creating an independent committee of Facebook’s board of directors to oversee information

privacy efforts; (8) designating a corporate officer in charge of monitoring its privacy program

6 and ensuring the program is effective—and who only can only be removed with a majority vote

of the newly created board committee; (9) commissioning regular, independent assessments of

its privacy practices and providing them to the FTC; (10) alerting the FTC when it discovers that

more than 500 users’ personal information has been compromised in some way; and (11)

undertaking other reporting and recordkeeping obligations, including annually certifying

compliance with the order and facilitating any FTC investigation into its compliance. See

at

8–29. 1 In exchange, under the Stipulated Order, Facebook receives considerable reprieve from

liability. The “Stipulated Order resolves all consumer-protection claims known by the FTC prior

to June 12, 2019, that [Facebook], its officers, and directors violated Section 5 of the FTC Act.”

See

at 1–2. The amended administrative order terminates 20 years after it is issued, or 20

years after the United States or the FTC files a complaint against Facebook alleging that it

violated the order. See

at 28–29.

Legal Standard

“[P]rior to approving a consent decree a court must satisfy itself of the settlement’s

overall fairness to beneficiaries and consistency with the public interest.” Citizens for a Better

Env’t v. Gorsuch,

, 1126 (D.C. Cir. 1983) (internal quotation marks omitted). But

the Court’s role is not to “inquire into the precise legal rights of the parties nor reach and resolve

the merits of the claims or controversy.” Id. (internal quotation omitted). Rather, it “need only

determine that the settlement is fair, adequate, reasonable and appropriate under the particular

facts and that there has been valid consent by the concerned parties.” Id.; see also United States

v. Wells Fargo Bank, NA,

(D.D.C. 2012) (“[S]hort of a decree that

1 Because the Stipulated Order and the amended administrative order are both included in ECF No. 4-1, the Court cites to page numbers in the document’s ECF header.

7 ‘make[s] a mockery of judicial power,’ the Court should accept an agreement between the

parties.”) (quoting United States v. Microsoft Corp.,

(D.C. Cir. 1995)). Both

the judiciary and the public at large have an interest in avoiding costly litigation, and so

voluntary settlements are highly favored. Citizens for a Better Env’t, 718 F.2d at 1126.

Analysis

Applying this deferential standard—and despite the underhanded conduct of which the

FTC accuses Facebook—the Court finds that the Stipulated Order passes muster. Specifically,

the Court finds that the parties consented to the order, and that it is fair, reasonable, and in the

public interest.

A. Consent

The parties represent that they consent to the Court’s entry of the Stipulated Order to

settle the allegations in the Complaint. See Consent Mtn. at 1–2; see also Stipulated Order at 6–

8. They also represent that it emerged from lengthy negotiations, see Consent Mtn. at 7, and the

Court notes that both parties are sophisticated and ably represented by counsel. These facts

amply support the Court’s conclusion that the parties have validly consented to the Stipulated

Order. See Wells Fargo,

.

B. Fairness

Procedurally, “[v]alid consent that resulted from good faith bargaining itself indicates

that the agreement is procedurally fair,”

and there is no evidence of any conflicts of interest

that might have tainted the negotiating process, see

Substantively, the Stipulated Order

reflects a compromise and includes benefits to both parties. The United States receives what it

asserts is by far the largest civil money penalty ever obtained on behalf of the FTC, and the

second largest in any context, Consent Mtn. at 4, as well as extensive injunctive relief, described

in more detail below. Facebook obtains a release from Section 5 violations known to the FTC.

8 Stipulated Order at 1–2. And both parties avoid the cost and uncertainty associated with lengthy

litigation. That Facebook does not admit the allegations in the Complaint does not suggest that

the resolution is unfair. See Stipulated Order at 2; Microsoft,

; see also Wells

Fargo,

.

C. Reasonableness

The D.C. Circuit has explained that a district court evaluating a consent agreement should

be cautious about second guessing the parties’ judgments. See Microsoft, 56 F.3d at 1460–61.

