A company selling identity theft protection services will pay $100 million to settle charges that it failed to protect its customers, in the largest ever settlement agreement with the Federal Trade Commission.
The FTC charged the company with violating a 2010 federal court order requiring it to secure consumers’ personal information — including social security, credit card, and bank account numbers — and to cease deceptive advertising.
“The fact that consumers paid LifeLock for help in protecting their sensitive personal information makes the charges in this case particularly troubling," said FTC Chairwoman Edith Ramirez in a statement.
As a part of the settlement, LifeLock neither confirmed nor denied the allegations, the company said in a statement.
"The advertising and security allegations raised by the FTC were historical in nature, and the settlement does not require us to change any of our current products or practices," LifeLock wrote. "It’s important to note that the FTC did not allege, or offer any evidence, that LifeLock has ever had its customers’ data stolen."
Founded in 2005, LifeLock first tangled with the FTC and 35 state Attorneys General five years ago, when, according to the complaint, the company failed to protect the identities and sensitive personal information of the consumers it claimed to guard. To settle the case, LifeLock agreed to provide the services it advertised and to stop misleading consumers.
According to LifeLock's website, the company offers protection and notifications for incidents including identity theft and lost wallets, data breaches, and bank account takeovers. Customers are charged $10 to $30 a month for the service, and the company says it has 4 million members.
Lifelock also provides address change verification, black market website surveillance, pre-approved credit card offers, and credit reports. It says it guarantees it will spend $1 million in the event of identity theft, in legal and other efforts to restore a consumer's identity, without specifically covering restitution for money lost from the theft.
"LifeLock promised consumers complete protection against all types of identity theft," said the FTC's then-chairman Jon Leibowitz when the company originally reached a settlement in 2010. "In truth, the protection it actually provided left enough holes that you could drive a truck through it."
LifeLock advertised heavily on TV and radio, and the company's celebrity spokespeople have included Howard Stern and Rush Limbaugh. "It pays to protect with the best," one slogan reads.
Now, LifeLock will pay to settle four alleged violations of the 2010 federal court order: that it failed to protect users’ sensitive personal information; it falsely claimed it protected consumers’ data with high-level safeguards comparable to those used by financial institutions; it falsely advertised it would send alerts “as soon as” it received any indication that a consumer may be a victim of identity theft; and it failed to meet record-keeping requirements.
Of the $100 million, $68 million may be used to compensate class action consumers allegedly injured by LifeLock. Under the terms of the settlement, the funds must be paid directly to consumers, rather than for administrative or legal costs. Any money not received by consumers will be provided to the FTC for use in further consumer redress, according to the Commission.