The Federal Trade Commission (FTC) just announced that Snapchat agreed to settle charges that it deceived consumers about how its popular mobile message app worked and what personal user data it collected.  (Read the FTC’s press release here). Part of Snapchat’s appeal was a feature enabling users to control how long a message could be seen by the recipient. After the designated time limit expires, the message is destroyed, much like the mission briefings in Mission Impossible. At least that’s what Snapchat told users. According to the FTC, Snapchat misled consumers because the app didn’t exactly work the way it said it did. The FTC’s complaint against Snapchat (read it here) included these allegations:

  • Recipients of a “snap” (a Snapchat message) could save the snap using tools outside of the app. Snapchat apparently stored video snaps in a location on the recipient’s mobile device outside of the app’s secure “sandbox.” This enabled recipients to find and save video snaps by connecting their mobile device to a computer and using simple file browsing tools. Another way to bypass the deletion feature was to use apps that connected to Snapchat’s API to download and save snaps.
  • Snapchat told users that if a message recipient took a snapshot of the snap, the sender would be notified. In fact, the screenshot detection mention could be bypassed.
  • Snapchat collected geolocation data of users when it said it would not.
  • Snapchat told users to enter their mobile number to find friends who also use the app, implying that the user’s mobile phone number was the only information it collected. Without the user’s knowledge, Snapchat also collected the names and phone numbers of all contacts in the address book on the user’s phone.

So what’s the significance of the settlement? Here are a few quick takeaways.

  • Descriptions of mobile apps in an app marketplace like iTunes App Store or Google Play are product descriptions that could be the basis for false advertising claims.
  • Including boilerplate language in an app description, terms of use, or privacy policy is a bad idea if you don’t know what it means or can’t verify its accuracy. Snapchat’s privacy policy told users that it “did not ask for, track, or access any location-specific information.” A lot of apps say that. The problem was that Snapchat integrated an analytics tracking service in the Android version of the app that did collect location information.
  • Take into account exploits and workarounds when drafting privacy policies and product descriptions. This includes software that uses the app’s API.
  • The FTC is getting more active in pursuing false advertising claims against mobile app makers. In December of last year, the FTC settled charges that the developer of the “Brightest Flashlight Free” app deceived consumers about how their geolocation information would be shared with advertising networks and other third parties. The FTC’s interest in suing companies that allow a data breach to occur is also a growing concern, especially after the New Jersey federal district court’s decision in FTC v. Wyndham Worldwide Corp., recognizing the FTC’s authority to prosecute cases where a company is alleged to have failed to maintain “reasonable and appropriate data security for consumers’ sensitive personal information.”
  • Information transmitted over the Internet is rarely, if ever, gone forever. Somehow, somewhere, electronic data can be retrieved.
Enhanced by Zemanta

The Federal Trade Commission adopted final amendments to the Children’s Online Privacy Protection (COPPA) Rule today.  The amendments are the result of a review initiated by the FTC in 2010 to adapt to changes in technology and in the way children use and access the Internet.

Highlights of the amendments include:

  • Modification of the list of “personal information” that cannot be collected without parental notice and consent.  Geolocation information, photographs, and videos are now on the list.
  • A streamlined, voluntary, and transparent process for getting approval of new ways of obtaining parental consent.
  • Closing of a loophole that allowed third parties, on behalf of kid-directed apps and websites, to use plug-ins to collect personal information from a child without parental notice and consent.
  • Strengthening of data security protections by requiring covered website operators and online service providers to take reasonable steps to release children’s personal information only to companies that are capable of keeping it secure and confidential.
  • Application of the COPPA Rule to persistent identifiers that can recognize users over timer and across different websites or online services, such as IP addresses and mobile device IDs.
  • Revision of the parental notice provisions to help ensure that operators’ privacy policies, and the notices they must provide to parents before collecting children’s personal information, are concise and timely.
  • Approval of new methods that operators can use to obtain verifiable consent.  The new methods are: electronic scans of signed parental consent forms; video-conferencing; use of government-issued identification; and alternative payment systems.

The amended Rule goes into effect on July 1, 2013.  The full text of the Federal Register Notice adopting the amendments can be found here.