VIA E-MAIL
July 25, 2019
Heather Hippsley
Chief FOIA Officer
Freedom of Information Act Request
Office of General Counsel
Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, DC 20580
Dear Ms. Hippsley:
This letter constitutes an urgent request under the Freedom of Information Act (“FOIA”), 5
U.S.C. § 552, and is submitted on behalf of the Electronic Privacy Information Center (“EPIC”) to
the Federal Trade Commission (“FTC”).
EPIC seeks all consumer complaints about Facebook sent to the FTC after the Commission
voted to accept the proposed consent order with Facebook on November 29, 2011 to June 12, 2019.
1
According to a Stipulated Order now pending before a federal court, the Federal Trade Commission
and Facebook:
have consented to entry of this Stipulated Order to resolve any and all claims that
Defendant, its officers, and directors, prior to June 12, 2019, violated the
Commission’s Decision and Order in In re Facebook, Inc., C-4365, 2012 FTC LEXIS
135 (F.T.C. July 27, 2012). Furthermore, this Stipulated Order resolves all consumer-
protection claims known by the FTC prior to June 12, 2019, that Defendant, its
officers, and directors violated Section 5 of the FTC Act. The FTC and the United
States specifically reserve all other claims.
2
1
See e.g., “Facebook is obligated to keep the promises about privacy that it makes to its hundreds of millions
of users,’ said Jon Leibowitz, Chairman of the FTC. . . . Facebook's privacy practices were the subject of
complaints filed with the FTC by the Electronic Privacy Information Center and a coalition of consumer
groups.” Press Release, Fed. Trade Comm’n, Facebook Settles FTC Charges That It Deceived Consumers By
Failing To Keep Privacy Promises (Nov. 29, 2011), https://www.ftc.gov/news-events/press-
releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep.
2
Proposed Stipulated Order, United States v. Facebook, Inc., 19-2184, ECF No. 2-1 (July 24, 2019)
[hereinafter Stipulated Order] available at
https://www.ftc.gov/system/files/documents/cases/182_3109_facebook_order_filed_7-24-19.pdf.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
2
Documents Requested
EPIC seeks the following records concerning consumer privacy complaints about
Facebook, now pending at the Federal Trade Commission, for the period of November 29,
2011 to June 12, 2019:
(1) All complaints, request for investigation, and similar “complaint-like” records
made by third parties to the FTC about Facebook submitted by any other
means outside the Consumer Sentinal database,
(2) All consumer complaints about Facebook sent to the FTC in the Consumer
Sentinal database narrowed to the following data fields:
• Complaint Date
• Company Normalized Name
• Complaint Info Comments
• Complaint Info Law Violation Code
• Complaint Info Law Violation Description
• Complaint Info Topic Description
• Complaint Infor Complaint Disposition
• Complaint Info Cross Border Complaint?
EPIC requests responsive electronic records to be produced in its native file format that contains the
original metadata of the files. For example, Microsoft Excel spreadsheets are to be produced as files
that open in Excel, with all original data and formulas intact. If records cannot be produced in their
native format, EPIC asks (1) an explanation of why the records cannot be produced and (2) that the
records be provided electronically in a text-searchable, static-image format (PDF), in the best image
quality in the FTC’s possession.
Background
From 2009 to 2011, the EPIC and a coalition of consumer organizations filed several
complaints with the FTC, alleging that Facebook was changing user settings and disclosing personal
data to third parties without consent.
3
EPIC had conducted extensive research and documented the
instances of Facebook overriding the users’ privacy settings to make personal information publicly
available and enabling application developers to collect the personal information of users’ friend
networks without their knowledge or affirmative consent.
4
3
EPIC, et al, In the Matter of Facebook, Inc. (Complaint, Request for Investigation, Injunction, and Other
Relief) (Dec. 17, 2009), https://epic.org/privacy/inrefacebook/EPIC-FacebookComplaint.pdf; See also, EPIC,
Supplemental Materials in Support of Pending Complaint and Request for Injunction, Request for
Investigation and for Other Relief (January 14, 2010),
https://epic.org/privacy/inrefacebook/EPIC_Facebook_Supp.pdf; In re Facebook, EPIC.org,
https://epic.org/privacy/inrefacebook/.
4
Press Release, Fed. Trade Comm’n, Facebook Settles FTC Charges that It Deceived Consumers by Failing
to Keep Privacy Promises (Nov. 29, 2011), https://www.ftc.gov/news-events/press-
releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
3
In response to EPIC’s complaints and detailed investigation, the FTC gathered further
information and eventually issued a consent order against Facebook.
5
In the announcement of the
settlement, the FTC stated that “Facebook told users they could restrict sharing of data to limited
audiences – for example with ‘Friends Only.’ In fact, selecting ‘Friends Only’ did not prevent their
information from being shared with third-party applications their friends used.”
6
And the FTC found
unfair or deceptive practices in Facebook’s “Verified Apps” program, which falsely claimed to
certify the security of participating apps to protect user privacy.
7
The consent order bars Facebook from making any future misrepresentations about privacy
and security of a user’s personal information, requires Facebook to establish a comprehensive
privacy program, requires Facebook to remove user information within thirty dates after a user
deletes an account, requires Facebook to obtain a user’s express consent before enacting changes in
its data sharing methods, and requires Facebook to have an independent privacy audit every two
years.
8
Cambridge Analytica Breach
On March 16, 2018, Facebook
admitted to the unlawful transfer of up to 87 million user
profiles to the data mining firm Cambridge Analytica.
9
That company harvested the data obtained
from Facebook without user consent to influence the 2016 U.S. presidential election and the vote on
Brexit.
10
Cambridge Analytica collected the private information of approximately 270,000 users and
their extensive friend networks under false pretenses as a research-driven application.
11
This clearly
violates the consent order, which states that Facebook “shall not misrepresent in any manner,
expressly or by implication … the extent to which [Facebook] makes or has made covered
information accessible to third parties; and the steps [Facebook] takes or has taken to verify the
privacy or security protections that any third party provides.”
12
In the wake of the Cambridge Analytica breach, Congress held a joint hearing about
Facebook’s failure to protect the personal data of users, calling on Mark Zuckerberg to publicy
5
In the Matter of Facebook, Inc., a corporation, Fed. Trade Comm’n,
https://www.ftc.gov/enforcement/cases-proceedings/092-3184/facebook-inc.
6
Id.
7
Id.
8
Consent Order, In the Matter of Facebook, Inc., Docket No. C-4365, 3–4 (Federal Trade Commission July
27, 2012), https://www.ftc.gov/sites/default/files/documents/cases/2012/08/120810facebookdo.pdf
[hereinafter Consent Order].
9
Press Release, Facebook, Suspending Cambridge Analytica and SCL Group from Facebook (Mar. 16, 2018),
https://newsroom.fb.com/news/2018/03/suspending-cambridge-analytica/.
10
See Danny Hakim & Matthew Rosenberg, Data Firm Tied to Trump Campaign Talked Business With
Russians, New York Times (Mar. 17, 2018), https://www.nytimes.com/2018/03/17/us/politics/cambridge-
analytica-russia.html.
11
Id.
12
Consent Order, supra note 8, at 3–4.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
4
testify on the company’s privacy practices.
13
Several members of Congress, including Senator
Blumenthal, stated that Facebook had violated the consent order.
14
Reports are also widespread of multiple Facebook investigations in many states and around
the world. According to Bloomberg News, Facebook faces seven separate data protection probes in
Ireland.
15
Gizmodo reports that at least six state attorneys general have launched their own
investigations of the company.
16
In October 2018, the U.K. Information Commissioner’s Office
(“ICO”) concluded its Facebook investigation in the wake of the Cambridge Analytical scandal and
fined Facebook £500,000 for failing to protect user data.
17
FTC Investigates Facebook and Issues Settlement
On March 26, 2018, the FTC confirmed that it was opening the investigation of Facebook.
