Federal Trade Commission

Privacy Impact Assessment

Facebook

Updated: March 2012
The Federal Trade Commission (FTC) has prepared this privacy impact assessment (PIA) to 

analyze and explain how the FTC handles personally identifiable information (PII) about 

individuals that may be available to the agency through the FTC’s use of the social networking

Web site, Facebook (www.facebook.com). The purpose of this PIA is: (i) to ensure that the 

FTC’s handling of available PII conforms to applicable legal, regulatory, and policy 

requirements regarding privacy, (ii) to determine the risks and effects if the FTC were to collect, 

maintain or disseminate such information, and (iii) to examine and evaluate protections and 

alternative processes for handling such information to mitigate potential privacy risks. See

section 208 of the E-Government Act of 2002 (E-GOV); Office of Management & Budget

(OMB) Memoranda 03-22 (2003) & 10-23 (2010). 

As explained below, the impact of the FTC’s Facebook usage on individual privacy is low. The 

FTC uses Facebook as an additional avenue for providing consumers with information about the 

agency’s activities and programs, but the FTC does not routinely use Facebook to solicit, collect, 

maintain, or disseminate PII from any individual. At the same time, however, the FTC suggests

that individuals who visit or interact with the FTC’s Facebook pages carefully review 

Facebook’s terms of service and its privacy policies to understand how Facebook may collect or 

use their personal information, even if the FTC does not.

SECTION 1.0 PURPOSE

1.1 – What is the specific purpose of the FTC’s use of Facebook, and how does that use fit 

with the agency’s broader mission?

The FTC uses Facebook, a social networking website, to disseminate information to the public. 

The FTC maintains three specific Facebook pages: a general FTC page created and administered 

by the Office of Public Affairs (OPA), and two pages created and administered by the Division 

of Consumer and Business Education (DCBE) featuring the FTC’s inter-agency 

OnGuardOnline.gov campaign, which is available in English and Spanish.

The FTC Facebook pages can be accessed online at:

www.facebook.com/federaltradecommission

www.facebook.com/OnGuardOnline

www.facebook.com/AlertaenLinea

Facebook pages allow the Commission to promote FTC news and resources to consumers who 

may not be regular visitors to FTC websites, including FTC.gov, OnGuardOnline.gov, and 

NCPW.gov. Information posted to the FTC’s Facebook pages is previously approved by FTC 

staff and includes, but is not limited to, press releases, consumer alerts, videos, blog post links, 

quizzes, and games. 

These pages are available to the public, and individuals need not have a registered account on

Facebook to see the FTC’s Facebook page content. The vast majority of the FTC’s content on 

Facebook is also available on existing FTC websites. However, users who wish to actively 
engage with the FTC on Facebook must be registered users of the site, per Facebook’s Terms of 

Service. Users who interact with the FTC on Facebook may like, comment on, and share the 

FTC’s news and information, and those interactions add a viral marketing component to the 

Commission’s outreach and education efforts. 

1.2 – Is the FTC’s use of Facebook consistent with all applicable laws, regulations, and 

policies?

Yes. With respect to the information that the FTC will disseminate through its Facebook pages, 

the FTC Act authorizes the FTC to prevent unfair and deceptive acts and practices in interstate 

commerce and, in furtherance of this mission, to gather, compile, and make information 

available in the public interest. See 15 U.S.C. 45, 46(a), (f).

The President’s January 21, 2009 memorandum on Transparency and Open Government and the 

OMB Director’s December 8, 2009 Open Government Directive call on federal departments and 

agencies to harness new technologies to engage with the public. Facebook has over 850 million 

registered users. Using tools to communicate with consumers on platforms where they’re active 

helps the FTC to meet the federal guidance outlined in the directive and memorandum including 

transparency, participation and collaboration.

The FTC’s use of Facebook also complies with other applicable Federal privacy and information 

security laws, including the Privacy Act of 1974, section 208 of the E-Government Act (EGOV), the Federal Information Security Management Act (FISMA), and implementing policy 

guidance. For example, per federal guidance issued under E-GOV, the FTC includes exit 

scripts/and other notices to consumers when linking from FTC websites to Facebook, where the 

FTC’s privacy policy does not apply. An example of an FTC exit script for Facebook is available 

here. Furthermore, the FTC posts a detailed privacy policy on each of its Facebook pages. More 

information about Facebook’s privacy policy is available online. 

When the FTC’s account administrators share content on Facebook, including status updates 

and responses to comments, they strive to direct users to relevant FTC website pages as much as 

possible. The FTC’s official websites (e.g., www.ftc.gov) remain the official and primary source 

of information available to the public about the Commission, not its Facebook pages, as 

explained in notices posted on the FTC’s Facebook pages.

SECTION 2.0 – AVAILABILITY OF PII

2.1 – What PII is made available to the FTC?

