LifeLock agrees to record $100M settlement in FTC order enforcement action
LifeLock has agreed to pay $100 million to settle Federal Trade Commission allegations that the company violated a 2010 court order to secure customers’ information and stop deceptive advertising.
The amount is the largest monetary award ever obtained by the FTC in an order enforcement action, according to a press release. The National Law Journal (sub. req.), Ars Technica and the Washington Post have stories.
Part of the settlement—$68 million—will be used to pay class-action plaintiffs who complained about LifeLock’s practices. The company described itself as an identity-protection service.
LifeLock paid $12 million in 2010 when it agreed to the order it is now accused of violating. The FTC alleged in 2010 that the company said it protected against identity theft even though it merely put fraud alerts on credit files, Ars Technica explains. That wouldn’t prevent identity thieves from stealing from existing accounts and wouldn’t prevent scammers from stealing a person’s identity for medical care or a job application, the publication says.
The current settlement stems from allegations that LifeLock:
1) Failed to establish a comprehensive security program to protect users’ sensitive information between October 2012 and March 2014.
2) Falsely advertised that it protected customer data with the same high-level safeguards used by financial institutions.
3) Falsely claimed it protected consumers’ identity 24/7 with alerts “as soon as” the company received indication of a problem.
4) Failed to follow record-keeping requirements in the 2010 order.
LifeLock did not admit or deny the charges. Its lawyer, David Boies of Boies, Schiller & Flexner, told the Washington Post that customer data was “never at risk” and there was “never a breach” of its computer systems. He also said the ads cited by the FTC are no longer being used.
