Facebook will pay a record-breaking $5 billion fine to resolve a government probe into its privacy practices and the social media giant will restructure its approach to privacy, the US Federal Trade Commission said today.
The FTC voted 3-2 along party lines to adopt the settlement, which requires court approval.
But Democrats have opposed the settlement, saying it did not go far enough or require a large enough fine.
"Despite repeated promises to its billions of users worldwide that they could control how personal information is shared Facebook undermined consumers' choices," FTC Chairman Joe Simons, a Republican, said in a statement.
Democratic FTC Commissioner Rohit Chopra said the penalty provided "blanket immunity" for Facebook executives "and no real restraints on Facebook's business model" and does "not fix the core problems that led to these violations."
Facebook agreed to pay an additional $100m to settle allegations that it misled investors about the seriousness of the misuse of users' data, the Securities and Exchange Commission also said today.
The FTC said that Facebook's data policy was deceptive to "tens of millions" of people who used its facial recognition tool.
The company also violated its rules against deceptive practices when it did not disclose phone numbers collected for a security feature would also be used for advertising.
Under the settlement, Facebook's board will create an independent privacy committee that removes "unfettered control by Facebook CEO Mark Zuckerberg over decisions affecting user privacy."
Facebook also agreed to exercise greater oversight over third-party apps.
Chopra and Democratic FTC Commissioner Rebecca Slaughter said the $5 billion penalty may be less than Facebook's gains from violating users' privacy.
"Until we address Facebook's core financial incentives for risking our personal privacy and national security, we will not be able to prevent these problems from happening again," Chopra said.
The FTC Republican majority argued the settlement "significantly diminishes Mr Zuckerberg's power - something no government agency, anywhere in the world, has thus far accomplished."
The Republican commissioners led by Simons said if the FTC had gone to court "it is highly unlikely that any judge would have imposed a civil penalty even remotely close to this one."
They called the settlement - in light of what the FTC might have been able to win in a court fight - "a complete home run."
The Republicans noted that Zuckerberg and other Facebook executives must sign quarterly certifications attesting to the company's privacy practices.
The FTC said Zuckerberg or others filing a false certification could face civil and criminal penalties.
Facebook also is barred from asking for email passwords to other services when consumers sign up.
It also can not use telephone numbers obtained in a security feature, like two-factor authentication, for advertising and must get user consent to use data from facial recognition technology.
Facebook said the deal worked out with the FTC would give the company "a comprehensive new framework for protecting people's privacy".
The company also said that it expected to find additional problems as it initiates a review of its systems.
"Going forward, our approach to privacy controls will parallel our approach to financial controls, with a rigorous design process and individual certifications intended to ensure that our controls are working - and that we find and fix them when they are not," Facebook's General Counsel Colin Stretch said in a statement.
Senator Richard Blumenthal, a Democrat from Connecticut, called the settlement "a fig leaf" that offers "no accountability for top executives."
"By relying on a monetary fine to deter Facebook, the FTC has failed to heed history's lessons. Facebook has already written this penalty down as a one-time-cost in return for the extraordinary profits reaped from a decade of data misuse," Blumenthal said.
The settlement stems from Facebook's alleged violations of a previous FTC settlement order over privacy issues.
FTC Commissioner Slaughter said the FTC should have taken Facebook and Zuckerberg to court.
Slaughter also criticised the FTC's decision to grant Facebook and its executives a release from liability for any claims before June 12, 2019.
She also said the FTC failed "to impose any substantive restrictions on Facebook's collection and use of data from or about users."
Chopra added that by "settling the commission - and the public - may never find out what Facebook knows. It is difficult to conclude that the commission got the better end of the bargain."
The FTC has been investigating allegations Facebook inappropriately shared information belonging to 87 million users with the now-defunct British political consulting firm .
The FTC also said that Cambridge's former CEO Alexander Nix and former app developer Aleksandr Kogan, had agreed to a settlement with the FTC that will restrict how they conduct business in the future.
The US Justice Department said earlier this week that it was opening a broad investigation of major digital technology firms into whether they engage in anticompetitive practices, the strongest sign the Trump administration is stepping up scrutiny of Big Tech.
The review will look into "whether and how market-leading online platforms have achieved market power and are engaging in practices that have reduced competition, stifled innovation, or otherwise harmed consumers," the Justice Department said in a statement.
It did not identify specific companies but said the review would consider concerns raised about "search, social media, and some retail services online" - an apparent reference to Alphabet, Amazon.com and Facebook - and potentially Apple.