Spokeo, Inc., a data broker that compiles and sells consumer profiles, has agreed to pay $800,000 to settle charges with the Federal Trade Commission (FTC). According to the FTC, the company violated the Fair Credit Reporting Act (FCRA) and the FTC’s Endorsement Guides. In addition to the $800,000 civil penalty, the settlement also requires Spokeo to comply with the FCRA, bans the company from making misrepresentations about its endorsements, and bans them from failing to disclose material connections between itself and its endorsers.
Spokeo operates a “people search engine.” It compiles profiles about individuals using information from all over the Internet, including social networking sites, data brokers, and other websites. The profiles provide specific information such as an individual’s name, age range, marital status, address, phone number, and/or email address. The profiles may also include information such as an individual’s hobbies and religion. According to the FTC’s complaint, from 2008 to 2010, Spokeo sold these profiles to the human resources, background screening, and recruiting industries on a subscription basis.
The FCRA, which is enforced by the FTC, covers the collection, dissemination, and use of consumer information, including consumer credit information and sets forth requirements for companies that deal with such data. According to the FTC, Spokeo was required under the FCRA to (1) take steps to verify the consumer information it compiled, (2) ensure that information it sold would only be used for legal purposes, and (3) notify its customers, users of the reports, about their obligations under the FCRA, including their obligation to notify consumers where they chose to take an adverse action based on information contained in one of the reports. The FTC maintained that Spokeo failed to satisfy any of the three requirements. Additionally, when Spokeo updated its Terms of Service in 2010 to indicate that it was not a consumer reporting agency and that its reports should not be used for FCRA-covered purposes, the FTC claimed that it failed to revoke access or take steps to ensure that human resources companies that subscribed prior to 2010 did not use the website for FCRA-covered purposes. Based on these actions and the fact that the companies activities continue to fall under the FCRA’s definition of a “consumer reporting agency” despite its assertion to the contrary, the FTC determined that Spokeo has violated the FCRA.
With respect to the Endorsement Guides, Spokeo advertised its services on news and technology websites. The company had its employees draft comments regarding Spokeo’s services that were then reviewed and edited by Spokeo managers. The comments were then posted online using account names that appeared independent despite the fact that they were provided by Spokeo. These behaviors violated the FTC’s Endorsement Guides, which require proper disclosures regarding any connections between an endorser and a product or company.
This case marks the first FTC case addressing the sale of Internet and social media information in the employment screening context and may be a sign of things to come as the FTC’s recent privacy report had an emphasis on data brokers. Companies that compile consumer information should be careful to comply with the FCRA. This case also demonstrates the FTC’s continued focus on deceptive advertising and serves as a warning to ensure that all endorsements incorporate proper disclosures.