The Federal Trade Commission (FTC) today announced its settlement with Spokeo, Inc. for alleged violations of the Fair Credit Reporting Act (FCRA) and Section 5(a) of the FTC Act. As part of the FTC's ongoing enforcement of the FCRA to regulate the collection, dissemination, and use of consumer credit information, this is the first case to involve the sale of social media data in the employment screening context.
Spokeo is a self-proclaimed "people search engine." According to the complaint, Spokeo assembles consumer information from hundreds of online and offline sources, including social networking sites, to create searchable consumer profiles. These profiles contain individuals' full name, physical address, phone number, age range, and email address, as well as other information such as hobbies, ethnicity, religion, participation in social networking sites, and photos. Spokeo promotes its service as providing "coherent people profiles" and "powerful intelligence," and sells this information through paid subscriptions and application program interfaces (API).
The FTC alleged that for a two-year period, Spokeo operated as a consumer reporting agency by marketing consumer profiles as an employment screening tool to human resources professionals and job recruiters. Spokeo specifically exhorted recruiters to "Explore Beyond the Resume" by using the company’s services to capture job applicants' personal interests and online activities. According to the complaint, Spokeo violated the FCRA by failing to ensure that the information it sold was accurate and would be used only for legally permissible purposes, and by failing to tell prospective employers about their obligations under the FCRA, including the requirement that consumers be notified when adverse actions are taken against them based on information contained in the profiles.
In addition to the FCRA violations, the FTC alleged that Spokeo directed employees to post endorsements of its services on third party websites using fake account names in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). According to the FTC, Spokeo misled consumers by representing that these comments were independently generated by ordinary consumers or business users. These misrepresentations allegedly constitute unfair or deceptive acts or practices prohibited by the FTC Act.
Under the proposed settlement terms, Spokeo will pay an $800,000 civil penalty. The settlement bars Spokeo from future violations of the FCRA and the FTC Act. Undoubtedly this is the first of many cases of alleged FCRA violations for the use of social media data in the employment screening context. This settlement serves as a cautionary tale that the FCRA will apply with full force when a consumer reporting agency assembles or evaluates consumer report information, including data collected from social networking sites, to be used for employment screening purposes.