Individual users who register with Facebook are required to provide a first name, last name, valid 

email address, password, sex, and date of birth to create a personal Facebook profile. Once 

registered, users have the option to provide a wealth of additional information about themselves 

such as telephone number, interests, employment, etc., which may be displayed on the individual 

user’s personal Facebook profile page or otherwise maintained or used by Facebook.
This information may be available to the FTC in whole or part, based on a user’s privacy 

settings. The FTC does not routinely solicit, collect, or maintain any personally identifiable 

information from individuals who visit, like, comment, or otherwise engage with the FTC’s 

Facebook pages. The FTC may however, read, review, or rely upon information that individuals 

make available to the FTC on Facebook including comments on FTC pages, as authorized or 

required by law. 

FTC Facebook administrators may delete any comments on the Commission’s Facebook pages 

that contain unnecessary amounts of PII, as stated in the FTC’s comment policy. 

The FTC may use generic user data available to page administrators through Facebook analytics, 

called Insights. This includes, but is not limited to, information about the number of likes and 

dislikes on the page in a given time period. None of the information gleaned from Insights used 

by the FTC includes any PII. 

2.2 – What are the sources of the PII?

Individual Facebook users are the source of any PII available to the agency on Facebook. 

Consumers who simply visit the FTC’s Facebook pages and either 1) do not have a Facebook 

account or 2) are not logged in/do not interact with the page, do not make any PII available to 

FTC Facebook administrators. Users who are logged in and interact with the FTC’s pages by 

liking, sharing, or commenting on FTC pages/posts, at a minimum, make their names available 

to the FTC. Registered users of Facebook provide additional information as outlined in Section 

2.1, which the FTC may or may not be able to see, depending on a user’s privacy settings, which 

the user controls. The FTC does not collect, maintain, or disseminate that information.

When answering questions, hosting interactive Facebook chats, or live events broadcasted on 

Facebook, the FTC may collect comments, but makes every reasonable attempt to remove any 

names prior to preserving agency records.

Any data the FTC uses from Insights does not contain PII. 

2.2 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how 

will the agency comply with the statute? 

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the 

Paperwork Reduction Act (April 7, 2010), the FTC’s use of Facebook as outlined in Section 1.1

is not a web-based interactive technology that would trigger the PRA, since the FTC’s use of 

Facebook is not an information collection activity under that law. 

SECTION 3.0 -- THE FTC’S INTENDED OR EXPECTED USE OF PII

Section 3.1 – Generally, how will the agency use the PII described in Section 2.0?

As explained earlier, the FTC may read, review, or rely upon information made available by 

individuals on Facebook (e.g., in any comments they post on the FTC’s Facebook pages). The 
FTC, however, does not routinely collect or maintain PII that may be made available on 

Facebook about registered users, particularly those who visit and/or engage with the FTC’s 

Facebook pages including liking, commenting, and/or sharing FTC content. The FTC may use 

some analytical data from Facebook, as described in Section 3.2, but this information does not 

contain PII.

Section 3.2 – Provide specific examples of the types of uses to which the PII may be subject.

The FTC may read, review, or rely upon information provided by individuals in comments on 

Facebook. See 3.1. When answering questions from consumers, hosting interactive Facebook 

chats, or live events broadcasted on Facebook, the FTC may also collect and maintain copies of 

these comments to satisfy Federal record retention requirements, but makes every reasonable 

attempt to remove any names prior to preserving such records.

As already noted, the Commission uses Facebook Insights to measure the overall number of likes 

and dislikes, and other engagement activities with FTC Facebook pages. Any data the FTC uses 

from Insights does not contain PII. 

SECTION 4.0 -- SHARING OR DISCLOSING OF PII

Section 4.1 – With what entities or persons inside or outside the agency will the PII be 

shared, and for what purposes will the PII be disclosed?

The FTC itself does not routinely share or disseminate PII made available to it on Facebook with 

entities or persons outside the FTC. Rather, any PII on Facebook is collected from individuals

and shared or otherwise disseminated solely by that site, and registered users may adjust their 

Facebook privacy settings to moderate the collection, sharing, or dissemination of their 

information by that site. See Section 2.0. 

Generally, all the information available to the FTC from users who interact with the FTC on 

Facebook by liking, commenting on, or sharing FTC news and information is also made publicly 

available on Facebook to anyone visiting the FTC’s pages. As noted earlier, the FTC can 

exercise limited control over the sharing of PII on its Facebook pages by deleting individual 

comments, consistent with its commenting policy, if an individual posts unnecessary amounts of 

PII.

Section 4.2 – What safeguards are in place to prevent expansion of use beyond those 

authorized under law and described in this PIA?

Only approved staff members from OPA and DCBE have access to manage the FTC’s Facebook 

pages. Each staff member with access must sign and comply with the Commission’s internal 

Rules of Behavior for account management, prior to beginning account administration. 

The FTC’s Facebook pages are registered as official business accounts to manage FTC Facebook 

pages, and administrators do not use their personal FTC accounts to manage them.
SECTION 5.0 -- MAINTENANCE AND RETENTION OF PII

Section 5.1 – How will the FTC maintain the PII, and for how long?

