Should Facebook Be Regulated?

In 2018, Facebook, the social media behemoth, faced public outrage over breaches of its users' privacy. A British political consulting firm hired by the Trump campaign, Cambridge Analytica, was accused of accessing the private data of 87 million Facebook users in an attempt to influence the 2016 presidential election. The consultants had partnered with a psychology professor at Cambridge University, who developed a Facebook app that offered a personality survey. When people responded, the app harvested private information from their profiles and those of their friends. The professor then shared this information with Cambridge Analytica, which used it to target political ads to Facebook users.

In the wake of these revelations, the U.S. Congress and European Parliament both held hearings on how to better protect the personal information of social media users. These hearings raised the question: Should Facebook, and other social media platforms, be more strictly regulated by the government to prevent future breaches of this kind?

While it was not publicly known how much revenue online political advertisements generated for Facebook in 2018, the firm made it clear that Facebook was spending so much money hiring moderators to review political ads that it would cancel out the revenue those ads were expected to generate in the 2018 election cycle. CEO Mark Zuckerberg explained, "We're essentially going to be losing money on running political ads, because the company is hiring 'thousands' in advance of the 2018 elections. ... That cost is going to be greater than the money that we make."

Zuckerberg responded to the growing social outcry by making himself publicly avail-able to legislators in both the United States and Europe. Zuckerberg was questioned for almost 10 hours by U.S. senators of the commerce and judiciary committees over the company's privacy and data mining policies. Zuckerberg explained, "I believe it's important to tell people exactly how the information that they share on Facebook is going to be used. ... Every single time, there's a control right there about who you're going to be sharing it with. ... It was my mistake, and I'm sorry. I started Facebook, I run it, and I'm responsible for what happens here. It's clear now that we didn't do enough to prevent these tools from being used for harm."

Two weeks later Zuckerberg appeared before the European Parliament, pledging to be more diligent in protecting his users' individual information. He explained, "Europeans make up a large and incredibly important part of our global community. Many of the values Europeans care most deeply about are values we share: from the importance of human rights and the need for community to a love of technology, with all the potential it brings." As in his congressional testimony, Zuckerberg admitted to making mistakes that needed to be corrected, but again argued against government regulation of the industry, claiming that companies could effectively address any problems themselves. "I believe deeply in what we're doing. And when we address these challenges, I know we'll look back and view helping people connect and giving more people a voice as a positive force here in Europe and around the world," stated Zuckerberg.

In response to the Cambridge Analytica incident, Facebook introduced a centralized system that enabled its users to control their privacy and security settings. The system, available globally, provided users with a single location where they could change their settings, rather than the old system, which was spread out across 20 separate locations on the social media platform. Facebook's chief privacy officer said, "We've heard loud and clear that privacy settings and other important tools are hard to find, and that we must do more to keep people informed." Facebook also announced that it would curb information that it exchanged with companies that collected and sold consumer data for advertisers. It ended an ad-targeting option called Partner Categories that allowed data brokers to target specific groups of Facebook userspeople who had bought a certain product, for exampleon behalf of their ad clients. Graham Mudd, product marketing director at Facebook, posted that shutting that system down would "help improve people's privacy on Facebook."

Many thought Zuckerberg's pledge to do better was not enough and legislation was required. This was not the first time in recent years that the public turned to the government to protect their privacy. In 2010, the Do Not Track Bill, intended to give American consumers more control over what personal details companies collected from them and how the data was used, was introduced in Congress. In addition, in 2012 then-President Obama unveiled a comprehensive Consumer Privacy Bill of Rights, which would empower consumers to know what personal information was collected, stored, and possibly sold to other businesses. Neither of these efforts generated sufficient political support to become law.

In 2018, the European Union passed the General Data Protection Regulation. This regulation defined personal data as proprietarythat is, owned by the individualand required that any use of that data by other parties had to be authorized by permission. A consumer would have to affirmatively "opt in" (rather than "opt out"), after receiving a request writ-ten in clear language, not legalese, from a business seeking to use their information.

In response to the Facebook-Cambridge Analytica incident, calls for new legislation in the United States appeared. Some of the potential legislative and regulatory strategies considered included

Legislation could be passed to protect the data of individuals. These laws would focus on how companies collect, share, and use user data, like the European Union's 2018 General Data Protection Regulation.

New regulation could restrict how consumer data was used, including the sale of this information to other businesses. It could require social media sites, like Facebook, to provide the government, or its users, with additional information on who purchased users' information. These steps would increase the transparency regarding the sale of consumers' information.

New regulation might also target how the consumers' information in used for online political advertising. Facebook said it would support legislation to require large digital platforms to keep a public library of paid political ads that had appeared on their sites. Proposals suggested that tech companies be required to confirm the identities and locations of the sponsors of political advertisements on their sites.

Facebook, Google, and other technology firms could be held responsible for the unethical or illegal behavior of those who used their platforms. This effort targeted the actions by organizations like Cambridge Analyticaor even foreign governmentsthat might try to influence political elections through advertisements on social media.

Governmental investigations, likely by the nation's chief privacy regulator, the Federal Trade Commission (FTC), could be conducted, with the FTC given sweeping access and enforcement powers.

How did the public feel about these proposals? In a 2018 survey, only 37 percent of Americans said that Facebook, Twitter, and other social platforms were not regulated enough, and 14 percent of those polled said they were already regulated too much. While many were worried that a Cambridge Analytica-type incident might occur again, and that personal information was not well protected, they were uncertain if governmental regulation was the right answer.

1. Do you believe the government (in the United States and other countries) should regulate Facebook to protect its users' privacy? Why or why not?

2. Do you believe that Facebook's actions so far exemplify working in collaboration with, or in opposition to, government? Why?

3. What elements of the public policy process are seen in this case: public policy inputs, goals, tools, and effects?

4. Of the reasons described in this chapter to justify government regulation: market failure, negative externalities, natural monopolies, and ethical arguments, which reasons are relevant in this case?

5. Since Facebook and other social media platforms are global in nature, is there a need for international regulation to protect consumers' privacy worldwide? If so, what organization could provide this global regulatory protection?

6. What level of responsibility do individuals who use Facebook and other social media sites have to protect their own personal information?