Twitter settles after feds claim it used 2FA information to target ads

Twitter has reached a $150 million settlement with the Department of Justice and the Federal Trade Commission over alleged misrepresentations of its data privacy practices, the agencies announced Wednesday.

The settlement, which still needs approval by a federal judge, would resolve claims by the government that Twitter did not adequately inform its users about how their contact information was being used to target ads rather than just secure their accounts, in violation of an FTC law and a 2011 settlement that found with the agency.

In a lawsuit accompanying the settlement announcement, the government accused Twitter of misrepresenting the extent to which it protects the security and privacy of users’ non-public contact information between at least May 2013 through September 2019.

The agencies claimed that Twitter told users that it collected phone numbers and email addresses to secure their accounts with two-factor authentication, but did not disclose that it used this information to help advertisers target their messages. They also accused Twitter of falsely claiming to comply with international privacy safeguards frameworks that prevent companies from processing user data for purposes they did not authorize.

In a statement announcing the settlement, FTC Chair Lina Khan said the alleged Twitter abuse affected more than 140 million Twitter users.

As part of the settlement, Twitter will also have to install new compliance measures, including creating a comprehensive privacy program, conducting a privacy review and written report before implementing any new product or service that collects private user information, and regularly testing data privacy protections. He will also need to undergo regular independent evaluations of his data privacy program. Both the Department of Justice and the Federal Trade Commission will be responsible for enforcing compliance with the terms of the settlement.

“The $150 million fine reflects the gravity of the allegations against Twitter, and substantial new compliance measures that will be imposed as a result of today’s proposed settlement will help prevent further misleading tactics that threaten users,” Assistant Attorney General for the Department of Justice Vanita Gupta said in a statement. total.”

The $150 million fine represents about 3% of Twitter’s 2021 revenue of $5.08 billion.

The settlement is the latest attempt by US law enforcement to apply consumer protection law to alleged data privacy violations. In 2019, the Federal Trade Commission (FTC) settled a privacy lawsuit against Facebook for a record $5 billion. But critics at the time said that still wasn’t enough, given that that figure represented about 9% of the company’s revenue for 2018, and argued it was a slap on the wrist that would incentivize tech companies to take such risks again.

Twitter did not immediately respond to a request for comment.

Subscribe to CNBC on YouTube.

WATCH: Why the US Government Questions Your Online Privacy