The settlement itself doesn't carry any fine, but does put the companies under a looming threat of stiff penalties should they – at any point in the next 20 years – be found to be lying about their security or privacy certifications (or lack thereof).