Twitter Fined $150m For Selling User Data

Just 6 months ago, in Europe, Twitter was fined £400k for breaking the EU's GDPR data privacy rules in 20121. Now, the US regulatory authorities fined Twitter $150 million (£119 million) for misusing users' data in order to help sell targeted ads. 

Twitter has been collecting users’ email addresses and phone numbers. And then in addition to using phone numbers and email addresses for security, Twitter also used the information to serve users targeted ads, which earned the firm millions of dollars.  

The Federal Trade Commission (FTC) and the Department of Justice (DOJ) say Twitter violated an agreement it had with regulators when the firm secretly exploited the personal data users handed over for security reasons. While Twitter had promised the regulators that it would not give personal information like phone numbers and email addresses to advertisers, the FTC say the social media company broke those rules. 

The FTC is an independent agency of the US government whose mission is the enforcement of anti-trust law and the promotion of consumer protection. It accused Twitter of breaching a 2011 FTC order that explicitly prohibited the company from misrepresenting its privacy and security practices. “While Twitter represented to users that it collected their telephone numbers and email addresses to secure their accounts, Twitter failed to disclose that it also used user contact information to aid advertisers in reaching their preferred audiences,” said a court complaint filed by the DoJ.

Twitter generates most of its revenue from advertising on its platform, which allows users ranging from consumers to celebrities to corporations to post 280-character messages, or tweets. Twitter makes 90% of its annual revenue of $5bn (£3.8bn) from advertising. 

According to a complaint filed by the Department of Justice on behalf of the FTC, Twitter in 2013 began asking users to provide either a phone number or email address to improve account security. “Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads.” FTC chair, Lina Khan observed. “This practice affected more than 140 million users while boosting Twitter’s primary source of revenue... Twitter obtained data from users on the pretext of harnessing it for security purposes, but then ended up also using the data to target users with ads".

To authenticate an account, Twitter requires people to provide a telephone number and email address.
That information also helps people reset their passwords and unlock their accounts if required, as well as for enabling two-factor authentication. Two-factor authentication provides an extra layer of security by sending a code to either a phone number or email address to help users log into Twitter along with a username and password.

According to the FTC, until at least September 2019, Twitter was also using that information to boost its advertising business. 

It is accused of allowing advertisers access to users' security information. In addition to the fine, Twitter must also:

  • Prohibit using the phone numbers and email addresses it illegally collected.
  • Tell users about its improper use of security information.
  • Explain to users about the FTC law enforcement action.
  • Tell how to turn off personalised adverts and review multi-factor authentication settings.
  • Provide multi-factor authentication options that do not need a phone number.
  • Implement an enhanced privacy and security programme which includes reporting incidents to the FTC within 30 days.

"The $150m penalty reflects the seriousness of the allegations against Twitter, and the substantial new compliance measures to be imposed as a result of the proposed settlement will help prevent further misleading tactics that threaten users' privacy.... "The Department of Justice is committed to protecting the privacy of consumers' sensitive data," said Vanita Gupta, the US associate attorney general. 

Twitter’s settlement follows years of controversy over the privacy practices of social media and technology companies. 

In 2018 it was disclosed that Facebook, the world’s biggest social network, was using phone numbers provided for two-factor authentication to serve ads enraged privacy advocates. Facebook, now called Meta, similarly settled with the FTC over the issue as part of a $5bn agreement reached in 2019.

Elon Musk,  who has an agreement to buy Twitter for $44b has slammed its advertising based business  model and has promised to diversify its income streams. "If Twitter was not truthful here, what else is not true? This is very concerning news," he said in a recent tweet.

FTC:      Reuters:      Twitter:    BBC:      Guardian:   Business Insider:     Computing:    NPR

You Might Also Read: 

Twitter, Free Speech & Disinformation:
 

« No future For IoT Security Without Secure Access Service Edge (SASE)
Facing Facts On Facial Recognition »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Softtek

Softtek

Softtek provides comprehensive software Quality Assurance and Testing that identifies the correctness, completeness, and quality level of software products.

Malta Information Technology Agency (MITA)

Malta Information Technology Agency (MITA)

MITA is the central driver of Government Information and Communications Technology (ICT) policy, programmes and initiatives in Malta.

Cog Systems

Cog Systems

Cog Systems offer an embedded solution built on modularity, proactive security, trustworthiness, and adaptability to enable highly secure connected devices.

CARICERT

CARICERT

CARICERT is the National Cyber Emergency Response Team of Curacao in the Caribbean.

FileWave

FileWave

FileWave offers a single solution for managing apps, devices, and more for Mac, Windows, and mobile devices.

ThirdWatch

ThirdWatch

ThirdWatch is a Data Science company with real-time automated fraud prevention solutions.

CSC Digital Brand Services

CSC Digital Brand Services

Our brand protection and security expertise give our customers peace of mind that no matter how fast the digital world changes, their intellectual property and digital assets will be secure.

Socure

Socure

Socure’s identity verification increases auto approval rates, reduces false positives and captures more fraud. In real time.

Tetra Tech

Tetra Tech

Tetra Tech is a cybersecurity leader with extensive experience in supporting enterprise-wide programs and systems across multiple business lines from industrial control systems to health IT.

EVOKE

EVOKE

EVOKE is an award-winning Digital Transformation company that partners with its clients to build digital workplace solutions for organizational challenges.

FortifyIQ

FortifyIQ

FortifyIQ's mission is to advance maximum security against side-channel attacks across the entire computing spectrum.

PacketViper

PacketViper

PacketViper’s Deception360 actively defends networks with deception-based threat detection and automated response to both external and internal cyber threats.

Appurity

Appurity

Appurity specialises in mobile and application security, delivering comprehensive solutions across all verticals.

Nasuni

Nasuni

The Nasuni File Data Platform offers the protection, detection, and recovery of file shares from ransomware attacks or random disasters within minutes.

MLSecOps Community

MLSecOps Community

The MLSecOps Community is a collaborative space for machine learning security experts and industry leaders to connect and shape the future of AI/ML security.

Metrics that Matter (MTM)

Metrics that Matter (MTM)

Metrics that Matter redefines how organizations approach cybersecurity by offering unprecedented insight into the value of their assets to criminals and tailored action plans to protect.