• Print

Others Likely to Follow MySpace Into FTC Crosshairs


The Federal Trade Commission recently smacked MySpace, loudly, for persistent violations of users’ privacy.

Now the Internet industry is busily sorting out exactly what this means to the rest of the players.

To review: The gist of the FTC complaint was that in 2009 through 2011, MySpace apparently transmitted information to advertisers that provided details on age, gender, and unique user identification numbers of “Friends.” Using that information, said the FTC, third parties could find out a user’s real name and could also look at the user’s personal Web browsing history.

That flew in the face of a privacy policy MySpace had begun distributing in 2008 that said the site "will not share your personally identifiable information with third parties unless you have given MySpace permission to do so."

In its settlement with the FTC, MySpace did not admit or deny the charges, but it settled the matter by saying it will abide by its stated privacy policies and, furthermore, will consent to a privacy audit every other year for the next 20 years.

No fine is involved, but there are other costs: “Submitting to that audit will be very costly for MySpace,” says Thomas Cohn, a onetime FTC director who now is an attorney with LeClairRyan in New York.

Now a shell of what it was, MySpace has around 25 million US users, compared to Facebook’s 159 million. In mid 2011, News Corp sold MySpace to online ad firm Specific Media LLC for $35 million, a haircut from the $580 million Rupert Murdoch had paid for it in 2005.

So the FTC settlement may seem irrelevant because of MySpace’s irrelevance; but looked at another way, the FTC ruling just may be a loud warning to many other Web 2.0 players.

At least some experts say: Buckle up, a lot more FTC actions -- and probably class action suits -- are coming.

“This is a shot across the bow of all Internet advertisers and all social media,” Cohn contends. “It is a warning shot that the FTC expects these entities will honor their privacy policies.”

“This is a big deal because the FTC has singled out a well known social media site,” says Robert Ellis Smith, publisher of The Privacy Journal. “The lesson is that the FTC takes privacy seriously.”

How seriously? Already, Facebook and Google have inked similar consent decrees, and MySpace makes it a kind of social media hat trick.

The fly in the ointment is that, right now, the FTC mainly can only act when a company violates its own stated privacy terms. Put up a TOS that says: “We will wantonly sell your every scrap of personal data to any bidder,” and the irony is that this leaves the FTC’s hands tied.

The White House now wants to change that by broadly extending government’s powers. Cameron Kerry, general counsel for the US Commerce Dept., recently said in written testimony advocating more clout for the FTC: “Granting direct enforcement authority to the F.T.C. would enable the commission to take action against outliers and bad actors even if their actions do not violate a published privacy policy.”

Will Congress enact that? Really, who knows with this cast of Washington characters and a Presidential election year?

But even so, it just might get very interesting. Dallas lawyer James Crewse bluntly says, “The FTC is becoming very proactive. They aren’t going to stop looking for violations.”

And there is the possibility of aggressive private-sector privacy protection lawsuits, says Crewse. “You will begin to see lawyers who are putting together class actions,” he predicts. He says this will extend beyond social networks, possibly to “regular companies” (many of which have been less than meticulous about maintaining the privacy of Web visitor data) and also apps developers, many of which also are cavalier with user data.

A key, stresses Crewse, is that whenever a privacy policy is changed, users have to explicitly consent to the changes -- or a company can find itself in legal crosshairs.

Winning those user consents is a cumbersome, expensive process, but there isn’t a shortcut. That seems to be a big takeaway from the MySpace decree.

“Every company,” notes Crewse, “needs to be looking at what the FTC is doing and deciding if they are in compliance… Or they may find themselves in court.”

Source: Internet Evolution