Facts

Twitter operates an online communication service with more than 330 million monthly users worldwide as of September 2019. Twitter prompts users to provide a telephone number and email address for the express purpose of securing or authenticating their Twitter accounts. Twitter offers various services that advertisers can use to reach their existing marketing lists on Twitter, including Tailored Audiences, which allows advertisers to target specific groups of users by matching telephone numbers and emails to existing lists of numbers, and Partner Audiences, which allows advertisers to import marketing lists from data brokers like Acxiom and Datalogix to match against the telephone numbers and email addresses collected by Twitter. In 2011, after a Federal Trade Commission (FTC) investigation, Twitter settled allegations that it misrepresented the extent to which it protected the privacy and security of nonpublic user information. The resulting Commission Order prohibited Twitter from misrepresenting the extent to which it protects consumer information. On May 25, 2022, the Department of Justice (DOJ) and FTC brought a claim against Twitter, alleging violations of the FTC Act and the FTC administrative order from March 2011. The plaintiffs sought injunctive relief, monetary relief, civil penalties, and other equitable relief for Twitter's alleged violations.

PLAINTIFFS' CONTENTIONS: Plaintiffs contended that Twitter violated the FTC Act by deceiving users about the extent to which Twitter maintained and protected the security and privacy of users' nonpublic contact information. In particular, plaintiffs alleged that from May 2013 to September 2019, Twitter told its users that it was collecting their telephone numbers and email addresses for account-security purposes but failed to disclose that it also would be using that information to help companies send targeted advertisements to consumers through its Tailored Audiences and Partner Audiences programs. These unlawful actions affected more than 140 million Twitter users who provided Twitter their email and phone numbers while boosting Twitter's primary source of revenue. Additionally, plaintiffs argued that Twitter falsely claimed compliance with the EU-US and Swiss-US Privacy Shield Frameworks, which prohibited companies from processing user information in ways that are not compatible with the purposes authorized by the users. Finally, plaintiffs alleged that consumers have suffered and will continue to suffer substantial injury as a result of Twitter's violations and that Twitter has been unjustly enriched as a result of its unlawful acts.

DEFENDANT'S CONTENTIONS: Defendant neither admitted nor denied any of the allegations in the complaint.

Result

Twitter agreed to pay $150 million in civil penalties, as well as implement significant new compliance measures intended to ensure that Twitter improves its data privacy practices, including developing a comprehensive privacy and information-security program, conducting privacy reviews with a written report prior to implementing any new product or service that collects users' information, and conducting regular testing of its data privacy safeguards. Additionally, Twitter is required to notify all U.S. customers who joined Twitter before September 17, 2019, about the settlement and provide users with options for protecting their privacy and security.