PUBLIC CT-2020- THE COMPETITION TRIBUNAL IN THE MATTER OF the Competition Act, R.S.C. 1985, c. C-34; and AND IN THE MATTER OF a Consent Agreement pursuant to section 74.12 of the Competition Act with respect to certain marketing practices of the Respondent under paragraph 74.01(1)(a) of the Competition Act.
BETWEEN: COMMISSIONER OF COMPETITION Applicant - and - FACEBOOK, INC. Respondent
CONSENT AGREEMENT WHEREAS the Commissioner of Competition (the “Commissioner”) is responsible for the administration and enforcement of the Competition Act (the “Act”);
AND WHEREAS Facebook, Inc. is a company organized and existing under the laws of Delaware and headquartered in Menlo Park, California;
AND WHEREAS the Respondent operates one of the largest social-networking services in the world through its website and mobile applications (hereafter “Facebook”), having recently estimated it has 2.6 billion monthly active users globally, and previously having estimated it had approximately 24 million monthly active users in Canada;
AND WHEREAS the Respondent operates an instant-messaging service called Messenger (“Messenger”), with a previous estimate of 1.3 billion monthly active users globally;
AND WHEREAS the Respondent primarily derives its revenue from selling advertising services, including the targeting of advertisements based in part on the information that Users provide to the Respondent;
- 2 -
AND WHEREAS the Respondent has reported that average revenue per user in the United States and Canada was USD $34.86 of revenue per month during Q4 of 2018;
AND WHEREAS the Respondent is aware of the importance Canadian Users place on their privacy;
AND WHEREAS the Respondent made various representations regarding privacy and the sharing of information on Facebook and/or Messenger from at least August 2012 until at least June 2018;
AND WHEREAS the Commissioner has concluded the Respondent made representations to the public on Facebook via Facebook’s “Privacy Settings”, “About” page, inline audience selector on “posts”, “Privacy Shortcuts”, “Privacy Checkup”, Help Center, and mobile privacy controls that created a general impression about who could see or access Users’ Personal Information on Facebook and Messenger and about Users’ ability to control, through Facebook’s Privacy Controls, who could see or access their Personal Information;
AND WHEREAS the Commissioner has concluded that the Respondent did not limit its sharing of Personal Information with Third Party Developers in a manner consistent with Facebook’s privacy representations, and that this was contrary to the literal meaning of and/or the general impression created by those representations;
AND WHEREAS the Commissioner has concluded that the Respondent made Facebook’s privacy representations to the public for the purpose of directly or indirectly promoting its business interests;
AND WHEREAS the Commissioner has concluded that Facebook’s privacy representations were false or misleading in a material respect, contrary to paragraph 74.01(1)(a) of the Act;
AND WHEREAS the Respondent, in April 2014, made additional representations to the public that the Commissioner has concluded created the general impression that it would no longer allow Third Party Developers to access the data of Users’ friends after April 30, 2015;
AND WHEREAS the Commissioner has further concluded that after April 30, 2015 and in some cases until 2018, the Respondent nevertheless allowed certain Third Party Developers access to the information of Users ’ friends, through a series of agreements, contrary to the literal meaning of and/or the general impression created by these additional privacy representations;
AND WHEREAS the Commissioner has concluded that the Respondent made these additional privacy representations to the public for the purpose of directly or indirectly promoting its business interests;
PUBLIC
- 3 -
AND WHEREAS the Commissioner has concluded that these additional privacy representations made by the Respondent were false or misleading in a material respect, contrary to paragraph 74.01(1)(a) of the Act;
AND WHEREAS the Commissioner had commenced an Inquiry on October 26, 2018 (the “Inquiry”) and has made the above conclusions in relation to Canada’s Competition Act and in respect of the Canadian public;
AND WHEREAS the Commissioner acknowledges the Respondent’s voluntary cooperation in resolving this matter and implementing the terms of this Consent Agreement (the “Agreement”);
AND WHEREAS the Respondent does not agree with the Commissioner’s conclusions but nonetheless seeks to resolve the concerns identified by the Commissioner in the course of the Inquiry;
AND WHEREAS the Respondent is required to implement a corporate compliance program (“Compliance Program”) pursuant to the Stipulated Order for Civil Penalty, Monetary Judgment and Injunctive Relief agreed between the Respondent and the United States Federal Trade Commission, and filed before the United States District Court for the District of Columbia on July 24, 2019 (the “FTC Consent Decree”);
