The Federal Trade Commission recently announced that it has settled a host of charges with Snapchat, arising out of privacy issues it had with the mobile messaging application. The FTC’s complaint alleged that despite Snapchat’s representations that messages (“snaps”) disappeared forever after the receiver viewed the content, in fact recipients had numerous (widely used) workarounds to preserve the content of the “snaps.” In addition, the FTC alleged that Snapchat transmitted geolocation information from users of its Android app despite stating in its privacy policy that it did not track or access such information. In addition, the FTC alleged that Snapchat accessed and collected information from iOS users’ address books via the “Find Friends” feature without notice and consent, in violation of the Snapchat privacy policy and representations made on the Snapchat user interface. The FTC also alleged that Snapchat failed to verify that the phone number an iOS user entered into the application belonged to the mobile device used by that individual – a violation, according to the FTC, of the “reasonable security measures” mentioned in the Snapchat privacy policy. As a result, individuals could create an account using another person’s phone number, which allowed people to send and receive snaps associated with the other person’s phone number. To highlight the weakness of Snapchat’s data security measures, the FTC also noted in its complaint that attackers were able to compile a database of 4.6 million Snapchat usernames and associated phone numbers. The terms of the settlement prohibit further misrepresentations and require Snapchat to implement a privacy program monitored by an independent privacy professional for the next 20 years. 

TIP: This case underscores the emphasis on privacy and data security this year for the FTC. Companies should keep in mind that the FTC uses misrepresentation and unfairness allegations as the basis for bringing cases when it believes individuals’ information has not been sufficiently secured.