Federal Trade Commission

Privacy Impact Assessment

Facebook 

Updated May 2019
The Federal Trade Commission (FTC or Commission) has prepared this Privacy Impact Assessment

(PIA) to analyze and explain how the FTC handles personally identifiable information (PII)1 about

individuals that may be available to the agency through the FTC’s use of the social networking Web 

site, Facebook (www.facebook.com). The purpose of this PIA is: (i) to ensure that the FTC’s handling 

of available PII conforms to applicable legal, regulatory, and policy requirements regarding privacy, (ii)

to determine the risks and effects if the FTC were to collect, maintain or disseminate such information, 

and (iii) to examine and evaluate protections and alternative processes for handling such information to 

mitigate potential privacy risks. See section 208 of the E-Government Act of 2002 (E-GOV); Office of 

Management & Budget (OMB) Memoranda 03-22 (2003) & 10-23 (2010); OMB Circular A-130 (2017). 

SECTION 1.0 PURPOSE

1.1 – What is the specific purpose of the FTC’s use of Facebook, and how does that use 

fit with the agency’s broader mission?

The FTC uses Facebook, a social networking website, to disseminate information to the public. The

FTC currently maintains two specific Facebook pages: a general FTC page created and administered by 

the Office of Public Affairs (OPA) and a page created and administered by the Division of Consumer 

and Business Education (DCBE) catering to the military community. 

The FTC Facebook pages can be accessed online at:

www.facebook.com/federaltradecommission 

www.facebook.com/militaryconsumer 

These Facebook pages allow the Commission to promote FTC news and resources to consumers who

may not be regular visitors to FTC websites, including www.ftc.gov and www.co n sumer.ftc.gov. 

Information posted to the FTC’s Facebook pages is previously approved by FTC staff and includes, but 

is not limited to, press releases, consumer alerts, videos, blog post links, quizzes, and games.

These pages are available to the public, and individuals need not have a registered account on 

Facebook to see the FTC’s Facebook page content. The vast majority of the FTC’s content on 

Facebook is also available on existing FTC websites. However, users who wish to actively engage with

the FTC on Facebook must be registered users of the site, per Facebook’s Terms of Service. Users who 

interact with the FTC on Facebook may like, comment on, and share the FTC’s news and information, 

and those interactions add a viral marketing component to the Commission’s outreach and education

efforts.

The FTC also intends to use Facebook’s “Live” feature, which allows the agency to share live videos 

with consumers, media, partners, etc. Use of Facebook Live allows the FTC to provide answers to 

audience questions or comments in real time and demonstrates the Commission’s commitment to 

transparency and accessibility. 

This PIA addresses the FTC’s use of Facebook to disseminate information to and interact with

consumers about the Commission’s mission-related initiatives. It does not encompass the FTC’s

 

1 Per OMB Circular A-130, personally identifiable information (PII) means information that can be used to 

distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or 

linkable to a specific individual.
use of Facebook for law enforcement investigations or any collection of personal information 

subject to the Privacy Act of 1974, and described more fully in the FTC’s Statement of Record 

Notice I-1 (Nonpublic Investigational and Other Nonpublic Legal Program Records).

2

1.2 – Is the FTC’s use of Facebook consistent with all applicable laws, regulations, 

and policies?

Yes. With respect to the information that the FTC will disseminate through its Facebook pages, the 

FTC Act authorizes the FTC to prevent unfair and deceptive acts and practices in interstate commerce 

and, in furtherance of this mission, to gather, compile, and make information available in the public 

interest. See 15 U.S.C. 45, 46(a), (f).

The President’s January 21, 2009 memorandum on Transparency and Open Government and the OMB 

Director’s December 8, 2009 Open Government Directive call on federal departments and agencies to

harness new technologies to engage with the public. Using tools to communicate with consumers on 

platforms where they are active helps the FTC to meet the federal guidance outlined in the directive and 

memorandum including transparency, participation and collaboration.

