Mr. Marc Rotenberg:

My organisation, the Electronic Privacy and Information Centre, EPIC, was established 25 years ago to focus public attention on emerging privacy issues. More than a decade ago, we worked with an organisation entitled Facebook Users Against the New Terms of Service. It was an international campaign joined by more than 150,000 people on the Facebook platform to oppose changes in the company's policies that would diminish personal privacy. As a consequence of the campaign, in 2009 Facebook gave commitments to its users that it would allow them to actively participate and vote on changes in its business practices. At the time, this was viewed as a great success and a demonstration of how Internet governance could promote democratic principles. However, Facebook reneged on its commitments and backed off on its agreement to allow users to vote. Chillingly, it shut down the political organisations, including the Facebook Users Against the New Terms of Service group and prohibited the use of the company's name in any user group on the platform. I bring this story to the attention of the committee because there has been much reference to Facebook and free expression. I know from ten years ago the company's view on free expression.

Thereafter, EPIC and a group of consumer privacy organisations in the US went to the FTC and laid a charge that the changes in the company's business practices violated US trade law and, specifically, were unfair and deceptive. We spent two years persuading the FTC to act on our complaint. We provided evidence, legal analysis and the blueprint for the remedies that the FTC announced in November 2011. Once again, we thought we had obtained a victory. The then chairman of the FTC pointed to the settlement with Facebook and stated the company would be held to account. When FTC commissioners appeared before the US Congress and in Europe, they pointed to the Facebook settlement as evidence that the US had effective protection for personal data. However, we almost immediately became aware of a problem, namely, that the FTC was unwilling to enforce its legal judgment.

In a related case, Google changed its business practice in violation of a consent order. We sued the FTC and stated that it must exercise its enforcement authority to protect users. The judge was sympathetic to our case but concluded that she did not have the authority to force the commission to take the action it should have taken in 2012.

We have spent many years trying to get the FTC to act against Facebook. During that time, complaints from many other consumer organisations and users have increased and include complaints about the use of personal data, the tracking of people who are not Facebook users and the tracking of Facebook users who are no longer on the platform. A request lodged by EPIC under the US Freedom of Information Act uncovered that 29,000 complaints were pending against the company. The FTC issued a judgment in June of this year against Facebook, accompanied by a historic fine of €5 billion. However, the FTC left Facebook's business practices in place and the users of the service at risk.

My message to the committee is simple: it must act. It must not wait ten years or one year to take action against this company. The terms of the GDPR must be enforced against Facebook and that should be done now. Facebook should be required to divest of WhatsApp not because of a scheme to break up big tech but, rather, because the company violated its commitments to protect the data of WhatsApp users as a condition of the acquisition. Until adequate legal safeguards are established, Facebook must be prohibited from engaging in political advertising. Its recently stated views on political advertising and the US First Amendment, which are not shared by US legal scholars, are reckless and irresponsible. Advertising revenue from political candidates should instead flow to traditional media organisations, which would help to support independent journalism.