> prohibited from misrepresenting how it monitors internal access to consumers’ personal information; I don't understand why one would need an agreement betwee

> prohibited from misrepresenting how it monitors internal access to consumers’ personal information; I don't understand why one would need an agreement between Uber and the FTC explicitly mentioning this. Is it not illegal if a company misrepresents its compliance to the regulator? > required to implement a comprehensive privacy program … > required to obtain within 180 days, and every two years after that for the next 20 years, independent, third-party audits certifying that it has a privacy program in place that meets or exceeds the requirements of the FTC order This is worth noting, it clearly alludes to a need for "privacy champion" (or "privacy engineer/compliance officer/deputy CIO") for any business that deals with sensitive (to regulatory compliance) personal information. It's not enough to write a token "/about/privacy.html" and relegate any and all of the system requirements that arise due to regulatory compliance. I hope other startups take note of this, and plan to allocate resources to this in their roadmap. I don't care when exactly you plan to do it - make sure it's there in your TODO list of things before the regulator comes knocking on your doors. Also, I was unable to find any number or estimate of cost of compliance mentioned in the settlement. I would really prefer when a government agency agrees to settle with a business they make it public how much the business was fined as well as the future cost of compliance. This information would hopefully make it clear to future businesses to take privacy issues seriously.