The FTC’s use of Facebook also complies with other applicable Federal privacy and information

security laws, including the Privacy Act of 1974, section 208 of the E-Government Act (E- GOV), the 

Federal Information Security Management Act (FISMA), and implementing policy guidance. For

example, per federal guidance issued under E-GOV, the FTC includes exit scripts/and other notices to

consumers when linking from FTC websites to Facebook, where the FTC’s privacy policy does not 

apply. An example of an FTC exit script for Facebook is available here. Furthermore, the FTC posts a 

detailed privacy policy on its Facebook page. More information about Facebook’s privacy policy is

available online. 

When the FTC’s account administrators share content on Facebook, including status updates and 

responses to comments, they strive to direct users to relevant FTC website pages as much as possible. 

The FTC’s official websites (http://www.ftc.gov) remain the official and primary source of information 

available to the public about the Commission, not its Facebook pages, as explained in notices posted on 

the FTC’s Facebook pages.

SECTION 2.0 – AVAILABILITY OF PII

2.1 – What PII is made available to the FTC?

Individual users who register with Facebook are required to provide a first name, last name, valid email

address, password, sex, and date of birth to create a personal Facebook profile. Once registered, users

have the option to provide a wealth of additional information about themselves such as telephone 

number, interests, employment, etc., which may be displayed on the individual user’s personal Facebook 

profile page or otherwise maintained or used by Facebook. This information may be available to the FTC 

in whole or part, based on a user’s privacy settings.

The FTC may, read, review, or rely upon information that Facebook users make available to the public 

 

2 See OMB 10-23 at 2 (requiring PIAs for “any Federal agency use of third-party websites or applications to engage 

with the public for the purpose of implementing the principles of the Open Government Directive.”) OMB 10-23 

specifically carves out applicability for “activities that are part of authorized law enforcement, national security, or 

intelligence activities.”
or to the FTC as authorized or required by law. The privacy impact of the FTC’s use of this platform is 

low, as the FTC does not routinely use Facebook to solicit, collect, maintain, or disseminate PII from 

members of the public. In specific circumstances, the FTC may collect limited information (e.g. 

usernames or handles) about members of the public (e.g., if messages or posts directed to the FTC or its

employees on Facebook are deemed as threatening or violent, or where the content may reveal some 

other potential law enforcement violation). The FTC may also occasionally produce reports or 

summaries of its use of this social media platform that include PII posted publicly (i.e., usernames): for 

instance, it may do so if needed to comply with social media records retention guidelines from the 

National Archives and Records Administration (NARA). In such instances, the collection of PII in these 

summaries will be reduced as much as is feasible.

FTC Facebook administrators may delete any comments on the Commission’s Facebook pages that

contain unnecessary amounts of PII, as stated in the FTC’s comment policy posted on its Facebook page.

The FTC may use generic user data available to page administrators through Facebook analytics, called 

Insights. This includes, but is not limited to, information about the number of likes and dislikes on the 

page in a given time period. None of the information that the FTC gleans from Insights includes any PII.

2.2 – What are the sources of the PII?

Individual Facebook users are the source of any PII available to the agency on Facebook. Consumers

who simply visit the FTC’s Facebook pages and either 1) do not have a Facebook account or 2) are not 

logged in/do not interact with the page, do not make any PII available to FTC Facebook administrators. 

Users who are logged in and interact with the FTC’s pages by liking, sharing, or commenting on FTC

pages/posts, at a minimum, make their names available to the FTC. Registered users of Facebook 

provide additional information as outlined in Section 2.1, which the FTC may or may not be able to see,

depending on a user’s privacy settings, which the user controls.

2.3 – Do the FTC’s activities trigger the Paperwork Reduction Act (PRA) and, if so, how

will the agency comply with the statute?

Per the OMB memorandum, Social Media, Web-Based Interactive Technologies, and the Paperwork 

Reduction Act (April 7, 2010), the FTC’s use of Facebook as outlined in Section 1.1 is not a web-based 

interactive technology that would trigger the PRA, since the FTC’s use of Facebook is not an

information collection activity under that law.

