that specific business activity is 7 years of non-compliance on top of however many years they had no actual user privacy before their 2012 agreement.

That specific business activity is selling information to advertisers, which is their entire business model.

So scale the fine to make 10 years of selling ads irrationally risky? I'm okay with that.

See, there's the problem. The FTC lacks the authority to fine Facebook for "10 years of selling ads", or really, anything outside of behavior they can prove violated Facebook's consent decree. The distinction here is behavior that we disapprove of and behavior the FTC does (or should) have the ability to sanction.

If the FTC can fine Facebook $5B† for a (comparatively) minor violation as a way of expressing the agency's disapproval for all the rest of Facebook's business practices, it can do that to anyone. It can, for instance, fine Apple tens of billions for minor, provable violations as a way of coercing them into cooperating with law enforcement to unlock phones.

Again, I do not like Facebook, broadly agree with 'idlewords testimony before the Senate today that his necktie is more tightly regulated than our industry, and want that to change. I do not think the FTC should be able to make up the rules as it goes, especially not as a way for politicians to showboat.

† or whatever you think the appropriate number is; I'm happy to stipulate that $3-5B is the appropriate range for the fine

The FTC not having the legal authority is a very different argument than your first post which just stated they shouldn't... as a principle.

As to blackmailing Apple:

while Cambridge analytical is a (maybe) minor violation the fact that it happened is again evidence of 7 years of non compliance with a previous settlement and it is a fundamental part of their business model.

I would probably have a different stance if Facebook was being fined umpteen billion for like bribing a doctor for unneeded handicap parking placards.

If the people want to elect representatives who pass a law declaring companies like Facebook systemically risky and authorizing their breakup, I'm ambivalent. What I have a real problem with is the federal government seizing on an offense that would ordinarily merit a $10MM fine (or $100MM or $5B) and ratcheting it way up as a way of signaling disapproval for actions not part of the underlying offense, which is essentially what I believe everyone advocating for higher fines is doing.

I think there's some blurriness here because people seem to believe that the violation FTC is pursuing had something to do with Facebook's whole business. That is not my understanding. As I understand it, what set FTC off here was the pattern of violations surrounding the Cambridge Analytica scandal, in which Facebook partners were given more access to user profile data than users expected or would have consented to. That's bad! But it is hard to argue, knowing a little bit about Facebook's business, that those violations were a major component of Facebook's revenue. Thus: Facebook's revenue is not the figure of interest in deriving a fine.

Facebook giving advertisers more access to user profile data than users expected is AGAIN the entire fucking point of the 2012 settlement. That Facebook was capable of giving a relatively tiny ass ad company that access is AGAIN evidence that they had been in non compliance with that settlement for 7 years.

And when selling access to user profile data is their entire value-add over any other given ad network AND rando-ass companies (which CA definitely was) can pay for data that Facebook told users was private: there is no untangling it from revenue from companies that didn't take advantage of that abuse of privacy, there is just what companies we know for sure and what companies could have.

That they did it AGAIN is the basis for there being a relatively significant fine in the first place. It does not follow that the purpose of that fine should be to cripple Facebook, not because crippling Facebook is bad, but because there is no reasonable basis in law to do so.

Again, the significance of the fine is relative to the offense, not the entity. We also don’t fine Mark Zuckerberg 10MM for being late (AGAIN) for paying parking tickets.

That they could do it again is clear evidence that they never complied.

Separately a 4x, a 20 billion dollar, fine still wouldn't cripple them.

Also I'm actually strongly for fining Zuckerberg personally 10mm for his personal traffic violations because the point of fines is punishment and deterrence and thus should be scaled to the individual.

Nobody is debating whether they complied. They didn't. They got a fine. The fine is good. What we're debating is how big the fine should be, and my argument is, the notion that the fine should scale with Facebook's overall revenue, unmoored from the specific offense, is both irrational and dangerous.

How else do fine a company for a decade of knowingly bad behavior except looking at what they afford and setting it accordingly. This wasn't a whoopsie, it was a deliberate choice made consistently for years with the knowledge and budgeting that they might get fined for it.

Also this behavior is inextricable from their overall revenue.

Also also are we back to should as opposed to the FTC's legal authority? I think it should be enough to change the entire culture of Facebook because selling user data is their business model and so anything short of changing the entire culture of Facebook will just result in selling more and more user data as soon as no one is looking. I think it should be enough to prevent Facebook from not just repeating current behavior but to prevent them from coming up with functionally identical but legally distinct behavior. I think it should be enough that Facebook management starts playing whack-a-mole with unethical behavior before the government has to play it after a decade of damage.

You can't just make things up because you don't like the company. If you can do that, so can people whose views you'd find odious.

What is he making up? This seems like Facebook's MO as far as I can tell.

They absolutely do have to scale with revenue. Maybe a small fine, enough to cover API revenues, will deter them from that the very specific behaviour around API data they got fined for however it won't make them think twice about taking a chance on the next unrelated opportunity to be nefarious. A large fine will.

They need to scale with the revenue derived from the offense, if the goal is to deter them from that behavior in the future.

FWIW, I see you saying this, but there are running examples of fines scaling to income, e.g. personal income and speeding tickets.

https://en.wikipedia.org/wiki/Day-fine

https://www.theatlantic.com/business/archive/2015/03/finland...

I'm also not sure that "scaling with the offense" makes sense -- If company A and B can do the same thing, receive equal fines, but company B can continue to exist as if nothing happened, did the fine mean anything? Would your argument in this case be that the fine should be high enough to be damaging enough to both companies, approximately equal to the social value of discouraging that behavior?

Curious especially because you said if the laws changed, you'd be ambivalent. I think there's a structural problem here, I'm not sure any amount of fining particularly will solve the real problem.

FWIW my personal opinion is the the goal should be to deter from unethical and/or (borderline) illegal activity in the future, not only that specific behaviour. Anything else turns into a game of whack-a-mole which is long term damaging to the economy and competitive environment.

This just allows corporations to compartmentalize their risks. They can put all their illegal activities in a side division, and if they don't pan out no worries since we only get fined on the revenue of the failed project.

How would that deter them though?