Antitrust Law Daily Wrap Up, PRIVACY NEWS: Social Networking App Developer Settles FTC Privacy Charges, (Feb 1, 2013)

By Tobias J. Gillett, J.D., LLM.

Social networking app developer Path, Inc. has settled charges that it misrepresented its privacy and data collection practices and collected consumers’ personal information from the address books in their mobile devices without their consent (United States of America v. Path, Inc., FTC File No. 122 3158, Case No. C 13 0448).

Path operated a social networking service that allowed users to maintain an online journal and share it, along with pictures, the user’s location, and songs to which the user is listening, with up to 150 friends. The complaint filed by the Department of Justice in the federal district court in San Francisco alleged that Path’s privacy policy had claimed that its service collected only information such as the user’s IP address, operating system, browser type, address of referring site, and site activity information. However, the service allegedly scanned the user’s address book and recorded the name, address, telephone number, mobile number, email address, Facebook username, Twitter username, and date of birth of each contact every time the user signed into his or her account.

Moreover, Path’s “Add Friends” feature in its user interface allegedly misled consumers by providing the options “Find friends from your contacts,” “Find friends from Facebook,” and “Invite friends to join Path by email or SMS,” even though the Path app recorded the user’s contact information even if the user did not select the “Find friends from your contacts” option. Furthermore, the app purportedly recorded information from children under age 13 without first obtaining parental consent, including their email addresses, first names, last names, dates of birth, and, if provided, genders and phone numbers. The app also collected information from the children’s address books, and permitted children to display the same personal information as other users, including their location.

The complaint charged Path with violations of the FTC Act, through its allegedly deceptive privacy policy and user interface design, and the Children’s Online Privacy Protection Act Rule, through failing to provide direct notice of its collection, use, and disclosure policies for children’s information; through failing to sufficiently disclose what information it collected and how it used the information; and through failing to obtain parental consent before collecting children’s personal information.

The proposed consent order requires Path to provide notice of its collection and use of children’s information; to provide direct notice to parents of its collection, use, and disclosure practices with regard to children’s information; to obtain parental consent before collecting, using, or disclosing children’s information; and to destroy personal information already collected from children. The order prohibits Path from expressly or impliedly misrepresenting its privacy policies, to disclose the information that will be collected from users and obtain consent before collecting it, and to establish a comprehensive privacy program. Path must also obtain biennial privacy assessments from qualified, independent third parties. The order also includes an $800,000 civil penalty.

“Over the years the FTC has been vigilant in responding to a long list of threats to consumer privacy, whether it’s mortgage applications thrown into open trash dumpsters, kids information culled by music fan websites, or unencrypted credit card information left vulnerable to hackers,” said FTC Chairman Jon Leibowitz. “This settlement with Path shows that no matter what new technologies emerge, the agency will continue to safeguard the privacy of Americans.”

Path’s use of its users’ address books was first revealed by Arun Thampi, a Singapore developer. Path later acknowledged the problem, and apologized for its actions.

Path Response

In a statement today, Path responded to the FTC’s settlement announcement and described steps it has already taken to ensure its users’ privacy.

“Before the FTC reached out to us, we discovered and fixed this sign-up process qualification, and took further action by suspending any under age accounts that had mistakenly been allowed to be created,” Path stated. “We want to share our experience and learnings in the hope that others in our industry are reminded of the importance of making sure services are in full compliance with rules like COPPA.”

Companies: Path, Inc.

News: Privacy ConsumerProtection FederalTradeCommissionNews