Twitter Fined $150m For Selling User Data

Just 6 months ago, in Europe, Twitter was fined £400k for breaking the EU's GDPR data privacy rules in 20121. Now, the US regulatory authorities fined Twitter $150 million (£119 million) for misusing users' data in order to help sell targeted ads. 

Twitter has been collecting users’ email addresses and phone numbers. And then in addition to using phone numbers and email addresses for security, Twitter also used the information to serve users targeted ads, which earned the firm millions of dollars.  

The Federal Trade Commission (FTC) and the Department of Justice (DOJ) say Twitter violated an agreement it had with regulators when the firm secretly exploited the personal data users handed over for security reasons. While Twitter had promised the regulators that it would not give personal information like phone numbers and email addresses to advertisers, the FTC say the social media company broke those rules. 

The FTC is an independent agency of the US government whose mission is the enforcement of anti-trust law and the promotion of consumer protection. It accused Twitter of breaching a 2011 FTC order that explicitly prohibited the company from misrepresenting its privacy and security practices. “While Twitter represented to users that it collected their telephone numbers and email addresses to secure their accounts, Twitter failed to disclose that it also used user contact information to aid advertisers in reaching their preferred audiences,” said a court complaint filed by the DoJ.

Twitter generates most of its revenue from advertising on its platform, which allows users ranging from consumers to celebrities to corporations to post 280-character messages, or tweets. Twitter makes 90% of its annual revenue of $5bn (£3.8bn) from advertising. 

According to a complaint filed by the Department of Justice on behalf of the FTC, Twitter in 2013 began asking users to provide either a phone number or email address to improve account security. “Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads.” FTC chair, Lina Khan observed. “This practice affected more than 140 million users while boosting Twitter’s primary source of revenue... Twitter obtained data from users on the pretext of harnessing it for security purposes, but then ended up also using the data to target users with ads".

To authenticate an account, Twitter requires people to provide a telephone number and email address.
That information also helps people reset their passwords and unlock their accounts if required, as well as for enabling two-factor authentication. Two-factor authentication provides an extra layer of security by sending a code to either a phone number or email address to help users log into Twitter along with a username and password.

According to the FTC, until at least September 2019, Twitter was also using that information to boost its advertising business. 

It is accused of allowing advertisers access to users' security information. In addition to the fine, Twitter must also:

  • Prohibit using the phone numbers and email addresses it illegally collected.
  • Tell users about its improper use of security information.
  • Explain to users about the FTC law enforcement action.
  • Tell how to turn off personalised adverts and review multi-factor authentication settings.
  • Provide multi-factor authentication options that do not need a phone number.
  • Implement an enhanced privacy and security programme which includes reporting incidents to the FTC within 30 days.

"The $150m penalty reflects the seriousness of the allegations against Twitter, and the substantial new compliance measures to be imposed as a result of the proposed settlement will help prevent further misleading tactics that threaten users' privacy.... "The Department of Justice is committed to protecting the privacy of consumers' sensitive data," said Vanita Gupta, the US associate attorney general. 

Twitter’s settlement follows years of controversy over the privacy practices of social media and technology companies. 

In 2018 it was disclosed that Facebook, the world’s biggest social network, was using phone numbers provided for two-factor authentication to serve ads enraged privacy advocates. Facebook, now called Meta, similarly settled with the FTC over the issue as part of a $5bn agreement reached in 2019.

Elon Musk,  who has an agreement to buy Twitter for $44b has slammed its advertising based business  model and has promised to diversify its income streams. "If Twitter was not truthful here, what else is not true? This is very concerning news," he said in a recent tweet.

FTC:      Reuters:      Twitter:    BBC:      Guardian:   Business Insider:     Computing:    NPR

You Might Also Read: 

Twitter, Free Speech & Disinformation:
 

« No future For IoT Security Without Secure Access Service Edge (SASE)
Facing Facts On Facial Recognition »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Atlantic Council

Atlantic Council

The Atlantic Council's Cyber Statecraft Initiative focuses on international cooperation, competition, and conflict in cyberspace.

Rubicon Workflow Solutions

Rubicon Workflow Solutions

Rubicon is a leading provider of managed IT support and strategic services, specialising in creative and mixed platform environments.

PhishLabs

PhishLabs

PhishLabs provides 24/7 services that help organizations protect against the cyberattacks targeting their employees, their customers and their brands.

CounterCraft

CounterCraft

The CounterCraft Cyber Deception Platform fits seamlessly into existing security strategies and delivers high-end deception for threat hunting and threat detection.

Dell Technologies

Dell Technologies

Dell Technologies Consulting Services enables a highly resilient business amidst the proliferation of cloud-based IT services and constant threats to your most critical information.

Aptiv

Aptiv

Aptiv is a global technology company that develops safer, greener and more connected solutions enabling the future of mobility.

Absio

Absio

Absio provides the technology you need to build data security directly into your software by default, and the design and development services you need to make it happen.

CyberSwarm

CyberSwarm

CyberSwarm is developing a neuromorphic System-on-a-Chip dedicated to cybersecurity which helps organizations secure communication between connected devices and protect critical business assets.

Vigilant Technology Solutions

Vigilant Technology Solutions

Vigilant is a global cyber security technology company offering solutions to manage entire IT & cyber security lifecycles.

LTIMindtree

LTIMindtree

LTIMindtree is a new kind of technology consulting firm. We help businesses transform – from core to experience – to thrive in the marketplace of the future.

Digital Pathways

Digital Pathways

Digital Pathways is an award-winning data security provider that helps businesses protect their digital assets.

Hub71

Hub71

Hub71 is a world-class tech ecosystem opening doors to global opportunities from an optimal business environment for entrepreneurial-minded innovators.

European Cybersecurity Competence Centre (ECCC)

European Cybersecurity Competence Centre (ECCC)

The ECCC aims to increase Europe’s cybersecurity capacities and competitiveness, working together with a Network of National Coordination Centres to build a strong cybersecurity Community.

Mitigo Group

Mitigo Group

Mitigo offers a well considered and effective approach to keeping businesses completely secure from any digital attacks.

Emerge Digital

Emerge Digital

Emerge Digital is a technology and digital innovation business and Managed Services Provider providing solutions to SMEs.

Telarus

Telarus

Telarus is a Technology Services Brokerage that holds contracts with the world's leading cloud voice, contact center, cybersecurity, mobility and IoT providers.