Twitter Fined $150m For Selling User Data

Just 6 months ago, in Europe, Twitter was fined £400k for breaking the EU's GDPR data privacy rules in 20121. Now, the US regulatory authorities fined Twitter $150 million (£119 million) for misusing users' data in order to help sell targeted ads. 

Twitter has been collecting users’ email addresses and phone numbers. And then in addition to using phone numbers and email addresses for security, Twitter also used the information to serve users targeted ads, which earned the firm millions of dollars.  

The Federal Trade Commission (FTC) and the Department of Justice (DOJ) say Twitter violated an agreement it had with regulators when the firm secretly exploited the personal data users handed over for security reasons. While Twitter had promised the regulators that it would not give personal information like phone numbers and email addresses to advertisers, the FTC say the social media company broke those rules. 

The FTC is an independent agency of the US government whose mission is the enforcement of anti-trust law and the promotion of consumer protection. It accused Twitter of breaching a 2011 FTC order that explicitly prohibited the company from misrepresenting its privacy and security practices. “While Twitter represented to users that it collected their telephone numbers and email addresses to secure their accounts, Twitter failed to disclose that it also used user contact information to aid advertisers in reaching their preferred audiences,” said a court complaint filed by the DoJ.

Twitter generates most of its revenue from advertising on its platform, which allows users ranging from consumers to celebrities to corporations to post 280-character messages, or tweets. Twitter makes 90% of its annual revenue of $5bn (£3.8bn) from advertising. 

According to a complaint filed by the Department of Justice on behalf of the FTC, Twitter in 2013 began asking users to provide either a phone number or email address to improve account security. “Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads.” FTC chair, Lina Khan observed. “This practice affected more than 140 million users while boosting Twitter’s primary source of revenue... Twitter obtained data from users on the pretext of harnessing it for security purposes, but then ended up also using the data to target users with ads".

To authenticate an account, Twitter requires people to provide a telephone number and email address.
That information also helps people reset their passwords and unlock their accounts if required, as well as for enabling two-factor authentication. Two-factor authentication provides an extra layer of security by sending a code to either a phone number or email address to help users log into Twitter along with a username and password.

According to the FTC, until at least September 2019, Twitter was also using that information to boost its advertising business. 

It is accused of allowing advertisers access to users' security information. In addition to the fine, Twitter must also:

  • Prohibit using the phone numbers and email addresses it illegally collected.
  • Tell users about its improper use of security information.
  • Explain to users about the FTC law enforcement action.
  • Tell how to turn off personalised adverts and review multi-factor authentication settings.
  • Provide multi-factor authentication options that do not need a phone number.
  • Implement an enhanced privacy and security programme which includes reporting incidents to the FTC within 30 days.

"The $150m penalty reflects the seriousness of the allegations against Twitter, and the substantial new compliance measures to be imposed as a result of the proposed settlement will help prevent further misleading tactics that threaten users' privacy.... "The Department of Justice is committed to protecting the privacy of consumers' sensitive data," said Vanita Gupta, the US associate attorney general. 

Twitter’s settlement follows years of controversy over the privacy practices of social media and technology companies. 

In 2018 it was disclosed that Facebook, the world’s biggest social network, was using phone numbers provided for two-factor authentication to serve ads enraged privacy advocates. Facebook, now called Meta, similarly settled with the FTC over the issue as part of a $5bn agreement reached in 2019.

Elon Musk,  who has an agreement to buy Twitter for $44b has slammed its advertising based business  model and has promised to diversify its income streams. "If Twitter was not truthful here, what else is not true? This is very concerning news," he said in a recent tweet.

FTC:      Reuters:      Twitter:    BBC:      Guardian:   Business Insider:     Computing:    NPR

You Might Also Read: 

Twitter, Free Speech & Disinformation:
 

« No future For IoT Security Without Secure Access Service Edge (SASE)
Facing Facts On Facial Recognition »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

iXsystems

iXsystems

iXsystems is a leader in Open-Source enterprise server and storage solutions including Backup & Recovery to protect critical data.

AA Certification (AAC)

AA Certification (AAC)

AAC provide ISO Quality Management System certification services including ISO 27001.

Hogan Lovells

Hogan Lovells

Hogan Lovells is an international business law firm with offices across Europe, Asia and the USA. Practice areas include Privacy & Cybersecurity.

Italian Association of Critical Infrastructure Experts (AIIC)

Italian Association of Critical Infrastructure Experts (AIIC)

AIIC acts as a focal point in Italy for expertise on the protection of Critical Infrastructure including ICT networks and cybersecurity.

Adlink Technology

Adlink Technology

ADLINK is a leading provider of embedded computing products and services for applications including IoT and industrial automation.

Avatier

Avatier

Avatier identity management software products automate identity access management, user provisioning and IT governance to ensure information security and compliance.

Terranova Security

Terranova Security

Terranova is dedicated to providing information security awareness programs customized to your internal policies and procedures.

Crashtest Security

Crashtest Security

Crashtest Security is a cyber security company that helps digital companies to continuously create secure software with the help of automated vulnerability assessments.

Cyber Physical Security Research Center (CPSEC)

Cyber Physical Security Research Center (CPSEC)

CPSEC aims to contribute to the security enhancement of industrial infrastructure that creates value across cyber space and physical space.

GrrCON

GrrCON

GrrCON is an information security and hacking conference that provides the Midwest InfoSec community with a fun atmosphere to come together and engage with like minded people.

TierPoint

TierPoint

TierPoint delivers secure, reliable, and connected infrastructure solutions at the internet’s edge. We meet you where you are in your journey to solve for data storage, compute, and recovery.

InferSight

InferSight

InferSight can help you design an architecture that takes into account security, performance, availability, functionality, resiliency and future capacity to avoid technological lock in and limitations

eCloudvalley Digital Technology

eCloudvalley Digital Technology

eCloudvalley Digital Technology is a born-in-the-cloud partner focused entirely on AWS services across APAC region.

Open Source Security Foundation (OpenSSF)

Open Source Security Foundation (OpenSSF)

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.

DataProof Communications

DataProof Communications

DataProof Communications is Cybersecurity Company specialising in cybersecurity operations, incident management and response best practices and technologies.

Lightpath

Lightpath

Lightpath is revolutionizing how organizations connect to their digital destinations by combining our next-generation network with our next-generation customer service.