After all, “[r]emedies which appear less than vigorous may well reflect an underlying weakness

in the government’s case, and for the district judge to assume that the allegations in the

complaint have been formally made out is quite unwarranted.” Id. at 1461. Although the

allegations the United States levels against Facebook for duplicitous privacy-related

representations to its users are shocking, it is not appropriate for the Court to judge the Stipulated

Order as if it were proposed after the United States had already proven those allegations up at

trial. See id. (noting that it is “inappropriate for the judge to measure the remedies in the decree

as if they were fashioned after trial”). Rather, the Court’s analysis must focus on whether the

proposed order achieves its stated objective. See Envtl. Def. v. Leavitt,

(D.D.C. 2004) (“The factors for determining the adequacy, reasonableness and appropriateness

of a consent decree focus on the extent to which the decree is confined to the dispute between the

parties and whether the decree adequately accomplishes its purported goal.”). In other words,

the Court must assess whether the Stipulated Order is a reasonable resolution of the allegations

outlined in the Complaint.

Judged by that standard, the Court concludes the Stipulated Order clears the modest bar

of reasonableness. The allegations in the Complaint reflect many ways in which Facebook

purportedly acted improperly. Some of these allegations represent discrete and poorly

9 considered decisions, such as allegedly encouraging users to provide phone numbers to better

secure their accounts, but then using those same numbers for advertising without telling users

beforehand. Others appear to reflect Facebook’s willingness to deceive its users outright, such as

allegedly telling the public that it would not share their personal information with third parties

when it was continuing to do so. And still others represent systemic oversight failures, such as

allegedly allowing third parties to access users’ personal information without the users’

knowledge and without controlling how those third parties would use the information. Most of

these allegations represent violations of the 2012 Order; several are new violations of law. But

all of them suggest that the privacy-related decisionmaking of Facebook’s executives was subject

to grossly insufficient transparency and accountability.

The Stipulated Order appears reasonably calculated to address these allegations. To

begin with, it imposes a $5 billion fine to deter similar conduct by Facebook in the future.

Stipulated Order at 3. That is, by any measure, a significant amount. The United States

contends it is “the largest civil penalty ever obtained . . . on behalf of the FTC—dwarfing the

previous record of $168 million.” ECF No. 28 at 3. The United States also argues that the total

breaks down to $5.56 per violation, “commensurate with . . . civil penalties obtained in contested

cases similarly involving millions of FTC Act violations by large corporations.” 2 Consent Mtn.

at 4. Facebook also claims that the fine looms even larger when compared to the largest civil

penalty ever assessed by the FTC where—as here—no consumer harm is alleged to have been

caused: $22.5 million. See ECF No. 30 at 11-12. The fine is also significant when compared to

Facebook’s bottom line; the parties agree it represents nearly a quarter of Facebook’s after-tax

2 See, e.g., United States v. Dish Network,

(C.D. Ill. 2017) ($168 million civil penalty on 66 million FTC Act violations, or $2.54 per violation).

10 profit in 2018. Id. at 3. Facebook also argues that the fine “is orders of magnitude greater than

what the FTC could reasonably have achieved at trial” given the statutory penalties and the

arguments available to it concerning how to calculate its alleged violations. ECF No. 30 at 11.

And the United States, citing the FTC’s “hard-fought” victory in United States v. Dish Network,

(C.D. Ill. 2017), appears to acknowledge that it would have been unlikely to

obtain more after a trial. See ECF No. 28 at 7–8. The Court has no reason to doubt that

judgment.

As important, the injunctive relief in the amended administrative order to be entered by

the FTC contains new measures aimed at ensuring that Facebook complies with its legal

obligations going forward. Under the amended administrative order, Facebook will have to

consider privacy at every stage of its operations and provide substantially more transparency and

accountability for its executives’ privacy-related decisions.

The amended administrative order will require Facebook, through its enhanced privacy

program, to consider and document in writing privacy risks, safeguards, training, and procedures

related to each of its products and services—including new safeguards for overseeing third-party

application developers with access to users’ information. At the operational level, the order will

require Facebook to designate one or more corporate officers in charge of monitoring its privacy

policies and ensuring they are effective—and who only a committee of its board of directors can

remove. At the corporate governance level, Facebook must stand up a new independent board

committee dedicated to information privacy—again, whose members enjoy significant removal

protections. Under the order, an independent, third-party assessor approved by the FTC will

evaluate and test Facebook’s privacy efforts, producing annual reports that must be provided to

the FTC and Facebook’s new independent board committee. Significantly, Facebook’s Chief

11 Executive Officer will have to certify regularly that Facebook is meeting its obligations under

both its privacy program and the order, potentially subjecting him to civil or criminal penalties.

Facebook will have to alert the FTC when significant privacy-related breaches occur. And the

order will empower both the Department of Justice and the FTC to demand extensive

information from Facebook to evaluate its compliance for themselves.

