Privacy & Information Security Law Blog

On December 17, 2015, the Federal Trade Commission announced that LifeLock, Inc. (“LifeLock”) has agreed to pay $100 million to settle contempt charges for deceptive advertising. According to the FTC, “[t]his is the largest monetary award obtained by the Commission in an order enforcement action.” Under the terms of the settlement, $68 million of the settlement amount will be paid to class action consumers who were injured by the identity theft protection company’s violation of a 2010 settlement with the FTC that required LifeLock to protect consumer information. The rest of the money will be used for settlements with state attorneys general, and any remaining money will go to the FTC. The case is Federal Trade Commission v. LifeLock Inc., et al. (2:10-cv-00530), in the U.S. District Court for the District of Arizona.

As part of the 2010 settlement, LifeLock had agreed to strengthen its safeguarding of customer data and refrain from making deceptive claims about its services. On July 21, 2015, the FTC alleged that LifeLock violated its 2010 settlement because it did not properly protect customers’ sensitive personal data and continued to “make deceptive claims about its identity theft protection services.” Specifically, the FTC alleged that LifeLock: (1) failed to establish and maintain a comprehensive information security program to protect its customers’ sensitive personal data; (2) falsely advertised that it protected customers’ sensitive data with the same high-level safeguards as financial institutions; and (3) falsely claimed that it protected customers’ identity at all times by providing alerts “as soon as” it received any indication there was an identity theft problem.