A federal judge in Washington, D.C., signed off on a record $5 billion fine imposed by the U.S. Federal Trade Commission on Facebook for allegedly violating federal law and a previous order with its privacy practices.

In an opinion issued Thursday night, U.S. District Judge Timothy Kelly of the District of Columbia approved the settlement and sharply criticized Facebook's alleged conduct, which stemmed from the Cambridge Analytica scandal. A whistleblower revealed in 2018 that Cambridge Analytica had harvested data from millions of Facebook users without their knowledge or permission and used the information for political ads.

The scandal and resulting investigation showed that Facebook was sharing user data with third parties, despite users believing that information was being kept private, according to the FTC. The FTC alleged these privacy practices were in violation of both federal law and a 2012 court order Facebook is under for past privacy violations.

Kelly wrote in Thursday's opinion that "the unscrupulous way in which the United States alleges Facebook violated both the law and the administrative order is stunning."

"And these allegations, and the briefs of some amici, call into question the adequacy of laws governing how technology companies that collect and monetize Americans' personal information must treat that information," the judge continued. "But those concerns are largely for Congress; they are not relevant here. Mindful of its proper role, and especially considering the deference to which the executive's enforcement discretion is entitled, the court will grant the consent motion and enter the order as proposed."

The judgement is a record fine from the FTC, which announced the penalty last year. Among the measures formally imposed by Thursday's opinion is a requirement that Facebook clearly tell users when their data can be accessed by outside parties and get their permission if their initial privacy settings don't allow for the information to be shared. The tech giant has also agreed to create a new privacy committee of board members, who cannot be removed without support of two-thirds of shareholders, and Facebook founder and CEO Mark Zuckerberg will now have more limited control over the company's privacy and security practices.

Facebook is represented in the case by a team at Gibson, Dunn & Crutcher, including partners Joshua Lipshutz, Orin Snyder and Thomas Hungar.

Some FTC commissioners had pushed for Zuckerberg and other top Facebook executives to be held personally liable for the sharing of private user data, which Kelly acknowledged in his opinion Thursday. However, he said approval of the order is still in the public's interest.

Kelly wrote that while he found the allegations against Facebook "shocking, it is not appropriate for the court to judge the stipulated order as if it were proposed after the United States had already proven those allegations up at trial." He found the order "clears the modest bar of reasonableness."

Kelly noted outside groups had urged him to adopt stronger measures against Facebook.

"But the overall terms of the stipulated order are not unreasonable simply because they do not apply an entirely different privacy-focused legal regime to Facebook or require the company to be broken apart. And the court's role is not to play the executive's part in deciding how to enforce the law," he wrote.

"While the court might well have fashioned different remedies were it doing so out of whole cloth after a trial, none of amici's criticisms call into question the Stipulated Order's reasonableness, or whether it is otherwise appropriate," Kelly added.

And he warned Facebook that if it allegedly violates the terms of the order again, "the court may not apply quite the same deference to the terms of a proposed resolution."

Kelly on Thursday also rejected motions to intervene in the case from the Electronic Privacy Information Center and a pro se plaintiff, Leonid Goldstein, who is suing Facebook separately. He found both lacked standing to be added to the case.

Alan Butler, the interim executive director of EPIC, said in an email Friday that the group "will continue to fight to protect the privacy interests of Facebook users."

"It is certainly important that Facebook be penalized for these violations, and the court noted that $5 billion is the largest fine ever issued by the FTC. But that is not enough," Butler wrote. "Facebook's business practices need to change, and Facebook users need to be protected from such violations in the future. EPIC will work to ensure that the FTC enforces its orders and that Facebook complies with its privacy obligations."

Read more: