In 2018, Facebook, the social media behemoth, faced public outrage over breaches of its users’ privacy. A British political consulting firm hired by the Trump campaign, Cambridge Analytica, was accused of accessing the private data of 87 million Facebook users in an attempt to influence the 2016 presidential election. The consultants had partnered with a psychology professor at Cambridge University, who developed a Facebook app that offered a personality survey. When people responded, the app harvested private information from their profiles and those of their friends. The professor then shared this information with Cambridge Analytica, which used it to target political ads to Facebook users.

In the wake of these revelations, the U.S. Congress and European Parliament both held hearings on how to better protect the personal information of social media users. These hearings raised the question: Should Facebook, and other social media platforms, be more strictly regulated by the government to prevent future breaches of this kind?

Mark Zuckerberg, Facebook's co-founder and CEO, responded to the growing social outcry by making himself publicly available to legislators in both the United States and Europe. Zuckerberg was questioned for almost 10 hours by U.S. senators of the commerce and judiciary committees over the company’s privacy and data mining policies.

Two weeks later Zuckerberg appeared before the European Parliament, pledging to be more diligent in protecting his users’ individual information. As in his congressional testimony, Zuckerberg admitted to making mistakes that needed to be corrected, but again argued against government regulation of the industry, claiming that companies could effectively address any problems themselves.

In response to the Cambridge Analytica incident, Facebook introduced a centralized system that enabled its users to control their privacy and security settings. The system, available globally, provided users with a single location where they could change their settings, rather than the old system, which was spread out across 20 separate locations on the social media platform. Facebook also announced that it would curb information that it exchanged with companies that collected and sold consumer data for advertisers. It ended an ad-targeting option called Partner Categories that allowed data brokers to target specific groups of Facebook users—people who had bought a certain product, for example—on behalf of their ad clients.

Many thought Zuckerberg’s pledge to do better was not enough and legislation was required. This was not the first time in recent years that the public turned to the government to protect their privacy. In 2010, the Do Not Track Bill, intended to give American consumers more control over what personal details companies collected from them and how the data was used, was introduced in Congress. In addition, in 2012 then-President Obama unveiled a comprehensive Consumer Privacy Bill of Rights, which would empower consumers to know what personal information was collected, stored, and possibly sold to other businesses. Neither of these efforts generated sufficient political support to become law.

In 2018, the European Union passed the General Data Protection Regulation. This regulation defined personal data as proprietary—that is, owned by the individual—and required that any use of that data by other parties had to be authorized by permission.

In response to the Facebook-Cambridge Analytica incident, calls for new legislation in the United States appeared. Some of the potential legislative and regulatory strategies considered included 

(1) Legislation could be passed to protect the data of individuals; 

(2) new regulation could restrict how consumer data was used, including the sale of this information to other businesses; 

(3) new regulation might also target how the consumers’ information is used for online political advertising; 

(4) Facebook and other technology firms could be held responsible for the unethical or illegal behavior of those who used their platforms; 

(5) governmental investigations could be conducted, with the Federal Trade Commission given sweeping access and enforcement powers.

How did the public feel about these proposals? In a 2018 survey, only 37 percent of Americans said that Facebook, Twitter, and other social platforms were not regulated enough, and 14 percent of those polled said they were already regulated too much. While many were worried that a Cambridge Analytica-type incident might occur again, and that personal information was not well protected, they were uncertain if governmental regulation was the right answer.

Describe the government's concerns over Facebook privacy policies.

Identify the stakeholders and their impact on Facebook's policies.

Describe the ethical dilemmas in the case.

Who are the stakeholders?