18
In February 2019, it was reported that Facebook and the FTC were in discussion of a potential
settlement over privacy violations, but the settlement had not reached the Commissioners for a
vote.
19
The Commissioners met in mid-December 2018 and were briefed that the FTC had found
evidence of violations of the consent order.
20
On July 24, 2019, the FTC issued a $5 billion settlement with Facebook over its mishandling
of users’ personal information.
21
In a 3–2 vote in favor of the settlement, the FTC commissioners
voted along party lines with Commissioners Chopra and Slaughter issuing separate dissenting
13
Facebook, Social Media Privacy, and the Use and Abuse of Data: Hearing Before the S. Comm. on the
Judiciary, 115th Cong. (2018) https://www.judiciary.senate.gov/meetings/facebook-social-media-privacy-
and-the-use-and-abuse-of-data.
14
See Press Release, Senator Richard Blumenthal, Blumenthal Calls for Stricter FTC Oversight of Facebook
and Fines Over Possible Consent Decree Violations (April 19, 2018),
https://www.blumenthal.senate.gov/newsroom/press/release/blumenthal-calls-for-stricter-ftc-oversight-of-
facebook-and-fines-over-possible-consent-decree-violations.
15
Stephanie Bodoni, Facebook Faces 7 Data Probes as Irish Watchdog Gets Tough, Bloomberg News (Feb.
1, 2019), https://www.bloomberg.com/news/articles/2019-02-01/facebook-faces-seven-data-probes-as-irish-
watchdog-gets-tough?srnd=technology-vp.
16
Tom McKay, Report: Attorneys General in Six States Are Now Investigating Facebook's Data Practices,
Gizmodo (Feb. 2, 2019), https://gizmodo.com/report-attorneys-general-in-six-states-are-now-investi-
1832294726.
17
Jim Waterson, UK Fines Facebook £500,000 for Failing to Protect User Data, The Guardian (Oct. 25,
2018), https://www.theguardian.com/technology/2018/oct/25/facebook-fined-uk-privacy-access-user-data-
cambridge-analytica.
18
Press Release, Fed. Trade Comm’n, Statement by the Acting Director of FTC’s Bureau of Consumer
Protection Regarding Reported Concerns about Facebook Privacy Practices (Mar. 26, 2018),
https://www.ftc.gov/news-events/press-releases/2018/03/statement-acting-director-ftcs-bureau-consumer-
protection.
19
Cecilia King, Facebook Fine Could Total Billions if F.T.C. Talks Lead to a Deal, N.Y. Times (Feb. 14,
2019), https://www.nytimes.com/2019/02/14/technology/facebook-ftc-settlement.html.
20
Id.
21
Stipulated Order, supra note 1.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
5
opinions.
22
The $5 billion settlement is the largest fine the FTC has imposed on a technology
company and does not impose non-monetary relief that would alter Facebook’s underlying business
model..
23
According to the Stipulated Order now pending before a federal court:
The parties have consented to entry of this Stipulated Order to resolve any and all
claims that Defendant, its officers, and directors, prior to June 12, 2019, violated the
Commission’s Decision and Order in In re Facebook, Inc., C-4365, 2012 FTC LEXIS
135 (F.T.C. July 27, 2012). Furthermore, this Stipulated Order resolves all consumer-
protection claims known by the FTC prior to June 12, 2019, that Defendant, its
officers, and directors violated Section 5 of the FTC Act. The FTC and the United
States specifically reserve all other claims.
24
Request for Expedition
EPIC is entitled to expedited processing of this request under the FOIA and the FTC’s FOIA
regulations because there is a “compelling need.” 5 U.S.C. § 552(a)(6)(E)(v)(II); 16 C.F.R. §
4.11(a)(1)(i)(G). Specifically, this request is entitled to expedited processing because, first, there is
an “urgency to inform the public concerning [an] actual . . . Government activity,” and second, this
request is made by “a person primarily engaged in disseminating information.” 16 C.F.R. §
4.11(a)(1)(i)(G).
