The Federal Trade Commission (FTC) is investigating Twitter, Inc. for falsely exploiting account security data for targeted advertising.
Twitter required users to provide their phone numbers and email addresses to protect their accounts. The company then made money by letting marketers target specific consumers with this information. Twitter ad revenue was boosted in the millions.
Twitter’s deception is in breach of a 2011 FTC judgment that forbids the company from misrepresenting its privacy and security processes. Under the proposed ruling, Twitter would have to pay a $150 million punishment and would be prevented from profiting from its improperly collected data.
In addition to the $150 million penalty, other provisions of the proposed order would:
- make it illegal for Twitter to profit from falsely acquired data;
- allow customers to use other multi-factor authentication methods that do not need them to submit their phone numbers, such as mobile authentication apps or security keys;
- notifying users that phone numbers and email addresses acquired for account security were also used to target adverts at them, as well as providing information on Twitter’s privacy and security measures;
- create and maintain robust privacy and information security program that requires the organization to assess and address any privacy and security risks associated with new products, among other things;
- employee access to users’ personal data should be limited; and
- if the company suffers a data breach, the FTC should be notified.
For more information on this see the FTC press release here.
