Social networking service Myspace has agreed to settle Federal Trade Commission (FTC) charges that it misrepresented its protection of users’ personal information. The settlement bars Myspace from future privacy misrepresentations, requires it to implement a comprehensive privacy program, and calls for regular, independent privacy assessments for the next 20 years.
The Myspace social network has users who create and customize online profiles containing substantial personalized content. Myspace assigns a persistent unique identifier, called a “Friend ID,” to each profile created on Myspace. A user’s profile publicly discloses his or her age, gender, profile picture (if the user chooses to include one), display name, and, by default, the user’s full name. User profiles also may contain additional information such as pictures, hobbies, interests, and lists of users’ friends.
In addition, Myspace certified that it complied with the U.S.-EU Safe Harbor Framework, which provides a method for U.S. companies to transfer personal data lawfully from the European Union to the United States. As part of its self-certification, Myspace claimed that it complied with the Safe Harbor Principles, including the requirements that consumers be given notice of how their information will be used and the choice to opt out. The FTC alleged that these statements were false.
The proposed settlement order bars Myspace from misrepresenting the extent to which it protects the privacy of users’ personal information or the extent to which it belongs to or complies with any privacy, security or other compliance program, including the U.S.-EU Safe Harbor Framework. The order also requires that Myspace establish a comprehensive privacy program designed to protect consumers’ information, and to obtain biennial assessments of its privacy program by independent, third-party auditors for 20 years.
The Commission vote to accept the consent agreement package containing the proposed consent order for public comment was 4-0-1, with Commissioner Maureen K. Ohlhausen not participating. The agreement will be subject to public comment for 30 days, and continuing through June 8, after which the Commission will decide whether to make the proposed consent order final.
You can find MySpace’s statement on the FTC settlement here.