Facebook homepage under magnifying glass showing California's probe into its privacy practices
California Stepping Up Its Probe Into Facebook Privacy Practices

California Stepping Up Its Probe Into Facebook Privacy Practices

In a new lawsuit, California Attorney General Xavier Becerra is accusing Facebook of failing to adequately comply with information and subpoena requests related to the company’s privacy practices. The investigation into Facebook privacy practices has been ongoing since 2018, but had never before been publicly disclosed until now. The state attorney general’s office had been working on a private investigation, but had been repeatedly stonewalled by Facebook for key documents and information, and had no other recourse than to make the investigation public.

Impact of new lawsuit involving Facebook privacy practices

According to Attorney General Becerra, Facebook has been guilty of far more than just “foot dragging” – it has been openly failing to comply with some very reasonable document requests. For example, the last subpoenas for documents occurred in June 2019. Nearly six months later, and the state attorney general’s office still has not received the documents. All told, says Becerra, there are 25 different information requests that have been ignored or rejected by Facebook, including 19 unanswered questions and 6 different document requests.

The public court filing will force Facebook to comply with the document requests. Failure to do so would expose a huge potential liability for the Silicon Valley tech giant, and potentially set up an epic legal battle between the state of California and one of its most powerful tech companies. For its part, Facebook says that it has already turned over thousands of documents and thousands of pages to the state attorney general’s office, seeming to imply that the state government has been drowning it in information requests and making it impossible for the embattled tech giant to comply with all subpoenas.

Potential bombshell Facebook documents

In response, California legal officials say that they are not demanding anything out of the ordinary, and that everything that has been asked for to this point falls under the category of “legitimate investigative requests.” So what could Facebook possibly be hiding?

Perhaps the most damaging documents still waiting to see the light of day are private communications between Facebook executives discussing how they deploy users’ data as “leverage” in negotiations with partners and developers. A huge trove of documents has already been leaked to the media, showing how top Facebook executives were privately raising doubts about the ethical practices at the company. In some of the leaked documents, they privately congratulated Facebook CEO Mark Zuckerberg as the “master of leverage” and applauded efforts at forcing partners to provide “reciprocal value” anytime Facebook opened up data access to them. Moreover, California has asked Facebook to search the emails of the company’s two most powerful executives – Mark Zuckerberg and Sheryl Sandberg – to see if they were engaged in high-level talks involving unscrupulous data deals.

This new California lawsuit against Facebook is a response to the 2018 Cambridge Analytica scandal that ultimately led to a Congressional investigation and a $5 billion fine from the Federal Trade Commission. As now divulged by the public lawsuit, California had been privately investigating Facebook ever since Spring 2018, when news of the Cambridge Analytica scandal first broke. The private investigation appears to be based on three different issues: whether or not Facebook misrepresented privacy practices to its users; whether or not Facebook knowingly violated any of its internal privacy practices; and whether or not Facebook actually violated California law by deceiving users.

Legal cloud over Facebook

The new California lawsuit over Facebook privacy practices is just the latest legal headache for the Silicon Valley tech giant. Currently, there are at least three different categories of legal liabilities facing the company – liability related to the European General Data Protection Regulation (GDPR); liability related to the firm’s privacy practices; and liability related to the firm’s anti-competitive and antitrust activities. In many ways, the massive $5 billion settlement with FTC was supposed to clear the air over the firm’s privacy practices, but now it looks like individual states such as California have more to say on the matter.

Perhaps the most troubling of these new legal issues are those on the antitrust front. When it comes to settling with the government over its privacy practices, Facebook has plenty of cash to pay whatever sum is demanded of them. Even the $5 billion fine from the FTC has been described as a “slap on the wrist.” But an antitrust investigation is a much more dangerous matter for Facebook, because the end result might be breaking up the company or forcing the company to radically change the way it does business.

A probe by 47 state attorneys general, led by the attorney general from New York, is the most visible of these antitrust probes into Facebook. Unlike the California investigation into the firm’s privacy practices, the New York probe involving attorneys general from all over the nation will take a closer look at the company’s market power and ability to run roughshod over competitors.

As of now, California has declined to join the separate probe involving attorneys general looking into antitrust practices, but it is easy to see several points of overlap between the different probes. For example, the way that Facebook exerts leverage over developers, or the way that it makes it close to impossible for users to know exactly what they are sharing with others could be used as evidence that the company has too much power and needs to be broken up into smaller pieces.

Looking ahead to the CCPA in 2020

According to Attorney General Becerra, investigating Facebook is going to remain front-and-center heading into 2020. In fact, at the same time that California revealed that it was investigating Facebook over its privacy practices, Becerra also noted that the new California Consumer Privacy Act (CCPA) would make it even easier for the state to go after companies like Facebook. He suggested that the state would start enforcing the CCPA as soon as it goes into effect on January 1, 2020. He also suggested that the state would be “more rigorous” in how it defines privacy practices.

Both of those suggestions, of course, should be very troubling for Facebook. It means that an entirely new legal front might be opening up in less than two months, creating another huge potential legal and regulatory liability for the company.