Wrong. The FTC said very clearly that it thinks Facebook lured consumers in under false pretenses. That's punishable by criminal and civil penalties, in theory. The FTC usually settles these kind of cases, AFAIK. Sometimes there's money involved, sometimes not. Anyone who isn't in compliance with their own published privacy policy should be worried about the FTC; they can (again, in theory) do serious harm to a business – even one as big as Facebook.
So are you suggesting that despite FB's rather sizeable legal budget and level of investment they will _still_ not be able to bring themsleves into compliance and stay that way? At least until the IPO. If Facebook even exists 20 years let alone 5 years from now I would be shocked. The data they've collected will of course probably have an infinite lifetime.
In the US, given that they're not in a regulated industry (except to the extent they qualify as a site aimed at children), they really only need to comply with their own stated privacy policies. The question is: will they?
