Spokeo to pay $800,000 in FTC settlement: Sold social network data for employment uses

UPDATE: In their stories on this settlement, both Ed Wyatt of the NYTimes and Dina ElBoghdady of the Washington Post mention Spokeo’s blog, which says: “It has never been our intention to act as a consumer reporting agency. [blah blah we stopped these alleged practices in 2010 blah blah].” Well, from where I sit, I read paragraph 11 of the FTC complaint to say:

11. In 2010, Spokeo changed its website Terms of Service to state that it was not a consumer reporting agency and that consumers may not use the company’s website or information for FCRA-covered purposes. However, Spokeo failed to revoke access to or otherwise ensure that existing users, including subscribers who may have joined Spokeo through its Spokeo.com/HR page, or those who had previously purchased access to profiles through API user agreements, did not use the Company’s website or information for FCRA-covered purposes.

But wait, there’s more.

12. The consumer profiles Spokeo provides to third parties are “consumer reports” … [emphasis added]

I, for one, am quite bored with companies using the Bart Simpson defense: “I didn’t do it, nobody saw me do it, you can’t prove anything (youtube).” I stand with the FTC. Spokeo intended to sell consumer profiles. Spokeo appears to still sell profiles. Those profiles “are consumer reports.” Changing disclosures is merely talking the talk, it isn’t walking the walk.

Over at the Consumerist, they warned about Spokeo’s then-practices in 2006.

ORIGINAL POST: Today, in a very important case, the U.S. Federal Trade Commission (FTC) assisted by the U.S. Department of Justice announced that the data broker Spokeo has agreed to pay penalties of $800,000 over multiple violations of the Fair Credit Reporting and FTC Acts in the first FTC case over the “sale of Internet and social media data in the employment screening context.”

It’s a very important case because it finds that when a company creates consumer profiles based on social networking information and sells them for employment, credit or insurance decisions, it is in fact a regulated credit bureau selling consumer credit reports.

Consumer credit reports can only be sold for legal purposes. Under the law, credit reports can be sold for employment uses but those legal purposes do not include “pre-employment screening” outside of the act’s protections.  A recent report, Broken Records: How Errors by Criminal Background Checking Companies Harm Workers and Businesses, by the National Consumer Law Center, explains that other sorts of pre-employment screening violations are a widespread problem.  By the way, even currently legal employment uses of reports have come under increasing scrutiny in Washington, DC and the states. If you are out of a job because of the economy, and credit reports bear no relationship to employment performance, why should you be denied a job due to your credit report? It’s a Catch-22 as this helpful site explains.

But what makes Spokeo different and interesting is its use of social networking data to create credit profiles. You can read paragraphs 14-33 of the complaint (pdf, but it totals only 16 pages if you want to read the whole thing) for a list of the counts against the firm for failing to comply with the FCRA’s permissible purposes requirements, its notice to users requirements and its accuracy requirements, among others.

The complaint also details how Spokeo was providing paid real-time access subscriptions through Application Programming Interfaces (API) to recruiters and human resources (HR) staff comprised of information from:

“hundreds of online and offline sources,” such as social networking sites, data brokers, and other sources to create consumer profiles, which Defendant promotes as “coherent people profiles” and “powerful intelligence.” These consumer profiles identify specific individuals and display such information as the individual’s physical address, phone number, marital status, age range, or email address, Spokeo profiles are further organized by descriptive headers denoting, among other things, a person’s hobbies, ethnicity, religion, or participation on social networking sites, and may contain photos or other information, such as economic health graphics, that Spokeo attributes to a particular individual.” 

These are credit reports, as the complaint explains, since the profiles bear on your mode of living, your character, your credit capacity and other factors covered by the act. By the way, over a year ago, the FTC had warned a competitor, Social Intelligence Corporation, that its similar practices made it a credit bureau. I guess Spokeo’s lawyers missed that well-publicized warning letter.

The FTC settlement with Spokeo is an important decision holding that the collection and use of consumer information from the Internet and, particularly, from your activities on social networking sites, may trigger the protections of the Fair Credit Reporting Act commonly thought to only include whether you pay your bills ontime.

It’s a bigger issue for a different blog, but in a forthcoming Suffolk University Law Review paper, my colleague Jeff Chester of the Center for Digital Democracy and I also explain that other types of collection and use of information on the Internet should also trigger FCRA or similar protections:

We are at just the beginning of the Big Data and online financial marketing revolution.  Consumers require safeguards to ensure they don’t confront the same oblique and unfair deception that contributed to the last financial crisis. The predictive capabilities of digital marketing enable determinations to be made about our financial future without sufficient checks and balances.  Today’s consumer relies on what’s called “multichannel” media—such as social networks, mobile phones, and email—to make their financial decisions. But they are largely unaware how the process works, including that they are the subject to invisible “calls to action” that help generate a profile that can include their “demographic, geographic, financial and product information.” Nor would they reasonably expect that their use of an online calculator for credit cards, insurance, and auto purchase can be used to “make immediate offers…based on key profile data such as loan amount, income level or geographic location.”

More to come on that. Oh, by the way, back to Spokeo for a coda.

To add insult to injury, the FTC also slammed Spokeo for violating the FTC Act’s Section 5 prohibition against unfair or deceptive practices. It seems that some of Spokeo’s supposed independent endorsements came not from satisfied users but from what are known on the web as sock puppets —

“In truth and in fact, the comments about Spokeo were not independent comments reflecting the views of ordinary consumers or business users of Spokeo. The comments were created by  employees and managers of Spokeo in response to news articles or reviews of Spokeo.”

You don’t have to make this stuff up, it writes itself.