Google has agreed to pay an FTC-record $22.5 million to
settle charges it violated an earlier FTC settlement when it misrepresented
that it was not placing tracking cookies or serving up targeted ads to Apple
Safari browser users.
The Federal Trade Commission says it is the largest
settlement of an agency order ever.
In addition to the money, Google has agreed to disable all
tracking cookies that it said would not be placed on users' computers.
"The record setting penalty in this matter sends a clear
message to all companies under an FTC privacy order," said FTC Jon Leibowitz in
announcing the settlement. "No matter how big or small, all companies must
abide by FTC orders against them and keep their privacy promises to consumers,
or they will end up paying many times what it would have cost to comply in the
first place."
"We set the highest standards of privacy and security for our users," Google said in a statement. "The FTC is focused on a 2009 help center page published more than two years before our consent decree, and a year before Apple changed its cookie-handling policy. We have now changed that page and taken steps to remove the ad cookies, which collected no personal information, from Apple's browsers."
The FTC vote was 4-1, but the "no" vote was not
because they backed Google. Commissioner J. Thomas Rosch dissented because the
consent decree allows Google to deny that it violated the initial order,
while the civil penalty, he suggests, is little more than a slap on the wrist
given Google's profits or revenues.
In October, 2011, Google settled with the FTC over charges
it had "used deceptive tactics and violated its privacy promises when it
launched its social network, Google Buzz." In that settlement, Google
promised not to misrepresent "the extent to which consumers can exercise
control over the collection of their information."
It was that settlement that the FTC charged Google had
violated. Google agreed to pay up and to remove the cookies, but does not have
to accept liability for the charge, which is what Rosch had an issue with.
Rep. Ed Markey (D-Mass.) who pushed for the Google
investigation as cochair of the Congressional Privacy Caucus, appeared to be
satisfied.
"When consumers say 'no' to tracking, companies should
not try to surreptitiously circumvent this preference," he said in a
statement. "Today's announcement reinforces the need to vigorously monitor
the promises technology companies make about protecting consumers' privacy. I
commend the FTC for pursuing any potential violation and plan to continue my
own strong oversight in this area."
Privacy caucus co-chair Joe Barton (R-Texas) was equally pleased.
"I commend the Federal Trade Commission for assessing Google the largest monetary fine in their history," Barton said. "Google was wrong to circumvent the anti-tracking program in the Safari system. Google compounded their culpability by misleading the FTC and the public about their actions."
"I commend the FTC for using its existing consent order against Google to hold the company accountable for misleading users of the Safari Internet browser about their online privacy," said Seante Commerce Committee Chairman Jay Rockefeller (D-W. Va..), who is a leading voice for more online privacy protections. "I will continue to push for common sense privacy legislation to give consumers the ability to choose what information companies collect about them and how they use it. In the meantime, it is imperative that the FTC continues to make sure that individual companies abide by the promises they make about consumers' privacy. Without strong enforcement actions, companies have shown a preference for profits over consumer protection."
Not so sanguine about the penalty were Geoffrey Manne, executive director of the International Center for Law and Economics, and Berin Szoka, president of TechFreedom:
"The size of today's fine will make headlines but it is a distraction from the real story: The FTC holds Google liable for a statement in a help page that was true when made and became untrue only because Apple quietly changed how its Safari browser handles cookies," they said. "Of course, companies do have a duty to ensure the accuracy of what they tell consumers about privacy as their own practices evolve. But holding them responsible for monitoring everything their rivals do that might affect their own past privacy statements will only discourage them from explaining their privacy practices in the first place. This is sadly ironic, as policymakers have spent years bemoaning the inadequacy of privacy policies and demanding companies do more to educate consumers. This is, at best, a pyrrhic victory for privacy."
