Twitter Fined $150 Million for Misusing Users’ Data for Advertising Without Consent

Twitter, which is in the process of being acquired by Tesla CEO
Elon Musk, has agreed to pay $150 million to the U.S. Federal Trade
Commission (FTC) to settle allegations that it abused non-public
information collected for security purposes to serve targeted
ads.

In addition to the monetary penalty for “misrepresenting its
privacy and security practices,” the company has been banned from
profiting from the deceptively collected data and ordered to notify
all affected users.

“Twitter obtained data from users on the pretext of harnessing
it for security purposes but then ended up also using the data to
target users with ads,” FTC Chair Lina M. Khan said^[1]
in a statement. “This practice affected more than 140 million
Twitter users, while boosting Twitter’s primary source of
revenue.”

According to a complaint^[2]
filed by the U.S. Justice Department, Twitter in May 2013 began
enforcing a requirement for users to provide either a phone number
or email address to improve account security.

The intention was to ostensibly help users recover access to
their locked accounts as well as enable two-factor authentication
by sending a one-time password to the registered phone number or
email address after signing in with a username and password.

But what Twitter failed^[3]
to make transparent was that it also allowed advertisers to use
this information to target specific ads by matching them with email
addresses and phone numbers already obtained from other
third-parties such as data brokers.

The social media platform reiterated the issue was addressed^[4]
as of September 17, 2019, adding^[5]
it will work to make investments with regards to “operational
updates and program enhancements to ensure that people’s personal
data remains secure and their privacy protected.”

“Consumers who share their private information have a right to
know if that information is being used to help advertisers target
customers,” said U.S. Attorney Stephanie M. Hinds for the Northern
District of California. “Social media companies that are not honest
with consumers about how their personal information is being used
will be held accountable.”

This development marks the second time Twitter has settled with
the U.S. consumer protection watchdog. In March 2011, it admitted^[6]
to charges that it “deceived consumers and put their privacy at
risk by failing to safeguard their personal information,” thereby
enabling hackers to gain administrative control over the platform
twice in 2009.