Finally, it bears mentioning that the requirements in the Stipulated Order are clear. See

Microsoft, 56 F.3d at 1461–62 (observing that “the district judge who must preside over the

implementation of the decree is certainly entitled to insist on that degree of precision concerning

the resolution of known issues as to make his task, in resolving subsequent disputes, reasonably

manageable”). The Stipulated Order spells out Facebook’s obligations precisely, it defines key

terms in detail, and it incorporates specific deadlines for completion of its obligations.

Amici urge the Court to reject the Stipulated Order in part because they argue it does not

go far enough. For example, the Electronic Privacy Information Center (EPIC) argues that the

$5 billion penalty is too low and that the injunctive relief is insufficient. ECF No. 26 at 18–22.

EPIC complains that the Stipulated Order does not “require meaningful changes in Facebook’s

business practices or establish new privacy protections for Facebook users.” Id. at 16. It

suggests, for example, that the United States should have required Facebook to adopt the “Code

of Fair Information Practices,” which “have been incorporated into other privacy laws and

frameworks across the world,” id. at 22–23, or forced Facebook to unwind its acquisitions of

WhatsApp and Instagram. Id. at 24. Other amici would have liked to see more protections

related to children included. See ECF No. 25 at 16–20.

As the United States concedes, amici raise some “broad and conceptually interesting

policy questions about data-privacy law in the United States generally.” ECF. No. 28 at 1. But

12 the overall terms of the Stipulated Order are not unreasonable simply because they do not apply

an entirely different privacy-focused legal regime to Facebook or require the company to be

broken apart. And the Court’s role is not to play the Executive’s part in deciding how to enforce

the law. See Microsoft, 56 F.2d at 1462 (cautioning that “when the government is challenged for

not bringing as extensive an action as it might, a district judge must be careful not to exceed his

or her constitutional role”); see also Ass’n of Irritated Residents v. EPA,

(D.C. Cir. 2007) (“Although the Supreme Court’s decision in Chaney applies directly to agency

decisions not to enforce a statute, we have also applied it to an agency’s decision to settle an

enforcement action.”) (citing Heckler v. Chaney,

(1985)). As noted above, in

evaluating the Stipulated Order’s reasonableness, the Court may not even assume that Facebook

violated the FTC Act or the 2012 Order in the first place. See Microsoft,

. While

the Court might well have fashioned different remedies were it doing so out of whole cloth after

a trial, none of amici’s criticisms call into question the Stipulated Order’s reasonableness, or

whether it is otherwise appropriate.

For these reasons, the Court finds that proposed remedies in the Stipulated Order are

reasonable in light of the allegations in the Complaint.

D. Public Interest

Finally, the Court must consider whether entering the Stipulated Order accords with the

public interest; “in other words, that the agreement is ‘not unlawful, unreasonable, or against

public policy.’” Wells Fargo,

(quoting United States v. District of

Columbia,

(D.D.C. 1996). As discussed above, the Stipulated Order

contains an unprecedented civil money penalty as well as a series of measures designed to

address the allegations in the Complaint.

13 In addition, though, this inquiry calls on the Court to consider whether entering the order

will “automatically affect the rights of third parties.”

Amici spill considerable ink on this

point. As discussed above, the Stipulated Order would release Facebook from all claims that it

violated the 2012 Order as well as “all consumer-protection claims known by the FTC prior to

June 12, 2019 that [Facebook], its officers, and directors violated Section 5 of the FTC Act.”

Stipulated Order at 1–2. Amici argue that the breadth of this release is unprecedented and reason

alone to reject the Stipulated Order. See ECF No. 25; ECF No. 26 at 13. They point to the

statements of two dissenting FTC Commissioners who both cited the scope of the release as a

reason they voted against the Stipulated Order. See ECF No. 25 at 13 n.3, 16; ECF No. 26 at 13,

15. Amici also argue that the they will be harmed by the scope of the Stipulated Order because it

would preclude the FTC from bringing other enforcement actions based on complaints amici and

others have filed with the agency, including for alleged violations of the 2012 Order. See ECF

No. 25 at 15–25; ECF No. 26 at 15–16.

These arguments by amici do not ultimately cast doubt on whether the Stipulated Order is

in the public interest. First, the Stipulated Order does not strip amici—or anyone else in a

similar situation—of any rights, because they have no right to enforce either Section 5 of the

FTC Act or the 2012 Order. As even they acknowledge, Section 5 of the FTC Act does not

contain a private right of action. See ECF No. 25 at 31; see also United States v. Philip Morris

Inc.,

(D.D.C. 2003). And as for the FTC’s administrative orders, the D.C.