SECTION 3.0 -- THE FTC’S INTENDED OR EXPECTED USE OF PII

3.1 – Generally, how will the agency use the PII described in Section 2.0?

The FTC will use Facebook to disseminate information to the public. See also Section 2.1 above. The

FTC may also use some analytical data from Facebook, as described in Section 3.2, but this information 

does not contain PII.

3.2 – Provide specific examples of the types of uses to which the PII may be subject.

For example, when the FTC posts updates on its Facebook pages, individuals sometimes comment on 

the updates. These comments may include PII from the individual making the comment, such as their 

names. The FTC may read, review, or rely upon information provided by individuals in comments on
Facebook. See also section 3.1 and 2.1 above. 

As already noted, the Commission uses Facebook Insights to measure the overall number of likes and

dislikes, and other engagement activities with FTC Facebook pages. Any data the FTC uses from Insights

does not contain PII.

SECTION 4.0 -- SHARING OR DISCLOSING OF PII

4.1 – With what entities or persons inside or outside the agency will the PII be

shared, and for what purposes will the PII be disclosed?

All information available to the FTC from users who interact with the FTC on Facebook by liking, 

commenting on, or sharing FTC news and information is also publicly available on Facebook to anyone

visiting the FTC’s pages. As noted earlier, the FTC can exercise limited control over the sharing of PII 

on its Facebook pages by deleting individual comments, consistent with its commenting policy, if an 

individual posts unnecessary amounts of PII. See also 2.1 above, since in limited instances, PII posted 

on Facebook may need to be specifically provided to others at the agency, to other law enforcement 

agencies, or to NARA. 

It is important to note that the FTC’s Facebook page is not the official FTC website. Facebook is 

controlled and operated by a third party and is not a government website or application. Therefore, by 

using Facebook and its application providers to access the FTC’s Facebook page, users may be 

providing non-government third parties access to their personal information, which can be used to 

distinguish or trace an individual’s identity. Additionally, Facebook and its application providers may 

use persistent technology throughout their sites.

There is a possibility that other third party applications may access and share user information. For 

example, links posted by the FTC may lead to third-party, non-government websites that may have 

different privacy policies than those of Facebook or the FTC. When visiting the FTC Facebook page, 

users should be aware of their privacy settings and the personal information being collected by 

Facebook and non-FTC related applications.

4.2 – What safeguards are in place to prevent expansion of use beyond those

authorized under law and described in this PIA?

Only approved staff members from OPA and DCBE have access to manage the FTC’s Facebook pages. 

Each staff member with access must sign and comply with the Commission’s internal Rules of Behavior 

for account management, prior to beginning account administration.

The FTC’s Facebook pages are registered as official business accounts to manage FTC Facebook pages,

and administrators do not use their personal FTC accounts to manage them.

SECTION 5.0 -- MAINTENANCE AND RETENTION OF PII

5.1 – How will the FTC maintain the PII, and for how long?

In general, this does not apply, as the FTC does not routinely use Facebook to solicit, collect, maintain, 

or disseminate PII from members of the public. In the limited instances in which the FTC does so (see 
2.1 above), any PII collected will be securely stored in accordance with FTC policy. See, for instance, 

the Data Center Privacy Impact Assessment. 

As part of the Commission’s staff reports, any information collected from Facebook Insights is kept in

accordance with Federal record retention requirements, but this information normally does not contain

any PII nor is it kept in any type of a searchable database.

Individual users register for Facebook accounts and maintain their data on Facebook to the extent

permitted by Facebook’s terms of service. For example, users who choose to interact with the FTC can 

publicly “unlike” and delete their interactions on the FTC’s pages at any time.

FTC Facebook page administrators have limited ability to delete users and/or their comments, hide

posts, and block users, as noted earlier. Staff deletes comments that violate the FTC’s comment policy,

which is outlined on each of its Facebook pages. The FTC does not maintain any record of deleted 

comments nor do they notify users that their comments have violated the comment policy.

