The Federal Trade Commission (FTC) recently reached an $800,000 settlement with the data broker Spokeo, Inc. (“Spokeo”). The FTC’s complaint alleged violations not normally seen together: First, that Spokeo distributed personal information for background checks by employers in ways that failed to comply with the Fair Credit Reporting Act (FCRA) and, second, that Spokeo’s employees posted Spokeo product endorsements without revealing their connection to the company, in violation of Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.”
The Alleged FCRA Violations
The FCRA imposes certain obligations on “consumer reporting agencies,” which are generally defined as businesses that assemble or evaluate certain information about a consumer and furnish it to third parties for their use in determining the consumer’s eligibility for credit, insurance, or employment. The FCRA requires a consumer reporting agency to follow specified procedures to help protect consumers’ rights, including steps to ensure that each report it sells is used for a purpose specifically permitted by the law and that the information contained in the report is accurate. The law also requires a consumer reporting agency to inform each recipient of a consumer report of its obligations under the Act, including that it notify a consumer in the event that it takes adverse action against him or her based on information in the report (such as a decision to deny him or her credit or not to hire him or her).
Spokeo collects personal information about consumers from hundreds of online and offline sources—including social networks and marketing databases—and combines this information to create profiles on those consumers. Spokeo then sells access to these profiles. The FTC alleged that, because Spokeo marketed the profiles to human resources departments and others for use in the hiring process, it was a consumer reporting agency subject to the FCRA. According to the FTC, Spokeo did not, however, comply with the Act’s requirements. Moreover, even though Spokeo had changed its website terms of service to state that it was not a consumer reporting agency and to prohibit clients from using its information for purposes protected by the FCRA, Spokeo did not actually enforce those terms, such as by revoking the access of companies that it knew—or should have known—were using its consumer reports for employment purposes.
Although this is the FTC’s first FCRA case involving the sale of data collected for employment purposes from social media and other online sources, it should not have come as a complete surprise, as this was not the first time that the agency had weighed in on the subject. In May 2011, FTC staff wrote to a company described as “an Internet and social media background screening service used by employers in pre-employment background screening,” reminding it of the FCRA’s applicability. Even in light of these FTC activities, however, businesses may not appreciate just how broad the law’s definition of a “consumer reporting agency” is. Companies that compile or evaluate and then distribute consumer data should seek to determine whether they need to comply with the FCRA’s requirements. Further, companies that receive consumer reports from consumer reporting agencies—whether to make employment decisions or otherwise—are also bound by certain obligations under the FCRA and, potentially, state laws.
The Allegedly Deceptive Endorsements
Just a few years ago, the FTC updated its Endorsement Guides (“Guides”) to address issues specific to social media marketing. Although the Guides do not have the force of law, they provide marketers with guidance from the FTC on avoiding potentially deceptive practices under Section 5 of the FTC Act. Even prior to this update, however, the Guides made clear that any connection between an endorser and the seller of the advertised product—such as an employment relationship—must be disclosed, as such a connection affects the weight that consumers give to the endorsement. The message to companies: Create and enforce a social media policy that requires your employees to disclose the fact of their employment when talking about your products or services.
Spokeo allegedly did just the opposite: The FTC asserted in its complaint that Spokeo directed its employees to pose as ordinary consumers and post endorsements praising the company’s products. What’s more, Spokeo managers actually reviewed the endorsements and supplied the accounts that were used to make them—all to give the public the misleading impression that Spokeo had numerous happy customers. In the FTC’s view, this practice was deceptive because, had consumers known that the endorsements were posted by the seller’s own employees, they would have known that they should probably take the endorsements with a grain of salt. In its settlement with the FTC, Spokeo agreed not only to comply with the Guides going forward but to also remove all of the fake endorsements already posted.
A myth has developed among many companies seeking to exploit social media that the old rules do not apply in this new age. The Spokeo settlement is a stark reminder that the old rules do in fact apply, and that companies ignore those rules at their peril.