Circuit “has opted for a bright line rule . . . that third parties to government consent decrees

cannot enforce those decrees absent an explicit stipulation by the government to that effect.”

SEC v. Prudential Sec. Inc.,

(D.C. Cir. 1998). Finally, amici do not suggest

that the Stipulated Order will somehow preclude them from doing what they have a right to do:

14 file complaints with the FTC accusing Facebook of violating the FTC Act or any applicable

administrative order.

Second, the admittedly broad scope of the release does not mean that the settlement is not

in the public interest. As the United States explains, the Stipulated Order does not stop the FTC

from bringing new enforcement actions against Facebook should it learn of additional violations

of Section 5 of the FTC Act, even if those violations occurred before July 12, 2019. See ECF

No. 28 at 11. And the United States represents that the proposed settlement “does not in fact

release any actual violations of the FTC Act beyond those discussed in the Complaint.”

That

is so because, after “extensive investigation and review of submitted consumer complaints, the

FTC [knows] of no other cognizable violations that occurred before June 12, 2019.” Id.; see also

at 11 n.4 (adding that “the vast majority of submitted consumer complaints involving

Facebook did not even address a privacy issue or implicate the 2012 Order, and none known to

the FTC raised a potential issue not covered by the proposed settlement”). Additionally, a

majority of the agency’s Commissioners have represented that the Stipulated Order sufficiently

addresses all known violations of the 2012 Order as well. Statement of Chairman Joe Simons

and Commissioners Noah Joshua Phillips and Christine S. Wilson Regarding the Matter of

Facebook, Inc., at 7–8 (July 24, 2019),

https://www.ftc.gov/system/files/documents/public_statements/1536946/092_3184_facebook_m

ajority_statement_7-24-19.pdf. Thus, it seems evident that the United States made a carefully

considered judgment to resolve these violations as it proposes through the Stipulated Order, a

judgment this Court is ill-equipped to second-guess. 3 Amici and even some FTC Commissioners

3 Unlike violations of the FTC Act, the Stipulated Order also releases Facebook from violations of the 2012 Order that are unknown to the United States, see Stipulated Order at 1–2. That is,

15 may disagree with that decision, but it does not follow that the Stipulated Order is not in the

public interest. See United States v. W. Elec. Co.,

, 309 (D.C. Cir. 1990) (“The

Court’s function is not to determine whether the resulting array of rights and liabilities is the one

that will best serve society, but only to confirm that the resulting settlement is within the reaches

of the public interest.”) (cleaned up)); see also Citizens for a Better Env’t,

(“Not

only the parties, but the general public as well, benefit from the saving of time and money that

results from the voluntary settlement of litigation.”).

For these reasons, the Court holds that entering the Stipulated Order is in the public

interest.

Conclusion

For all these reasons, the Court will grant the Consent Motion for Entry of Stipulated

Order, ECF No. 4, and enter the Stipulated Order. The Court ends by noting that under the

Stipulated Order it retains jurisdiction over this matter, including to enforce its terms. See

Stipulated Order at 5. In the event that the parties return to this Court because the United States

alleges—once again—that Facebook has reneged on its promises and continued to violate the

law or the terms of the amended administrative order, the Court may not apply quite the same

deference to the terms of a proposed resolution. As the D.C. Circuit has explained, a district

court must be especially deferential “when the proposed decree comes to a district judge in the

undoubtedly, a concession to Facebook. Still, the Court finds that the Stipulated Order is in the public interest and is otherwise reasonable, given that it preserves the FTC’s right to bring enforcement actions for any presently unknown violation of the law. Moreover, a majority of the agency’s Commissioners are satisfied, given the FTC’s extensive investigation, that the terms of the Stipulated Order are “more than adequate to remedy any as-yet-unknown violation” of the 2012 Order. Statement of Chairman Joe Simons and Commissioners Noah Joshua Phillips and Christine S. Wilson Regarding the Matter of Facebook, Inc., at 7–8 (July 24, 2019), https://www.ftc.gov/system/files/documents/public_statements/1536946/092_3184_facebook_m ajority_statement_7-24-19.pdf.

16 first instance as a settlement between the parties.” Microsoft,

. But, on the other

hand, when “a district judge has administered a consent decree for some period of time,” and is

therefore likely more familiar with the relevant context, “the lack of an initial trial is, at least

marginally, less of an inhibition” when weighing the appropriateness of a proposed remedy.

/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge

Date: April 23, 2020

17