First, there is an “urgency to inform the public concerning [an] actual . . . Government
activity.” § 4.11(a)(1)(i)(G). The collection, documentation, and retention of consumer complaints
and investigation requests submitted to the FTC constitutes an “actual . . . Government activity.”
The “urgency” to inform the public about this activity is clear given that despite the FTC and
Facebook reaching a settlement, the court has not formally issued a judgement on the July 24, 2019
proposed order. The proposed order “resolves” all pending consumer complaints prior to June 12,
2019, which effectively nullifies all consumer complaints alleging violations of the 2011 Consent
Order. The court could issue a final judgement on the proposed order at any time, thereby
immunizing Facebook from any unaddressed consumer complaint allegations of consent order
violations. The release of the requested information will inform the public about the nature and
scope of consumer complaints pending at the Commission at the time the agency entered into the
settlement agreement. This information will help the public and the Congress assess whether the
settlement reached with Facebook sufficiently addresses the consumer complaints filed prior to June
12, 2019.
Second, EPIC is an organization “primarily engaged in disseminating information” to the
public because it is a representative of the news media. 16 C.F.R. § 4.11(a)(1)(i)(G). As the Court
22
Press Release, Fed. Trade Comm’n, FTC Imposes $5 Billion Penalty and Sweeping New Privacy
Restrictions on Facebook (July 25, 2019), https://www.ftc.gov/news-events/press-releases/2019/07/ftc-
imposes-5-billion-penalty-sweeping-new-privacy-restrictions.
23
Id.
24
Stipulated Order, supra note 1, at 1.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
6
explained in EPIC v. DOD, “EPIC satisfies the definition of ‘representative of the news media’”
entitling it to preferred fee status under the FOIA. 241 F. Supp. 2d 5, 15 (D.D.C. 2003).
In submitting this request for expedited processing, EPIC certifies that this explanation is true
and correct to the best of its knowledge and belief. 16 C.F.R. § 4.11(a)(1)(i)(G); 5 U.S.C. §
552(a)(6)(E)(vi).
Request for “News Media” Fee Status and Public Interest Fee Waiver
EPIC is a “representative of the news media” for fee classification purposes. EPIC v. DOD,
241 F. Supp. 2d 5 (D.D.C. 2003). Based on EPIC’s status as a “news media” requester, EPIC is
entitled to receive the requested record with only duplication fees assessed. 16 C.F.R. §
4.8(b)(2)(iii); 5 U.S.C. § 552(a)(4)(A)(ii)(II).
Further, any duplication fees should also be waived because (i) disclosure of the requested
information is “likely to contribute significantly to the public understanding of the operations or
activities of the government” and (ii) disclosure of the information is not “primarily in the
commercial interest” of EPIC, the requester. 16 C.F.R. §§ 4.8(e)(2)(i)–(ii); 5 U.S.C. §
552(a)(4)(A)(iii). EPIC’s request satisfies this standard based on the FTC’s considerations for
granting a fee waiver. 16 C.F.R. § 4.8(e)(2).
(1) Disclosure of the requested information is likely to contribute to the public understanding
of the operations or activities of the government.
First, disclosure of the requested documents is in the public interest because it is “likely to
contribute significantly to public understanding of the operations or activities of the government.” 16
C.F.R. § 4.8(2)(i). The FTC components evaluate four factors to determine whether this requirement
is met: (i) the subject matter of the request “concerns the operation and activities of the Federal
government”; (ii) the disclosure “is likely to contribute to an understanding of these operations or
activities”; (iii) the disclosure “is likely to contribute [to] public understanding” of the issue; and (iv)
the disclosure will provide a “significant” contribution to public understanding; §§ 4.8(2)(i)(A)–(D).
On the first factor, the subject of the request self-evidently concerns identifiable “operations
or activities of the Federal government.” 16 C.F.R. § 4.8(2)(i)(A). As previously stated, the subject
of this request self-evidently concerns consumer complaints submitted to the FTC about Facebook.
The FTC maintains information about these complaints in several of its computer databases.
