The FTC alleges that Facebook failed to safeguard user data from third parties and used their phone numbers to provide targeted advertising. It also alleges that some users were misled into believing their facial recognition feature was turned off when it was in fact on.

The settlement order also imposes unprecedented new restrictions on Facebook’s business operations and creates multiple channels of compliance. The order requires Facebook to restructure its approach to privacy from the corporate board-level down and to establish strong new mechanisms ensuring company executives are accountable for the decisions they make about privacy, and that those decisions are subject to meaningful oversight.

Facebook chief executive Mark Zuckerberg will have to personally certify the company’s compliance with privacy measures and it will have to submit quarterly privacy review to demonstrate its measures are working.

Failure to do so could see civil or criminal action taken against Mr Zuckerberg.

FTC Chairman Joe Simons said: “Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices.”

He added: “The magnitude of the $5 billion penalty and sweeping conduct relief are unprecedented in the history of the FTC. The relief is designed not only to punish future violations but, more importantly, to change Facebook’s entire privacy culture to decrease the likelihood of continued violations. The commission takes consumer privacy seriously, and will enforce FTC orders to the fullest extent of the law.”

“The Department of Justice is committed to protecting consumer data privacy and ensuring that social media companies like Facebook do not mislead individuals about the use of their personal information,” said Assistant Attorney General Jody Hunt for the Department of Justice’s Civil Division.

“This settlement’s historic penalty and compliance terms will benefit American consumers, and the department expects Facebook to treat its privacy obligations with the utmost seriousness.”