WASHINGTON–The Federal Trade Commission is reporting that LifeLock has agreed to pay $100 million to settle a case in which the company failed to establish and maintain an information security program to protect customers personally identifiable information.
It is the largest monetary award ever obtained by the FTC.
LifeLock rose to national prominence by guaranteeing it could protect consumers against identity theft, with its CEO, Todd Davis, going on national TV and appearing in other advertising giving away his real Social Security number. According to numerous reports, Davis’ identity was stolen at least 13 times, including to obtain a $500 loan at a check-cashing company that was discovered only after the company called his wife’s cellphone seeking to recover the debt. Numerous cellphone accounts were also opened in his name.
In a 3-1 vote, the FTC held LifeLock in contempt for violating terms of a 2010 federal court order requiring it to secure consumers' personally identifiable information and prohibit the use of deceptive advertising.
"The fact that consumers paid LifeLock for help in protecting their sensitive personal information makes the charges in this case particularly troubling," said FTC Chair Edith Ramirez in a statement.
A 2010 settlement had barred the company and its principals from making any further deceptive claims, required LifeLock to take more stringent measures to safeguard the personal information it collects from customers and required LifeLock to pay $12 million for consumer refunds.
In its new ruling the FTC said LifeLock had falsely advertised that it protected consumers' sensitive data with the same high-level safeguards used by financial institutions, including from January 2012 through December 2014, falsely advertised it would send alerts as soon as it received any indication that a consumer may be a victim of identity theft.
Of the $100 million that LifeLock will pay to settle the case, $68 million will go to consumers who were affected by the company's policies.
The Federal Trade Commission is reporting that LifeLock has agreed to pay $100 million to settle a case in which the company failed to establish and maintain an information security program to protect customers personally identifiable information.