LifeLock To Pay Record $100 Million To Settle FTC Charges of Deception, Lack of Data Protection

LifeLock agreed to pay $100 million to settle FTC charges that the company failed to act to protect users' data and continued to make deceptive claims about its identity theft protection services, violating a 2010 federal court order (see 1507210041). “That consumers paid [LifeLock] for help in protecting their sensitive personal information makes the charges in this case particularly troubling,” FTC Chairwoman Edith Ramirez said in a statement Thursday. The commission approved the order 3-1, with Commissioner Maureen Ohlhausen dissenting. Under the settlement, $68 million may be used to reimburse customers in a class-action lawsuit against the company and in settlements state attorneys general have negotiated on behalf of other consumers. It can't be used for any administrative or legal costs of the lawsuit. An FTC spokesman said the agency will use the remaining $32 million to provide redress to other consumers who weren't part of the class-action suit or state AG settlements. In a separate statement, Ohlhausen said the "record lacks a clear and convincing evidence that LifeLock failed to establish and maintain a comprehensive information security program designed to protect the security, confidentiality, and integrity of consumers' personal information." She said LifeLock's compliance with the payment card data security standard and other data security certifications undermined FTC staff's ability to clear the "high threshold" and succeed on the July contempt motion, which alleged LifeLock violated the 2010 order. LifeLock, which neither confirmed nor denied the allegations, said in a statement the allegations "are related to advertisements that we no longer run and policies that are no longer in place. The settlement does not require us to change any of our current products or practices. Furthermore, there is no evidence that LifeLock has ever had any of its customers' data stolen, and the FTC did not allege otherwise." The company said it has made "significant investments in our people, processes and systems" in recent years to address more complex and prevalent ID threats. The FTC said the settlement is the largest obtained by the commission in enforcing an order.