Identity theft protection service LifeLock, Inc. has agreed to pay $11 million to the Federal Trade Commission and $1 million to a group of 35 states (including California, Florida, Illinois, New York and Texas) to settle charges that the company used false claims to promote its identity theft protection services. Since 2006, LifeLock’s ads have claimed that it could "prevent" identity theft for consumers willing to sign up for its $10-a-month service. LifeLock famously advertised these services by displaying its CEO’s actual Social Security number.

In its complaint, the FTC charged that the fraud alerts that LifeLock placed on customers’ credit files protected only against certain, less common forms of identity theft and gave them no protection against the misuse of existing accounts (the most common type of identity theft), medical identity theft or employment identity theft. The FTC further alleged that LifeLock made deceptive claims about the extent of its monitoring services and its own data security. For example, while LifeLock advertised that "all stored personal data is electronically encrypted" and that it granted access to consumer data only on a "need to know" basis, the FTC charged that those claims were blatantly false and LifeLock's data system was vulnerable to attack.

The settlement represents one of the largest ever FTC-state coordinated settlements. Going forward, LifeLock and its principals are barred from making deceptive claims and required to take stricter measures to protect the personal information they collect from consumers (including establishing a comprehensive data security program and obtaining independent assessments of that program for twenty years). “This agreement effectively prevents LifeLock from misrepresenting that its services offer absolute prevention against identity theft because there is unfortunately no foolproof way to avoid ID theft,” Illinois Attorney General Lisa Madigan said. “Consumers can take definitive steps to minimize the chances of having their personal information stolen, and this settlement will help them make more informed decisions about whether to enroll in ID theft protection services.”

The FTC will use the settlement money to provide refunds to consumers, and will be sending letters to eligible current and former customers of LifeLock.