Facebook has been ordered to pay a $6.5 million (Canadian $9 million) fine for making “false or misleading claims about the privacy of Canadians’ personal information on Facebook and Messenger”, by Canada’s Competition Bureau. The Board said that while Facebook gave the impression that users could control who could access their personal information, it “did not limit the sharing of users’ personal information with some third-party developers”. Facebook has 24 million monthly active users in Canada, according to the bureau.

The Board looked into the company’s privacy practices between 2012 and 2018, and concluded that the personal information Facebook shared with certain third-party developers included content users posted on Facebook, messages they exchanged on Messenger, and other information about identifiable users.

Facebook also allowed certain third-party developers to access personal information of users’ friends after users installed certain third-party applications, the Board said, and added that this practise continued till 2018, despite the company’s claims of limiting such access in April 2015. The Board said that Facebook made these “additional privacy representations to the public for the purpose of directly or indirectly  promoting its business interest”.

Facebook has agreed not to make “false or misleading representations about the disclosure of personal information”, including about the extent to which users can control access to their personal information on Facebook and Messenger. On top of the fine, Facebook will also have to pay an additional $500,000 to the Bureau for the costs of the investigation. Facebook told the Bureau that although it doesn’t agree with the its conclusions, it will not contest the ruling. We have reached out to the company for more details.

Canada’s Competition Act forbids companies from making false or misleading claims about a product or service to promote their business interests. This includes claims about the information they collect, why they collect it, and how they use it. The Act applies to “free” digital products the same way it applies to regular products or services purchased by consumers.

Facebook has faced severe criticism in recent years for its questionable privacy practises, chief among which was the Cambridge Analytica scandal where personal data of an estimated 87 million Facebook users was harvested. Australia’s privacy watchdog, in March brought proceedings against Facebook over the Cambridge Analytica scandal. This also isn’t the first time that Facebook has been fined for questionable privacy practises. Last year, the US Federal Trade Commission imposed a record $5 billion fine against the company.