We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
Continuing its focus on privacy issues, the Federal Trade
Commission (FTC) reached a settlement earlier this month with
social networking service, Myspace, over charges that it
misrepresented its protection of users' personal information.
The FTC alleged that Myspace allowed advertisers to access
personally identifiable information despite previous assurances to
its users that it would keep such information private. The
settlement requires Myspace to implement a comprehensive privacy
program, and calls for regular, independent privacy assessments for
the next 20 years.
The primary data practice at issue was Myspace's alleged
sharing of the unique identifier assigned to each profile of each
Myspace user called a "Friend ID" with third-party
advertisers to customize advertisements directly on its site. The
FTC alleged that advertisers could use the identifier - by simply
typing the Friend ID in the URL after the slash in www.myspace.com/ - to access a particular
user's profile and personal information. A user's profile
contains some basic profile information such as his or her age,
gender, profile picture (if the user chooses to include one),
display name, and, by default, the user's full name. User
profiles also may contain additional information such as pictures,
hobbies, interests, and lists of users' friends. The FTC also
alleged that advertisers could use a tracking cookie to combine an
individual user's real name and other personal information to
link broader web-browsing activity to that specific individual.
Myspace's privacy policy promised it would not share users
personally identifiable information, or use such information in a
way that was inconsistent with the purpose for which it was
submitted, without first giving notice to users and receiving their
permission to do so. The privacy policy also promised that the
information used to customize ads would not individually identify
users to third parties and would not share non-anonymized browsing
activity. The FTC alleged that the Myspace's use of the Friend
ID was not described in its privacy policy and it did not receive
permission from its users for such sharing. The FTC charged that
this constituted deceptive statements in its privacy policy which
violated federal law (Section 5(a) of the Federal Trade Commission
Act).
In addition, Myspace certified that it complied with the U.S.-EU
Safe Harbor Framework, which provides a method for U.S. companies
to transfer personal data lawfully from the European Union to the
United States. As part of its self-certification, Myspace claimed
that it complied with the Safe Harbor Principles, including the
requirements that consumers be given notice of how their
information will be used and the choice to opt out. The FTC alleged
that these statements were false.
The proposed settlement bars Myspace from misrepresenting the
extent to which it protects the privacy of users' personal
information or the extent to which it belongs to or complies with
any privacy, security or other compliance program, including the
U.S.-EU Safe Harbor Framework. The order also requires that Myspace
establish a comprehensive privacy program designed to protect
consumers' information, and to obtain biennial assessments of
its privacy program by independent, third-party auditors for 20
years.
Since 2010, the FTC has reached a dozen settlements against
companies that the agency accused of failing to uphold their
privacy promises to consumers. The agreement with Myspace is
similar to one the FTC made in November with Facebook over its
sharing of users' information with advertisers and making
public information that it had said would be kept private. Under
that settlement, Facebook is required to submit to a third-party
privacy audit every two years for the next 20 years and to obtain
express consent before making changes that override user privacy
preferences. In March 2011, Google agreed to settle the
agency's claims that it used deceptive practices and violated
its own privacy policies when it launched its Google Buzz social
network in 2010. That agreement, similar to the later ones with
Facebook and Myspace, also requires regular privacy audits for the
next 20 years.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Last week, by virtue of a 63-30 procedural vote, the Senate moved forward with a bill called the Marketplace Fairness Act, with a final Senate vote set for May 6, according to The Wall Street Journal.
Corporate tweeters or bloggers – employees who post promotional and often entertaining commentary on behalf of their employers’ businesses – add much of their own personal brand – their voice, their opinions, their snarky remarks – to the information they are disseminating on the company’s behalf.
No blog can really take itself seriously unless it's written about Lindsay Lohan. Plus our Marketing Department claims she'll do wonders for our search rankings.
In a First Report and Order, Further Notice of Proposed Rulemaking and Notice of Inquiry released at the end of March in a proceeding begun in 2003, the Federal Communications Commission continued its comprehensive review of its rules, policies and procedures governing radiofrequency radiation and limits on exposure to human beings.
