Antitrust Law Daily Wrap Up, CONSUMER PROTECTION NEWS: Snapchat settles FTC charges of deceptive statements regarding the collection of personal information to consumers, (May 8, 2014)

By Jody Coultas, J.D.

The FTC announced that Snapchat agreed to charges that it deceived consumers over the amount of personal data it collected and the security measures taken to protect that data from misuse and unauthorized disclosure (In the Matter of Snapchat, Inc., FTC File No. 132 3078).

The Snapchat app allows users to send photo and video messages, or snaps, that were deleted after a time period designated by the user expired. However, the FTC noted several ways that recipients could save snaps indefinitely, including the use of third-party apps. Snapchat was allegedly made aware of this but continued to misrepresent that users controlled how long a recipient could view a snap. Because Snapchat stored video snaps unencrypted on the recipient’s device in a location outside the app’s “sandbox,” the videos remained accessible to recipients who simply connected their device to a computer and accessed the video messages through the device’s file directory. Users were also allegedly deceived into believing they would be notified if a recipient took a screenshot of the snap as any user with an Apple device using an operating system pre-dating iOS 7 could evade the screenshot detection software.

In its complaint, the FTC also alleged that Snapchat misrepresented its data collection practices. Snapchat allegedly transmitted geolocation information from users of its Android app, despite representations to the contrary. Users’ contact information was also collected from their address books without notice or consent. When Apple iOS users entered their phone number to find friends, Snapchat also collected the names and phone numbers of all the contacts in their mobile device address books without notifying users or obtaining their consent.

Finally, Snapchat’s failure to secure its Find Friends feature allegedly resulted in a security breach that enabled attackers to compile a database of 4.6 million Snapchat usernames and phone numbers. This failure also allowed people to register with phone numbers that did not belong to them, resulting in users falsely believing they were communicating with a friend when they were actually communicating with complete strangers.

Under the terms of the settlement, Snapchat will be prohibited from misrepresenting the extent to which it maintains the privacy, security, or confidentiality of users’ information, and must implement a comprehensive privacy program that will be monitored by an independent privacy professional for the next 20 years.

The case was part of a multi-national enforcement sweep on mobile app privacy by members of the Global Privacy Enforcement Network, a cross-border coalition of privacy enforcement authorities. The case was also coordinated with the Asia Pacific Privacy Priorities forum’s Privacy Awareness Week, according to the FTC.

Companies: Snapchat, Inc.

News: Privacy ConsumerProtection FederalTradeCommissionNews