AND WHEREAS the Respondent has agreed to review the Commissioner’s bulletin titled “Corporate Compliance Programs”, as published (as of the Execution Date of this Agreement) on the Competition Bureau’s website at www.competitionbureau.gc.ca with the aim of aligning its Compliance Program, as it relates to supporting compliance with this Agreement, with the principles identified in the Bulletin;
AND WHEREAS IT IS AGREED AND UNDERSTOOD that for the purposes of this Agreement only, including execution, registration, enforcement, variation or rescission of this Agreement, and subject to paragraph 16 of this Agreement, the Respondent does not contest the Commissioner’s conclusions and consents to the immediate registration of this Agreement, but that nothing in this Agreement shall constitute an admission by the Respondent as to the facts or findings in any civil, criminal, regulatory, or administrative proceeding, or shall be taken as an acceptance or admission by the Respondent under the Act, for any other purpose, or any other applicable law, including privacy laws, of any facts or findings, wrongdoing, submissions, legal argument or conclusions; nor shall the non-contestation of the Commissioner’s conclusions have any issue-preclusive or claimpreclusive effect in any future proceeding, except for any future proceeding between the Parties, and shall not derogate from any rights or defences of the Respondent against third parties including any defences available under the Act or any other Act, including privacy legislation;
AND WHEREAS the Parties are satisfied that the Commissioner’s concerns related to the Inquiry will be resolved with the registration of this Agreement which, upon registration, shall have the same force and effect as an order of the Competition Tribunal (the “Tribunal”);
PUBLIC
- 4 -
NOW THEREFORE, in order to resolve the Commissioner’s concerns, the Parties hereby agree as follows:
I. INTERPRETATION 1. For the purpose of the Agreement, the following definitions shall apply: a. “Act” means the Competition Act, R.S.C. 1985, c. C-34; b. “Execution Date” means the date on which the Agreement has been signed by both Parties;
c. “Interpretation Act” means the Interpretation Act, R.S.C. 1985, c. I-21; d. “Parties” means the Commissioner and the Respondent collectively, and “Party” means any one of them;
e. “Personal Information” means, in relation to Facebook and Messenger, information about an identifiable User, including but not limited to: a first and last name; a home or other physical address, including street name and name of city or town; an email address or other online contact information, such as an instant messaging user identifier or a screen name; a mobile or other telephone number; Internet Protocol (“IP”) address, user ID or other persistent identifier that can be used to recognize a user over time and across different devices, websites or online services; information from the User’s Facebook profile; User-generated content posted on Facebook or Messenger, including messages exchanged on Messenger; or any information combined with any of the foregoing;
f. “Privacy Controls” means any control or setting provided by Respondent that allows a User to restrict which individuals or entities can access or view Personal Information;
g. “Respondent”, means Facebook, Inc., a company organized and existing under the laws of Delaware and headquartered in Menlo Park, California, its directors, officers, employees, agents, representatives, successors and assigns;
h. “Senior Management” means the Respondent’s current and future senior management materially responsible for implementation of the obligations arising from this agreement, specifically the Designated Compliance Officers, including the Chief Privacy Officer for Product, appointed by the Independent Privacy Committee of the Respondent’s Board of Directors, as described in the FTC Consent Decree;
i. “Third Party Developers” means developers of third party applications (whether individual or entity) that use or receive Personal Information obtained by or on behalf of the Respondent outside of a User-initiated
PUBLIC
- 5 -
transfer of Personal Information as part of a data portability protocol or standard, other than: (1) a service provider of the Respondent that (i) uses the Personal Information for and at the direction of the Respondent and no other individual or entity and for no other purpose; and (ii) does not disclose the Personal Information, or any individually identifiable information derived from such Personal Information, except for, and at the direction of, the Respondent, for the purpose of providing services requested by a User and for no other purpose; or (2) any individual or entity that uses the Personal Information only as reasonably necessary: (i) to comply with applicable law, regulation, or legal process, or (ii) to enforce the Respondent’s terms of use, or (iii) to detect, prevent, or mitigate fraud or security vulnerabilities;
j. “Tribunal” means the Competition Tribunal established by subsection 3(1) of Competition Tribunal Act, R.S.C., 1985, c. 19 (2nd Supp.); and
k. “User” means an identified individual from whom Respondent has obtained information for the purpose of providing access to Respondent’s products and services.