As explained earlier, the FTC does not routinely collect or maintain PII made available to it on 

Facebook.

As part of the Commission’s staff reports, any information collected from Facebook Insights is 

kept in accordance with Federal record retention requirements, but this information normally 

does not contain any PII nor is it kept in any type of a searchable database. 

Any comments collected as official agency records are retained and disposed of in accordance 

with applicable schedules issued or approved by the National Archives and Records 

Administration.

Individual users register for Facebook accounts and maintain their data on Facebook to the extent 

permitted by Facebook’s terms of service. For example, users who choose to interact with the 

FTC can publicly “unlike” and delete their interactions on the FTC’s pages at any time.

FTC Facebook page administrators have limited ability to delete users and/or their comments, 

hide posts, and block users, as noted earlier. Staff deletes comments that violate the FTC’s 

comment policy, which is outlined on each of its Facebook pages. The FTC does not maintain 

any record of deleted comments nor do they notify users that their comments have violated the 

comment policy. 

Section 5.2 – Was the retention period established to minimize privacy risk?

Per the FTC’s own privacy policy, the FTC does not collect any information, including PII, that 

is unnecessary, in order to minimize privacy risk and reduce the amount of information that must 

be maintained. In cases where the FTC determines that a copy of a comment or other interaction 

on Facebook must be made to satisfy Federal records retention requirements, the FTC makes 

every reasonable attempt to remove any identifiable portions (e.g., name of the user or other 

information that could identify the user) when retaining such a copy. 

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII

Section 6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of 

securing PII?

Not applicable. See Sections 2.0 and 5.0. Facebook, not the FTC, controls the security of 

comments or other information posted on that site. Facebook users should review Facebook’s 

terms of service and privacy policies for information regarding the security of that site. Any FTC 

copies of comments or other user interactions on Facebook with the FTC are maintained by the 

FTC subject to applicable Federal privacy and information security laws, and such copies would 

not normally include any PII, as explained earlier.
SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS

Section 7.1 – What other privacy risks exist, and how will the agency mitigate those risks?

Facebook is a third-party service that uses persistent tracking technologies. In an effort to help 

consumers understand how their information is used by Facebook, the FTC posts additional 

notices to users on each of its Facebook pages, including a specific privacy policy. Furthermore, 

the FTC informs consumers who link to FTC Facebook pages from official FTC websites that 

they are leaving the FTC’s websites and the Commission’s privacy policy no longer governs, and 

provides links to Facebook’s privacy policy. These notices are available through exit scripts or 

text overlays at all points that connect users to Facebook from official FTC websites. 

Per the terms of service negotiated by the General Services Administration and Facebook, the 

FTC’s Facebook pages do not contain any third-party advertising. This limits any association 

with, or obscure links to, additional content that the FTC has neither reviewed nor endorsed on 

the FTC’s Facebook pages. In addition, Facebook users should review the site’s terms of service 

and privacy policies to understand how Facebook may collect information about such users, 

including what pages the user may visit, and how Facebook may use or share such information 

for third-party advertising or other purposes. 

Users should also exercise care and be aware of the risks associated with any third-party Web 

site, particularly as to any tracking technology (e.g., cookies, beacons) and potentially interactive 

content (e.g., links, videos, games, applications, messaging, or other features or functions) that 

may collect, use, or share the user’s personal information, or compromise the user’s computer 

security, without the user’s knowledge or consent (e.g., malware, spyware, phishing). Because

the vast majority of the FTC’s content on Facebook is already available on the FTC’s official 

websites, consumers do not need to visit or utilize the FTC’s Facebook pages if they have any 

privacy concerns about any third-party material (e.g., a comment or link) posted on such pages. 

Likewise, the FTC’s Facebook account administrators shall attempt to identify and remove such 

privacy and security threats and vulnerabilities as they may arise, if any, in managing the FTC’s 

pages. 

The FTC routinely reviews Facebook privacy policies for any changes that may affect the FTC’s 

use of Facebook and will update its privacy policies on Facebook, FTC.gov websites, and this 

PIA. 

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS

Section 8.1 – Will the FTC’s activities create or modify a “system of records” under the 

Privacy Act of 1974?

The FTC does not collect PII through its Facebook pages, thus it does create or modify a system 

of records under the Privacy Act of 1974.
Prepared for the Business Owners of the System by:

_______________________________________ Date: __________

Cheryl Hackley

Office of Public Affairs

Review:

_______________________________________ Date: __________

Alex Tang

Office of the General Counsel

_______________________________________ Date: __________

Peter Miller

Acting Chief Privacy Officer

_______________________________________ Date: __________

Jeffrey Nakrin

Director, Records and Filings Office

_______________________________________ Date: __________

Jeffrey Smith

Information Assurance Manager

Approved:

_______________________________________ Date: _________

Jeffrey Huskey

Chief Information Officer