FTC: Collecting and Selling Data Mined from Social Media Sites Covered by FCRA

On June 12, 2012, the Federal Trade Commission (FTC) announced a settlement with Spokeo, Inc., a data broker that compiles and sells detailed information profiles on consumers, in connection with claims that Spokeo violated the Fair Credit Reporting Act (FCRA) and the FTC’s Endorsement Guidelines.  Spokeo will pay $800,000 in civil penalties and has entered into an order prohibiting it from violating certain FCRA provisions and misrepresenting the status of any user or endorser of its product or service.

Notably, this is the FTC’s first case to address the sale of information collected through the internet from social media for use in the employment screening context.  Not only is the FTC watching what social media companies are doing with users’ information, it is paying attention to how data brokers are using information collected through social media sites.  This case, while about the FCRA and Endorsement Guidelines specifically, echoes the enhanced scrutiny for data brokers (and large platform providers and mobile app developers) evident in the FTC’s March 2012 privacy report.

The FCRA was enacted to promote the accuracy, fairness and privacy of information maintained by consumer reporting agencies (sometimes incorrectly referred to as credit reporting agencies).  So-called “consumer reports” are broadly defined in the FCRA as information “bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for (a) credit or insurance . . .; (b) employment purposes; or (c) any other purpose authorized under [15 U.S.C. § 1681b].”  (Other purposes under § 604 of the FCRA, 15 U.S.C. § 1681b, include determining the consumer’s eligibility for a government license or other benefit, determining capacity to make child support payments, or some other “legitimate business need for the information,” among other similar uses.)

Spokeo collected information about individuals from online and offline sources to create profiles that included contact information, marital status and age range, and in some cases included a person’s hobbies, ethnicity, religion, participation on social networking sites and photos that Spokeo attributed to a particular individual.  Spokeo marketed these profiles to companies in the human resources, background screening and recruiting industries as information to serve as a factor in deciding whether to interview or hire a job candidate.  As such, Spokeo acted as a consumer reporting agency, and the FTC alleged that Spokeo violated the FCRA by (a) failing to ensure the consumer reports it sold were used for legally permissible purposes, (b) failing to ensure that the information it sold was accurate and (c) failing to inform users of Spokeo’s consumer reports of their obligations under the FCRA.

The complaint also alleges that Spokeo violated Section 5 of the FTC Act, which prohibits “unfair or deceptive” trade practices, by directing its employees to post deceptive endorsements of its consumer reports as Spokeo customers (instead of disclosing that the endorsements were posted by Spokeo’s own employees).  The order requires that Spokeo remove (or request removal of) deceptive endorsements of its products, whether on its own website or third-party websites.

For additional information, the FTC’s press release and related documents can be found here.