FTC Settlement Targets Deceptive Promises of Enhanced Privacy

Instead, according to the FTC’s complaint, PrivacyLock did not block consumers’ names from showing up as an associate of someone else in a search for the other person’s name; did not block consumers’ information from appearing in a "reverse search" of their phone number or address, or in a search of their address in real estate records; did not work if the consumer changed addresses; and did not work if the consumer had multiple records (e.g., "John Smith" and "John T. Smith").  The consent decree, which is part of the proposed settlement, subject to a regulatory comment period, prohibits US Search from continuing to market any products claiming to ensure consumer privacy in such a manner and requires it to refund customers who paid for Privacy Lock.

This enforcement action comes on the heels of the FTC’s Feburary settlement with ControlScan, another company that promoted a privacy-enhancing service but failed to live up to its promises.  In that case, ControlScan purported to certify the privacy and data security practices of its clients’ websites but failed to adequately verify those websites’ actual privacy and security protections and displayed a certification date that did not reflect the actual date of its most recent security review.  And last October, the FTC brought enforcement actions against six companies over misrepresentations that they were current with their certifications under the U.S.-EU Safe Harbor program, a privacy compliance program that provides assurance to European organizations that U.S. businesses to which they transfer personal data will treat that data in accordance with European privacy standards.

The FTC’s activity in this area demonstrates the importance it places on promises of privacy and security by companies that directly sell and market privacy and security protections.  Privacy enhancing services are obviously a good thing.  But profiting from consumers’ willingness to pay for  protections by selling them knowingly or negligently false guarantees will trigger enforcement actions.  Therefore, companies developing privacy certifications and technologies should take care to evaluate their marketing materials and to constantly evaluate their services to ensure that they do not fall short in their promises to consumers.

Authored by Bret Cohen.