This week, the social network Myspace agreed to settle charges by the Federal Trade Commission (the "FTC") that Myspace inappropriately disclosed its users' personally identifiable information. Specifically, the FTC charged that Myspace did not honor its own promises to consumers in its privacy policy.
Myspace assigns a unique identifier (a "Friend ID") to each consumer profile. The profile can contain all sorts of personally identifiable information about a user, such as that user's full name, age, picture, interests, friends, etc.. Myspace's privacy policy promised it "would not share users' personally identifiable information, or use such information in a way that was inconsistent with the purpose for which it was submitted," without giving notice, and getting permission from users.
Nonetheless, Myspace provided advertisers the Friend IDs, which advertisers could then match up with users' profiles to serve targeted behavioral ads and track user activity. The FTC thus alleged that the privacy policy's deceptive promises violated federal law.
Myspace will be barred from future privacy misrepresentations, must implement and maintain a comprehensive privacy program, and must provide periodic independent privacy assessments for 20 years. Notably, Myspace will not pay any penalty.
The settlement is a reminder that privacy concerns are at the forefront of the FTC's "to do" list, and that privacy policies actually do matter. Just in the last year, the FTC has agreed to privacy-related settlements with Twitter, Google and Facebook, so even the big players are not exempt from scrutiny. Further, while many entities jump to the question of whether their privacy practices are legal, the preliminary question may be whether their privacy practices adhere to what they have already promised in their privacy policies.
This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
