While the admonition “say what you mean and mean what you say” may sound incredibly trite, it appears to be the motto for the Federal Trade Commission’s privacy enforcement. Snapchat, the online photo sharing service, is the latest provider to learn this lesson.
For my readers who, like me, are not as tech savvy as the average 12 year old, Snapchat is a photo sharing service that offers a twist – the photos you share are visible to the person you share them with for only a limited time – to a maximum of 10 seconds. After that, according to Snapchat, the photo vanishes forever.
Sounds great, right? And in this era of revenge porn, Snapchat seems like the perfect way to send an intimate photo without worrying what might happen after the magic fades.
Well, here’s another trite admonition – nothing’s perfect. According to the FTC, despite Snapchat’s promises, the photos don’t disappear. In its complaint, the FTC offered this example: “when a recipient receives a video message, the application stores the video file in a location outside of the application’s “sandbox” (i.e., the application’s private storage area on the device that other applications cannot access). Because the file is stored in this unrestricted area, until October 2013, a recipient could connect his or her mobile device to a computer and use simple file browsing tools to locate and save the video file. This method for saving video files sent through the application was widely publicized as early as December 2012. Snapchat did not mitigate this flaw until October 2013, when it began encrypting video files sent through the application.” Apparently there were other pretty easy ways to get around the disappearing photo feature.
The FTC filed its complaint alleging that Snapchat violated Section 5(a) of the Federal Trade Commission Act. That provision very broadly prohibits “deceptive acts or practices.” And while the FTC doesn’t have specific authority to regulate privacy, this blanket provision gives it the power to pursue practices that don’t match representations made in marketing pitches or privacy policies.
Snapchat decided it was better to capitulate than fight. It’s entered a proposed consent decree with the FTC. And while it doesn’t admit any wrongdoing, as part of the deal, it’s agreed to FTC monitoring for 20 years. In other words, slightly longer than a ten second expiration period.