On May 25, 2022, the Justice Department announced that Twitter had agreed to resolve privacy allegations through a $150 million civil penalty and new compliance obligations. The announcement was conditional: a federal court still had to approve the settlement. An agreement to settle, an allegation in a complaint and a judicial finding are different things. [doj]

The government’s complaint, filed in the Northern District of California, alleged that Twitter collected phone numbers and email addresses for account security while failing to disclose their advertising use. DOJ placed the alleged conduct between May 2013 and September 2019. It alleged violations of the FTC Act and a March 2011 Federal Trade Commission order restricting misrepresentations about nonpublic user information. [doj]

The FTC supplied a narrower measure of scale: according to the complaint, more than 140 million users provided contact information from 2014 to 2019 after security assurances. That period is not identical to DOJ’s description of the alleged conduct. The figures should not be combined into a new claim about how many people were affected in every year of the case. [ftc][doj]

The FTC said stipulated final orders acquire legal force when a district judge approves and signs them. Its proposed provisions included alternative authentication methods and restrictions on profiting from deceptively collected data. DOJ described independent privacy assessments and senior-officer certifications. Those announcements establish the terms being proposed, not completed implementation or a criminal conviction. Both releases came from agencies pursuing the same case; they do not provide independent corroboration or establish court approval on this record. [ftc][doj]

Source documents

  1. FTC Charges Twitter with Deceptively Using Account Security Data to Sell Targeted Adshttps://www.ftc.gov/news-events/news/press-releases/2022/05/ftc-charges-twitter-deceptively-using-account-security-data-sell-targeted-ads
  2. Twitter Agrees with DOJ and FTC to Pay $150 Million Civil Penalty and to Implement Comprehensive Compliance Program to Resolve Alleged Data Privacy Violationshttps://www.justice.gov/archives/opa/pr/twitter-agrees-doj-and-ftc-pay-150-million-civil-penalty-and-implement-comprehensive