FTC warns ‘no CEO or company is above the law’ if Twitter shirks privacy order

The FTC has telegraphed what appears to be a now-inevitable investigation into Twitter’s internal data handling practices, as the company continues to shed important staff and improvise new features. “No CEO or company is above the law,” the agency said in a statement — and if Elon Musk’s Twitter continues its current spree, they may find themselves in violation of the FTC’s order and facing serious consequences.

To be clear at the outset, the FTC has not announced any investigation into Twitter, Elon Musk, or even that they are gathering information in service of such an investigation. Nor would it be able to confirm it was investigating if it was. But circumstantial evidence, common sense, and the ominous statement issued today leave little doubt that the company is in the agency’s crosshairs.

In the course of its ordinary oversight duties, the FTC looks into complaints by consumers, companies, and anyone with a bone to pick about things like misleading advertising, broken privacy promises, illicit business arrangements, and so on. But in 2011 Twitter agreed to a consent decree with the regulator after being found to have misused user data. It was also found to have done so again for many years in an investigation culminating in a $150 million settlement earlier this year, so this isn’t some bygone red tape.

This decree required Twitter to establish and maintain a program to ensure and regularly report that its new features do not further misrepresent “the extent to which it maintains and protects the security, privacy, confidentiality, or integrity of any nonpublic consumer information.” The revised order adds more oversight and gives the FTC more power, since evidently Twitter needed a stick as well as a carrot.

The gist of it is that Twitter is in the doghouse with the FTC already, and it has specific and legally binding requirements regarding what it can and can’t do with data, and how it verifies that it is in compliance.

Around the time of the settlement, Elon Musk entered the stage and now we have all… this. But the news that last night several data handling executives, no doubt important to walking the line with a watchful regulator, all reportedly left at once. Literally minutes after I wrote this paragraph, the company’s head of trust and safety, Yoel Roth, was reported to be leaving as well.

 

This would be troubling at any company, at any time, under any level of federal scrutiny. But for Twitter the departing chiefs might as well have hired a skywriter to spell out “INVESTIGATE ME” in huge letters above Twitter HQ. (Of course normally that might apply to any number of companies in downtown San Francisco, but right now there’s little question.)

The amount of changes, new products, eliminations of various departments and processes (many of which had to do with privacy, fairness, data handling and other crucial topics) don’t mean Twitter is necessarily in violation of the consent decree. But with things going the way they are, it’s quite hard to imagine that it is in compliance now, or it is is, will remain so for long.

It’s important, though, to understand that the FTC isn’t like the FBI, kicking doors down and arranging evidence in damning dioramas. The FTC conducts its investigations privately and at great length — they can’t and don’t publicize the fact that they are looking into a company for some violation or another until there is a legally binding consequence like a signed consent decree, settlement, or a decision to go to trial via the Department of Justice.

Although many expected the FTC under the leadership of tech skeptic and very smart person Lina Khan to be more proactive, it is limited by law what it can do. It’s actually a bit surprising that the agency got as spicy as it did in the full statement:

We are tracking recent developments at Twitter with deep concern. No CEO or company is above the law, and companies must follow our consent decrees. Our revised consent order gives us new tools to ensure compliance, and we are prepared to use them.

Though it stops short of saying “We are sharpening our knives,” this statement nevertheless is about as strong an implication that they will be giving Twitter a call soon as they can make. (A juicy tidbit uncovered by CNN’s Brian Fung, while enticing, could relate to ongoing discussions regarding the $150M settlement, so don’t get too excited.)

If they decide to pursue an investigation, which would probably happen if there are any red flags at all, let alone this many, it will be done confidentially — but importantly, it is not secret.

That means that although it is the FTC’s policy not to reveal or comment on an investigation, a company or person being investigated may do so at any time if they wish. So if the FTC makes a formal request for certain data from Twitter, or deposes its executives (present or former), they may decide to publicize that information.

In fact Twitter did this in late 2020, long before the settlement with the FTC was finalized. After all, you don’t want your investors to be the last to hear about something like a $150M charge, even though in telling them you risk discovery by hawk-eyed journalists.

So if the FTC investigates Twitter, it’s far more likely that we will hear about it from the company — in a filing with investors or, more likely, from its incautious and prolix CEO during one of his increasingly frequent emergency meetings.

The state of chaos at Twitter makes the commonplace observation that we don’t know what it will look like in six months into a gross understatement, however, meaning the entire company might have changed hands or business models before the FTC has finished its (hypothetical) work. Still, that won’t get the flailing company off the hook. Twitter’s leadership, or what’s left of it, may want to prioritize survival and compliance with federal regulators before returning to its now regularly scheduled mayhem.