The agency cited thousands of complaints from users that their email contacts -- which included in some cases ex-spouses, patients, students, employers, or competitors -- were revealed against their will by the search giant's new social network when Buzz was unveiled in 2010.
According to a statement released by the agency, this amounted to deceptive tactics and marked a breach of Google's own privacy promises to consumers -- a mistake that violated the FTC Act.
“This is a tough settlement that ensures that Google will honor its commitments to consumers and build strong privacy protections into all of its operations," said Jon Leibowitz, chairman of the FTC, in a statement about the settlement. “When companies make privacy pledges, they need to honor them."
Per the terms of the settlement -- which the FTC said "should serve as a guide to industry" -- Google must implement a comprehensive privacy program. It also calls for regular, independent privacy audits every two years for the next 20 years -- marking the first time an FTC settlement order has required a company to implement a comprehensive program to protect the privacy of consumers’ information.
A spokesman for the agency said the company may face still fines as well for any future violations.
"Google could be subject to civil penalties in the amount of $16,000 per violation (standard) for violating consent decree," the FTC wrote during an unusual press conference held over the Twitter service.
Watchdog group the Electronic Privacy Information Center (EPIC) had filed the original complaint on behalf of users in 2010. Google acknowledged the missteps in a post to its blog, and apologized for its mistakes.
"The launch of Google Buzz fell short of our usual standards for transparency and user control -- letting our users and Google down," wrote Alma Whitten, director of privacy for the search giant.
We’d like to apologize again for the mistakes we made with Buzz," Whitten wrote. "While today’s announcement thankfully put this incident behind us, we are 100 percent focused on ensuring that our new privacy procedures effectively protect the interests of all our users going forward."