5.2 – Was the retention period established to minimize privacy risk?

In general, this does not apply, as the FTC does not routinely use Facebook to solicit, collect, maintain, 

or disseminate PII from members of the public. In the limited instances in which the FTC does so (see 

2.1 above), any PII collected will be retained and disposed of in accordance with NARA’s General 

Records Schedule (GRS) 6.4, item 020, Public Comments and Communications Not Requiring Formal 

Action, or other records schedules that may apply. 

Per the FTC’s own privacy policy, the FTC does not collect any information (including PII) that is 

unnecessary, in order to minimize privacy risk and reduce the amount of information that must be 

maintained.

SECTION 6.0 – HOW THE AGENCY WILL SECURE PII

6.1 – Will the FTC’s privacy and security officials coordinate to develop methods of

securing PII?

In general, this does not apply, as the FTC does not routinely use Facebook to solicit, collect, maintain, or 

disseminate PII from members of the public. Regarding the limited instances in which the FTC does so 

(see 2.1 above), privacy and security officials routinely coordinate to develop methods to secure all 

agency PII. Any FTC copies of comments or other user interactions on Facebook with the FTC are 

maintained by the FTC subject to applicable Federal privacy and information security laws.

Facebook, not the FTC, controls the security of comments or other information posted on that site.

Facebook users should review Facebook’s terms of service and privacy policies for information 

regarding the security of that site. 

SECTION 7.0 – IDENTIFICATION AND MITIGATION OF OTHER PRIVACY RISKS

7.1 – What other privacy risks exist, and how will the agency mitigate those risks?

The privacy impact of the FTC’s use of this platform is low, as the FTC does not routinely use Facebook 

to solicit, collect, maintain, or disseminate PII from members of the public. See 2.1 for more 
information.

However, Facebook is a third-party service that uses persistent tracking technologies. In an effort to help

consumers understand how their information is used by Facebook, the FTC posts additional notices to

users on its Facebook pages, including a Facebook-specific privacy policy. Furthermore, the FTC 

informs consumers who link to FTC Facebook pages from official FTC websites that they are leaving 

the FTC’s websites and the Commission’s privacy policy no longer governs, and provides links to

Facebook’s privacy policy. These notices are available through exit scripts or text overlays at all points

that connect users to Facebook from official FTC websites.

The FTC’s Facebook pages do not contain any third-party advertising. This limits any association with, 

or obscure links to, additional content that the FTC has neither reviewed nor endorsed on the FTC’s 

Facebook pages. In addition, Facebook users should review the site’s terms of service and privacy

policies to understand how Facebook may collect information about such users, including what pages

the user may visit, and how Facebook may use or share such information for third-party advertising or

other purposes.

Users should also exercise care and be aware of the risks associated with any third-party Web site, 

particularly as to any tracking technology (e.g., cookies, beacons) and potentially interactive content

(e.g., links, videos, games, applications, messaging, or other features or functions) that may collect, use,

or share the user’s personal information, or compromise the user’s computer security, without the user’s 

knowledge or consent (e.g., malware, spyware, phishing). Because the vast majority of the FTC’s

content on Facebook is already available on the FTC’s official websites, consumers do not need to visit 

or utilize the FTC’s Facebook pages if they have any privacy concerns about any third-party material 

(e.g., a comment or link) posted on such pages. Likewise, the FTC’s Facebook account administrators

shall attempt to identify and remove such privacy and security threats and vulnerabilities as they may

arise, if any, in managing the FTC’s pages.

SECTION 8.0 – CREATION OR MODIFICATION OF A SYSTEM OF RECORDS

8.1 – Will the FTC’s activities create or modify a “system of records” under the Privacy 

Act of 1974?

No. The FTC does not collect PII from Facebook in a manner that would require the FTC to create or 

modify a system of records under the Privacy Act of 1974.