Facebook has settled claims that it shared private information regarding 24 million Canadian customers with third parties over six years, despite promising users it was not doing so.

The company has agreed to pay $6.8 million in fines and penalties ($9.5 million Canadian dollars) to end an investigation by the Canada Competition Bureau into Facebook’s practice of sharing users’ personal data with third parties. Although the company “gave the impression that users could control who could see and access their personal information on the Facebook platform when using privacy features,” the Bureau said in a press release, the company regularly shared that data anyway.

The practice was “contrary to the literal meaning of and/or the general impression created by those representations,” according to the settlement released Thursday.

“This personal information included content users posted on Facebook, messages users exchanged on Messenger, and other information about identifiable users” for six years, from 2012 to 2018, noted the agency.

“Facebook also allowed certain third-party developers to access the personal information of users’ friends after users installed certain third-party applications,” the Bureau said, adding that while Facebook said in 2015 that it would stop doing so, it continued sharing the information until 2018.

“The Competition Act forbids companies from making false or misleading claims about a product or service to promote their business interests,” said the press release. “This includes claims about the information they collect, why they collect it, and how they use it. The Act applies to ‘free’ digital products the same way it applies to regular products or services purchased by consumers.”

Facebook cooperated with the investigation. “Although we do not agree with the Commissioner’s conclusions, we are resolving this matter by entering into a consent agreement and not contesting the conclusions for the purposes of this agreement,” a company spokesperson stated. “… We will build on the improvements we’ve made in protecting people’s information and how we communicate about the privacy controls Canadians can use.”

Aaron Nicodemus covers regulatory policy and compliance trends for Compliance Week. He previously worked as a reporter for Bloomberg Law and as business editor at the Telegram & Gazette in Worcester, Mass.

Topics