Privacy settlement examples: six recurring shapes, and the evidence that decides each

Privacy settlement examples cluster into six shapes. Each shape names what the fight is about and which document decides it. The named matters below are public enforcement actions and filed complaints, not findings against every company that resembles them.

What to take away

Six shapes, six named matters

The public records for these six matters:

1. FTC v. Facebook, Docket No. C-4365. The FTC announced the $5 billion order on July 24, 2019.
2. FTC v. Kochava, No. 2:22-cv-00377, District of Idaho. The FTC filed the complaint in August 2022.
3. In re Facebook Biometric Information Privacy Litigation, No. 3:15-cv-03747, Northern District of California. The $650 million settlement was approved in 2021.
4. The FTC's December 6, 2019 announcement of the order against Cambridge Analytica.
5. Arizona v. Google, Maricopa County Superior Court, filed May 27, 2020. The state announced the $85 million settlement in 2022.
6. The FTC's May 25, 2022 announcement of the $150 million order against Twitter.

The Texas attorney general's February 2022 petition against Meta, under the state's 2009 biometric statute, was settled in July 2024.

The gap between the notice and the practice. The FTC's 2019 order against Facebook alleged that Facebook told users they could control how their data was shared. Third-party apps could still pull friend data. The decisive document was the 2011 consent order Facebook had already signed, which required a privacy program.

The new allegation was that the program did not match the promise. Facebook paid $5 billion and accepted a 20-year order.

Collection for one purpose, use for another. The FTC's 2022 action against Kochava alleged that Kochava sold geolocation data that could identify visits to sensitive locations, after collecting it for advertising. The FTC alleged the data could reveal visits to reproductive health clinics and places of worship.

The argument is not whether the data existed but whether the later use fit what was described.

Sharing with a third party. The Cambridge Analytica matter is the clearest example: a researcher built a quiz app, users consented to a research purpose, and the app pulled friend data that went to a political consulting firm.

The recurring surprise is that nobody inside the platform knew the transfer existed, because the API default allowed it.

Retention past the point of use. The FTC's 2024 action against X (then Twitter) alleged that X used phone numbers and email addresses collected for two-factor authentication to serve targeted ads. The data was held for a security purpose and used for a marketing one.

Twitter had agreed to pay $150 million in 2022 over the same 2FA data.

Security failures. The FTC's 2019 order against Cambridge Analytica also covered the failure to verify that apps complied with platform terms. The argument is rarely whether the exposure happened.

It is whether what was in place beforehand was adequate. Uber's 2018 FTC settlement is another security shape: the FTC alleged Uber failed to protect rider and driver data, and Uber agreed to pay $148 million and accept an expanded consent order.

Consent and interface design. Arizona's 2020 complaint against Google alleged that Google made location settings confusing enough that users could not tell when tracking was on. Arizona settled with Google for $85 million in 2022.

What each shape turns on

The middle column is the useful one. In every shape, the material that decides the question is internal, dated, and either exists or does not. Organizations that keep it are in a different position from those that reconstruct it afterwards.

What varies between systems

The same facts produce an administrative order in one place, private litigation in another, and nothing in a third. What counts as harm, who may bring a claim, what a body may impose, and how long anyone has to act all differ.

Two general definitions are worth having in mind. A description of privacy as a legal concept shows how much sits under one word in a single system.

An explanation of statutes of limitations shows why timing questions decide more matters than merits questions do.

Using a pattern without misusing it

A shape tells you what to look at in your own arrangements. It does not tell you that anything is required of you, and it does not establish what happened anywhere. Two misuses are worth avoiding.

Treating a pattern as a compliance standard. The obligations in any particular resolution were negotiated for one organization's facts, covered in what a resolution does and does not establish.

Treating a pattern as an accusation. Every shape above describes a category of allegation. The gap between an allegation and a finding is the whole subject, and the honest position on any specific matter is whatever the operative document says.

Turning a shape into a question about yourself

Six questions, one per shape, that an organization can answer without legal analysis:

Where the answer is no, that is not a breach of anything. It is a gap in the evidence you would want, and closing it is cheap now and impossible later.

Which body might ever ask is a separate question, addressed in identifying the responsible regulator. Where the people involved are young, an additional layer applies that is described in the different age numbers and where each lives. Where information is held by a service rather than by you, what the agreement permits is in the terms you accepted.

Common questions

Why name specific matters?

Because a pattern with no example is a slogan. The six matters above are public enforcement actions and filed complaints, each with a docket or a press release you can read. Naming them lets you check the shape against the source.

Which shape is most common?

The gap between the published notice and the actual practice, in most descriptions of this area. It is also the cheapest to prevent, which is a frustrating combination.

Is a security incident the same kind of matter as the others?

Procedurally it often runs differently, because notification obligations may be triggered immediately and by their own rules, and because more than one body may become involved at once. Treating it as an ordinary privacy question loses the first few days, which are the ones that matter most.

Do these settlements set a standard I have to meet?

No. Each resolution was negotiated for one organization's facts. The obligations in it apply to that organization. What transfers is the evidence question.