II. COMPLIANCE WITH THE DECEPTIVE MARKETING PRACTICES PROVISIONS OF THE ACT 2. The Respondent shall not make, in connection with a Facebook product or service, any representation to the public that, taking into account its general impression as well as its literal meaning, is materially false or misleading regarding the disclosure of Personal Information, including how and the extent to which Users can control who can access the Personal Information.
III. PAYMENTS ADMINISTRATIVE MONETARY PENALTY 3. The Respondent shall pay an administrative monetary penalty in the amount of $9,000,000.
COSTS 4. The Respondent shall pay $500,000 for costs incurred by the Commissioner during the course of his investigation into this matter.
FORM AND TIME OF PAYMENT 5. The payments referred to in paragraphs 3 and 4 above shall be made within 30 days after the Execution Date by certified cheque or by wire transfer payable to the Receiver General for Canada.
PUBLIC
- 6 -
IV. CORPORATE COMPLIANCE PROGRAM 6. Within 180 days after the Execution Date, the Respondent will ensure that its Compliance Program supports compliance with paragraph 2 above. The Respondent will review the Commissioner’s bulletin titled “Corporate Compliance Programs”, as published (as of the Execution Date of this Agreement) on the Competition Bureau’s website at www.competitionbureau.gc.ca, with the aim of aligning the Compliance Program, as it relates to supporting compliance with this Agreement, with the principles identified in the Bulletin.
7. The Respondent’s Senior Management shall fully support and enforce the Compliance Program and shall take an active and visible role in its establishment and maintenance.
8. Within 21 days after the establishment of the Compliance Program, each current member of Senior Management shall acknowledge his or her commitment to the Compliance Program by signing and delivering to the Commissioner a commitment letter in the form set out in Appendix “A” of this Agreement. Any individual that becomes a member of Senior Management during the term of this Agreement shall sign and deliver to the Commissioner a commitment letter in the form set out in Appendix “A” of this Agreement, within 21 days of becoming a member of Senior Management.
V. COMPLIANCE REPORTING AND MONITORING 9. During the term of this Agreement, (i) the Respondent shall provide a copy of this Agreement to Senior Management and their direct reports 14 days after the date of registration of this Agreement, and (ii) any additional personnel meeting this description within 14 days after the commencement of their responsibilities. Within 30 days after being provided with a copy of this Agreement, the Respondent shall secure from each such person a signed (or electronically signed) and dated statement acknowledging that he or she read and understood this Agreement and Part VII.1 of the Act.
10. The Respondent shall provide the Commissioner written confirmation that all such personnel have received a copy of this Agreement, as required by paragraph 9, within 21 days after the registration of this Agreement.
11. For the purposes of monitoring compliance with this Agreement, the Respondent shall provide to the Commissioner information relating to any matters referred to in Parts II and V of this Agreement that the Commissioner requests, within 45 days following receipt of a written request from the Commissioner.
VI. GENERAL 12. Notices, reports and other communications required or permitted pursuant to any of the terms of this Agreement shall be in writing and shall be considered to be
PUBLIC
- 7 -
given if dispatched by personal delivery, registered mail or facsimile transmission to the Parties at the following addresses:
Commissioner of Competition Competition Bureau Place du Portage, 21st Floor 50 Victoria Street, Phase I Gatineau, Quebec K1A 0C9
Attention: Deputy Commissioner of Competition, Cartels and Deceptive Marketing Practices Branch
Facsimile: (819) 953-4792 Email: Josephine.Palumbo@canada.ca
With a copy to: Executive Director and Senior General Counsel Competition Bureau Legal Services Department of Justice Place du Portage, 22nd Floor 50 Victoria Street, Phase I Gatineau, Quebec K1A 0C9
Facsimile: (819) 953-9267 The Respondent: Attn: General Counsel Facebook, Inc. 1 Hacker Way Menlo Park, CA 94025 United States
With a copy to: McCarthy Tétrault LLP 66 Wellington St W Suite 5300 Toronto, Ontario Canada M5K 1E6
Attention: Nikiforos Iatrou Kate McNeece Stephanie St-Jean Ashley Taborda
PUBLIC
- 8 -
13. This Agreement shall be binding upon the Respondent for a period of 10 years following its registration.
14. The Parties consent to the immediate registration of this Agreement with the Tribunal pursuant to section 74.12 of the Act.
15. The Commissioner may, in his sole discretion and after informing the Respondent in writing, extend any of the time frames in this Agreement, except for the 10-year period provided for in paragraph 13, above.
16. Nothing in this Agreement precludes the Respondent or the Commissioner from bringing an application under section 74.13 of the Act where circumstances that led to the making of this Agreement have changed. Subject to this paragraph, the Respondent shall not, for the purposes of this Agreement only, including its execution, enforcement, variation or rescission, contest the Commissioner’s conclusions as stated herein.
17. The Respondent shall not make any public statements that contradict the terms of this Agreement.
18. The Respondent attorns to the jurisdiction of the Tribunal only for the purposes of this Agreement and any proceeding initiated by the Commissioner relating to this Agreement for variation or rescission.
19. In the event of a dispute regarding the interpretation, implementation or application of this Agreement, any of the Parties shall be at liberty to apply to the Tribunal for an order or directions. In no event shall any dispute suspend any time period under the Agreement. The Parties agree that the Tribunal has jurisdiction to make such order as is required to give effect to this Agreement.
20. This Agreement may be executed in two or more counterparts, each of which shall be an original instrument, and all of which taken together shall constitute one and the same instrument. In the event of any discrepancy between the English and French versions of this Agreement, the English version shall prevail.
21. The Agreement constitutes the entire and only Agreement between the Parties and supersedes all previous negotiations, communications and other Agreements, whether written or oral, unless they are incorporated by reference herein. There are no terms, covenants, representations, statements or conditions binding on the Parties other than those contained herein.
22. The computation of time periods contemplated by this Agreement shall be in accordance with the Interpretation Act. For the purpose of this Agreement, the definition of “holiday” in the Interpretation Act shall include Saturday. For the purposes of determining time periods, the date of this Agreement is the last date on which it is executed by a Party.
PUBLIC
- 9 -
23. The Agreement shall be governed by and interpreted in accordance with the laws of Ontario and the laws of Canada applicable therein, without applying any otherwise applicable conflict of law rules.
[The remainder of this page is intentionally left blank]
PUBLIC
- 10 -
The undersigned hereby agree to the filing of the Agreement with the Tribunal for registration.
DATED at Palo Alto, California, USA this 8th day of May, 2020. FACEBOOK, INC. By: “Original signed by Paul Grewal” Name: Paul Grewal Title: Vice President & Deputy General Counsel
I have authority to bind the corporation. DATED at Gatineau, in the Province of Quebec this 8th day of May, 2020. By: “Original Signed by Matthew Boswell” Name: Matthew Boswell Title: Commissioner of Competition
PUBLIC
- 11 -
APPENDIX "A" ACKNOWLEDGEMENT BY SENIOR MANAGEMENT [CORPORATE COMPANY LETTERHEAD]
[date], 2020 CONFIDENTIAL Commissioner of Competition Competition Bureau Place du Portage, Phase 1 50 Victoria Street, 21st Floor Gatineau (QC) K1A 0C9
RE: Commitment to Establishment and Maintenance of Compliance Program Further to paragraphs 7 and 8 of the Agreement between the Commissioner of Competition (the “Commissioner”) and Facebook, Inc., dated ________, 2020, I hereby
commit to supporting and enforcing the corporate compliance program described in Part IV of this Agreement, which supports compliance with the deceptive marketing practices provisions of the Competition Act. I also hereby commit to taking an active and visible role in the establishment and maintenance of the program.
Sincerely, (Name and title) cc. Executive Director and Senior General Counsel, Competition Bureau Legal Services
Deputy Commissioner of Competition, Deceptive Marketing Practices Directorate, Cartels and Deceptive Marketing Practices Branch
Competition Act, R.S.C. 1985, c. C-34, as amended.
PUBLIC