Legal Review: Spokeo's Data Broker Business Model Results in First-of-Its-Kind FTC Action1 Jul, 2012 By: Jeffrey D. Knowles, Venable LLP’s Advertising, Jonathan L. Pompan Response
On June 12, the Federal Trade Commission (FTC) leveled an $800,000 civil penalty against Spokeo Inc. over charges that the company violated the Fair Credit Reporting Act (FCRA). The company entered into a settlement with the FTC regarding the alleged FCRA violations, as well as the alleged posting of fraudulent endorsements and testimonials on news and technology websites and blogs.
This case marks the first time the FTC has used FCRA, which governs credit-reporting agencies, in an enforcement action against a lead generator. To understand why the FTC took this course of action — and what this case could mean for marketers and companies engaged in the sale of consumer data — it is important to understand Spokeo’s business.
Spokeo is a data broker that compiles and sells detailed information profiles on millions of consumers from its consumer-facing people search engine and other sources, including social networks. It merges the data to create detailed personal profiles of consumers, including name, address, age range and E-mail address, among a number of other things.
The FTC alleges that from 2008 until 2010 the company marketed these profiles to the human resources, background screening and recruiting industries by encouraging recruiters to “Explore Beyond the Resume.” Because the consumer information was being used in hiring decisions, the FTC alleged that Spokeo was operating as a consumer reporting agency, making the company subject to the FCRA’s requirements.
The FTC accused Spokeo of violating the FCRA by failing to ensure that the information it sold would be used only for legally permissible purposes; failing to ensure the information was accurate; and failing to tell users of its consumer reports about their obligation under the FCRA, including the requirement to notify consumers if the users of the information took an adverse action against the consumer based on information contained in the consumer report.
Spokeo strenuously objected to the FTC’s allegations. In a statement on the company’s blog, the company maintained that it is not, and never was a consumer reporting agency, writing, “It has never been our intention to act as a consumer reporting agency. We are a technology company organizing people-related data in innovative ways. We do not create our own content, we do not possess or have access to private financial information, and we do not offer consumer reports.”
In fact, Spokeo modified its “terms of service” in 2010 to state explicitly that it was not a consumer reporting agency and that consumers of the company’s profiles could not use the information in ways that violated FCRA.
However, relying solely upon contractual limitations on the use of data when representations are made in marketing that may suggest the data can be used as a factor for employment decisions may now be a problem that could ensnare other companies that collect, aggregate, sell and/or use consumer data. The FCRA regulates the practices of companies that collect and compile consumer information for use by credit grantors, insurance companies, employers, landlords and other entities in making eligibility decisions affecting consumers.
Companies across the marketing spectrum are delving deeper into the collection and use of “big data” to slice and dice communities of consumers in order to provide highly customized offers to select groups of consumers and mine their databases for new sources of revenue. There is a risk that both the seller of the consumer data and the marketer using the data could create a situation in which one or both organizations become subject to FCRA, even if they are not traditional vendors or users of consumer reports. Accordingly, companies considering monetizing their consumer databases or purchasing data from another company and using that data to make marketing decisions should ensure they their business practices, as well as those of their partner(s), either are in compliance with FCRA or are not subject to it.