The size of today's fine will make headlines but it is a distraction from the real story: The FTC holds Google liable for a statement in a help page that was true when made and became untrue only because Apple quietly changed how its Safari browser handles cookies.  Of course, companies do have a duty to ensure the accuracy of what they tell consumers about privacy as their own practices evolve.  But holding them responsible for monitoring everything their rivals do that might affect their own past privacy statements will only discourage them from explaining their privacy practices in the first place.  This is sadly ironic, as policymakers have spent years bemoaning the inadequacy of privacy policies and demanding companies do more to educate consumers.  This is, at best, a pyrrhic victory for privacy. 

 

The FTC now has Google, Facebook, Twitter and MySpace under under 20-year consent decrees and continues to add other companies to the list.  Each of these companies now risks incurring unpredictable fines and enormous reputational costs for conduct the FTC likely couldn’t punish under its general Section 5 powers—without any admission of guilt and without the FTC having to prove liability or justify the amount of the fine.  As the Commission boldly declares, a consent decree violation need not have "yielded significant revenue or endured for a significant period of time" to be punished with a huge fine.  Such arbitrary regulation-by-settlement undermines the rule of law and harms consumers by deterring privacy disclosures.