Online data broker Spokeo agreed to pay $800,000 to settle charges that it violated a federal law regulating consumer reporting agencies, the Federal Trade Commission announced on Tuesday. Spokeo also promised to comply with the consumer protection law in the future.
The FTC charged Spokeo with violating the federal Fair Credit Reporting Act by selling information about job applicants to prospective employers without first taking steps to ensure the information is accurate. Spokeo also allegedly violated the law's provisions requiring consumer reporting agencies to verify purchasers' identities, as well as provisions requiring agencies to tell people when reports about them are purchased.
The federal fair credit law provides that reporting agencies must take steps to ensure the accuracy of background reports used for employment, housing and credit. The law also gives consumers the right to challenge information in those reports.
Spokeo says it never intended to act as a consumer reporting agency.
"We have made changes to our site and our internal business practices in order to ensure we don’t infringe upon the FCRA’s important consumer protections, and to ensure an honest and transparent service that will continue to be easy for our customers to use," company president Harrison Tang said Tuesday in a blog post.
The FTC alleged in its complaint, which was filed Thursday in federal court in Los Angeles, that the company intentionally marketed itself to human resources managers, background screeners and recruiters. Specifically, Spokeo purchased keywords relating to "employment background checks, applicant screening, and recruiting," the FTC alleged. Also, its ads carried taglines meant to "encourage HR professionals to use Spokeo to obtain information about job candidates' online activities," according to the FTC.
In a separate allegation, the FTC also charged Spokeo with ordering employees to post fake endorsements on news and tech sites. "These comments were reviewed and edited by Spokeo managers and then posted using account names, provided by Spokeo, that would give the readers of these comments the impression they had been submitted by independent, ordinary consumers or business users," the FTC alleged.
The FTC enforcement action comes two years after the digital rights group Center for Democracy & Technology filed a complaint alleging that Spokeo was violating the federal fair credit law.
Justin Brookman, director of consumer privacy for the CDT, cheered news of the FTC's enforcement action. "The FCRA is a good statute, but there's a lot of gray about how far it extends," he said. "It's good to see that it extends this far."
While Spokeo always offered consumers the opportunity to remove themselves from its database, the opt-outs didn't always persist.
The FTC's settlement comes at a time when the agency appears increasingly interested in online data brokers. In February, the commission warned three online data brokers that their mobile apps must comply with the federal credit reporting law.
The FTC's March privacy report called Congress to enact new laws requiring data brokers to give consumers access to information about them. The FTC also urged data brokers to create a centralized site where they can explain to consumers how their data is collected and used.
Even though Spokeo resolved the FTC charges, the company could still face a potential class-action lawsuit by consumers. In 2010, Virginia resident Thomas Robins sued Spokeo for allegedly violating the federal credit reporting law. A judge dismissed that case last year on the ground that Robins' couldn't show he was injured by Spokeo's reports. But Robins recently filed papers asking the 9th Circuit to revive the lawsuit.