According to the federal lawsuit, Twitter did not tell its users for years that it used their contact information to help marketers target their advertising, in violation of a 2011 privacy agreement with the Federal Trade Commission.
“This practice has affected more than 140 million Twitter users, while increasing Twitter’s main source of revenue,” FTC President Lina Khan said in a statement.
Twitter said on Wednesday that the use of personal information for ads was “inadvertent” and that the incident was first revealed in 2019.
“This issue was addressed on September 17, 2019, and today we want to reiterate the work we will continue to do to protect the privacy and security of people who use Twitter,” wrote Damien Kieran, Twitter’s director of privacy. a blog post. “Keeping our data secure and respecting privacy is something we take very seriously, and we have cooperated with the FTC every step of the way. To reach this agreement, we have paid a $ 150 million fine and aligned ourselves. with the agency in operational matters. program updates and enhancements to ensure that people’s personal data remains secure and their privacy protected. ” process of acquiring billionaire Elon Musk and a restructuring of the company’s staff that has led to the departure of several senior employees.
In its alleged misconduct, Twitter only told users that their phone numbers and email addresses were being used for account security purposes, but did not mention advertising, according to a copy of the complaint seen by CNN.
“From at least May 2013 to at least September 2019, Twitter misrepresented users of its online communications service to the extent that it maintained and protected the security and privacy of its non-public contact information,” she said. complaint.
The complaint also alleges that Twitter’s conduct violated the terms of a 2011 agreement stemming from two hacking incidents that caused attackers to gain administrative privileges on the platform. According to the agreement, Twitter was banned from misleading the public about how it protects consumer data. Failure to comply with the agreement may result in fines.
“Twitter misrepresentations violate the FTC Act and the 2011 Order, which specifically prohibits the company from making false statements about the security of non-public consumer information,” the complaint said.
In addition to the $ 150 million fine, the new proposed agreement between Twitter and the FTC to resolve Wednesday’s complaints also prohibits the company from taking advantage of what the FTC described as “data collected in a manner misleading “and allow user authentication methods other than phone numbers. , such as multifactor authentication applications. The company must also inform users about the non-disclosure of its alleged practice of using contact information for advertising purposes.
Wednesday’s agreement has yet to be approved by the court.