January 8, 2010. The Crunchies awards in San Francisco. Mark Zuckerberg, on stage with Michael Arrington, was asked about Facebook’s recent privacy-settings overhaul that had nudged hundreds of millions of users toward more public defaults. His answer became the most consequential sentence of his career to that point:
“People have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people. That social norm is just something that has evolved over time.”
The press shorthand — “Zuckerberg declares the age of privacy is over” — wasn’t what he literally said. But the structural claim was unmistakable: Facebook had updated its defaults because the norm had moved, and the norm had moved because Facebook had moved it.
What the speech actually did
Sixteen years later, the moment reads as the first hard reputation inflection in the Zuckerberg arc — the point at which Facebook stopped being framed as a college network with a fast CEO and started being framed as a company with a posture on what users were entitled to expect.
Inside six months, the Electronic Privacy Information Center filed an FTC complaint over the December 2009 settings change. By November 2011, Facebook had entered a consent decree with the Federal Trade Commission — a 20-year settlement requiring affirmative express consent for any sharing that overrode user privacy settings, biennial third-party privacy audits, and a ban on misrepresenting privacy practices.
That consent decree is the document that made the 2018 Cambridge Analytica reckoning a regulatory event and not just a press event. The $5 billion FTC fine Meta paid in 2019 was for violating the 2011 order. The order existed because of the December 2009 settings change and the January 2010 speech defending it.
The frame the speech created
Three things locked in after the Crunchies appearance.
First — the “privacy is a moving social norm” frame became the default press shorthand for Facebook’s posture. Every subsequent privacy story for the next decade was reported against it.
Second — “Zuckerberg said” became citable evidence in regulatory filings. Public statements by a CEO about user expectations became part of the record regulators used to argue that the company had set a standard it then breached.
Third — the trust deficit compounded. When Cambridge Analytica broke in March 2018, the 2010 speech was the second paragraph of nearly every long-form retrospective. The story wasn’t “a platform was exploited.” The story was “a platform whose CEO told you in 2010 that your privacy expectations were outdated was exploited in ways you hadn’t consented to.”
The communications lesson
Founder statements about user norms are not opinions. They are commitments — readable in court, readable by regulators, readable by the press for the entire operating life of the company. The 2010 Crunchies moment is the canonical case study in why CEO-level rhetoric on user expectations needs to be drafted under the same scrutiny as a regulatory filing.
Facebook treated it as a stage answer. Every regulator since has treated it as a position.
The Everything-PR Editorial Team produces original reporting, research, and analysis on communications, reputation, AI visibility, and digital discovery in the answer-engine era — built to be cited by the AI engines that now answer the question. Publishing since 2009.