25
Additionally, EPIC and other organizations have filed several consumer complaints about Facebook
to the FTC using alternative means, including e-mail and FTC electronic filings.
On the second factor, disclosure “is likely to contribute to an understanding of these
operations or activities” because the FTC has not published any information about these consumer
complaints against Facebook. 16 C.F.R. § 4.8(2)(i)(B). The FTC relies on consumer complaints to
investigate and take enforcement action towards companies with unfair or deceptive business
practices. For instance, the FTC attributed the Facebook charges regarding its privacy practices to
25
See Fed. Trade Comm’n, Frequently Asked Questions: What types of records can I request under FOIA?,
https://www.ftc.gov/about-ftc/foia/frequently-asked-questions-faq#request.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
7
complaints filed by EPIC and a coalition of consumer groups.
26
The release of this information will
contribute to the understanding of how many consumer complaints have been submitted to the FTC
about Facebook and on what basis.
On the third factor, disclosure “is likely to contribute [to] public understanding” of the issue.
16 C.F.R. § 4.8(2)(i)(C). EPIC is a registered non-profit organization committed to privacy, open
government, and civil liberties.
27
EPIC consistently publishes critical documents obtained through
the FOIA and through litigation on its robust website for educational purposes.
28
Moreover, EPIC
publishes an award-winning email and online newsletter that always highlights critical documents
obtained through the FOIA.
29
EPIC’s FOIA work is also prominently featured in major media
outlets.
30
On the fourth factor, the disclosure will provide a “significant” contribution to public
understanding. 16 C.F.R. § 4.8(2)(i)(D). The FTC maintains a FOIA Reading Room of frequently
requested records and has dedicated a page for Facebook as a “Hot Topic” item.
31
The FTC’s
Facebook frequently requested records page, however, has no information about consumer
complaints submitted to FTC about Facebook. Since the consent order, the public has been left in the
dark about whether the FTC has been appropriately enforcing the order and investigating any
potential privacy violations by Facebook. The FTC’s recent settlement and proposed order does not
identify all privacy violation claims and if any of the alleged violations are going unaddressed. The
release of this information would significantly contribute to the public understanding of whether the
FTC has been fulfilling its function in safeguarding online privacy when prompted by the public
through consumer complaints of potential unfair or deceptive practices by Facebook that violate the
consent order.
(2) Disclosure of the information is not primarily in the commercial interest of the requester
Second, disclosure of the information is not “primarily in [EPIC’s] commercial interest.” 16
C.F.R. § 4.8(2)(ii)(A). Again, EPIC is a registered non-profit organization committed to privacy,
open government, and civil liberties. EPIC has no commercial interest in the requested records and
has established there is significant public interest in the requested records.
For these reasons, EPIC’s fee waiver request should be granted.
26
Press Release, Fed. Trade Comm’n, Facebook Settles FTC Charges That It Deceived Consumers By Failing
To Keep Privacy Promises (Nov. 29, 2011), https://www.ftc.gov/news-events/press-
releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing-keep.
27
EPIC, About EPIC, http://epic.org/epic/about.html.
28
EPIC, https://www.epic.org/.
29
EPIC, EPIC Alert, https://www.epic.org/alert/.
30
See EPIC, EPIC in the News, https://epic.org/news/epic_in_news.php/.
31
See Fed. Trade Comm’n, Facebook: Released Documents, https://www.ftc.gov/about-ftc/foia/frequently-
requested-records/facebook.
EPIC FOIA Request Facebook Consumer Complaints
July 25, 2019 FTC
8
Conclusion
Thank you for your consideration of this request. EPIC anticipates your determination on its
request within ten calendar days. 16 C.F.R. § 4.11(a)(1)(i)(G); 5 U.S.C. § 552(a)(6)(E)(ii)(I). For
questions regarding this request contact Enid Zhou at 202-483-1140 x104 or [email protected], cc:
Respectfully submitted,
/s Enid Zhou
Enid Zhou
EPIC Open Government Counsel
