It's the first FTC fine involving personal data collected online and sold to potential employers.
The FTC argued in the case that Spokeo was running as a "consumer reporting agency" that violated the Fair Credit Reporting Act (FCRA) by not checking if the data it collected was accurate or would be used for legally permissible purposes.
Spokeo also violated the FCRA by failing to notify people who were rejected from a potential job because of data it sold to employers, the FTC says. Additionally, Spokeo posted advertisements on the web that claimed to show endorsements from a third party, but according to the FTC, they were faked by the company's own staff.
On top of the fine, Spokeo is prohibited from further violating the FCRA or creating false advertisements.
Harrison Tang, one the company's founders, said in a written statement hat Spokeo will make the necessary changes to steer clear of future FTC charges. He denied his company was a consumer reporting agency, instead claiming to be part of the "people search industry."
"We have made changes to our site and our internal business practices in order to ensure we don’t infringe upon the FCRA’s important consumer protections, and to ensure an honest and transparent service that will continue to be easy for our customers to use," Tang wrote. "We are a technology company organizing people-related data in innovative ways. We do not create our own content, we do not possess or have access to private financial information, and we do not offer consumer reports."
The FTC, though, alleged that from 2008 through 2010, Spokeo sold "detailed personal profiles" of consumers to employers, which could include "such information as name, address, age range, and email address" as well as "hobbies, ethnicity, religion, participation on social networking sites, and photos." Spokeo collected that information both online and offline and marketed it directly at employers and recruiters through specialized portals on its web site.
In 2010, Spokeo changed gears, saying it was not a consumer reporting agency and its products shouldn't be used in ways that violate the FCRA. However, the FTC says the company failed to revoke access to those who were already using Spokeo's products in illegal ways.
The case was the result of a two-year old complaint originally launched by the Center for Democracy and Technology, an online privacy organization.
"Spokeo sold shoddy consumer reports to prospective employers without offering the very basic protections required by law," said Justin Brookman, director of CDT's Project on Consumer Privacy. "This is a really important case that will hopefully offer needed guidance on how the Fair Credit Reporting Act applies in the age of social media."
How worried are you about the information data collectors have about you? Share with us in the comments.