FTC Fines Twitter $150 Million For Using 2FA Phone Numbers For Ad Targeting (npr.org) 32
Twitter has agreed to pay a $150 million fine after federal law enforcement officials accused the social media company of illegally selling advertisements based on an improper use of personal data over six years. NPR reports: In court documents made public on Wednesday, the Federal Trade Commission and the Department of Justice say Twitter violated a 2011 agreement with regulators in which the company vowed to not use information gathered for security purposes, like users' phone numbers and email addresses, to help advertisers target people with ads. Federal investigators say Twitter broke that promise.
"As the complaint notes, Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads," said FTC Chair Lina Khan. Twitter requires users to provide a telephone number and email address to authenticate accounts. That information also helps people reset their passwords and unlock their accounts when the company blocks logging in due to suspicious activity. But until at least September 2019, Twitter was also using that information to boost its advertising business by allowing advertisers access to users' phone numbers and email addresses. That ran afoul of the agreement the company had with regulators. More than 140 million Twitter users provided this kind of personal information based on "Twitter's deceptive statements," according to federal prosecutors.
"As the complaint notes, Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads," said FTC Chair Lina Khan. Twitter requires users to provide a telephone number and email address to authenticate accounts. That information also helps people reset their passwords and unlock their accounts when the company blocks logging in due to suspicious activity. But until at least September 2019, Twitter was also using that information to boost its advertising business by allowing advertisers access to users' phone numbers and email addresses. That ran afoul of the agreement the company had with regulators. More than 140 million Twitter users provided this kind of personal information based on "Twitter's deceptive statements," according to federal prosecutors.
So... (Score:4, Insightful)
Re: (Score:1)
Re:So... (Score:4, Interesting)
Re: (Score:3)
As is always true when big corps are 'caught', this settlement is missing a zero. Maybe two.
We should make them incorporate in Iceland.
Re: (Score:2)
What a fucking joke (Score:4, Insightful)
The FTC
The State of US regulation in general.
All a big fucking joke at the peoples expense.
Re: (Score:3)
What about Twitter and Facebook? You conveniently forgot to give us your opinion of them.
Re: (Score:2)
Re: (Score:3, Insightful)
Sad part is getting laughed at because you knew (Score:5, Informative)
But when you tell people why you won't cross the red line to expose such personal information to companies, most are gullible enough to just laugh every concern off. Until they start complaining about the robo-calls, the SMS SPAM and so on.
Re: (Score:3)
I collect phone numbers like a drug dealer. If the number space is going to collapse under its own weight, that's partly my fault, but I have no regrets. Action and reaction. Phone numbers are an anachronism and need to go away.
Re: (Score:2)
nah, my landline conference phone is better for some purposes than a screwy unreliable digital two-way radio with bad fidelity, dead spots in coverage, dropping of calls. Talk about backwards step. Phone serves better as pocket computer and two-way pager platform (texting), but actualy making phone calls sucks goat balls.
Re: (Score:2)
I vividly remember the time when corporations like Twitter (and many other) started to harvest mobile phone numbers under the pretense of "something something security".
Yep. I remember well the first time google said "to verify something something we'll send you a text message..."
A phone number is the holy grail of data collection. People can easily create fake email accounts but not many people have multiple phones.
Re: (Score:2)
Re: (Score:1)
Re: (Score:3)
Re:Sad part is getting laughed at because you knew (Score:4, Funny)
Yes, I'm just being pre-coffee nasty this morning. They deserve it.
Re: (Score:2)
I vividly remember the time when corporations like Twitter (and many other) started to harvest mobile phone numbers under the pretense of "something something security". It was clear from the very start that this was just another ploy to lure people into exposing sensitive personal information to those greedy data collectors. Once collected, such data will be on sale, if not today, then soon or latest when the collecting company is sold off to some other company.
But when you tell people why you won't cross the red line to expose such personal information to companies, most are gullible enough to just laugh every concern off. Until they start complaining about the robo-calls, the SMS SPAM and so on.
I think it's gotten so bad I need one number to give to companies that are going to spam me and another number I use for my everyday phone. Just like I currently do with email.
Re:Sad part is getting laughed at because you knew (Score:4, Informative)
In the UK we don't really get many spam calls. There is a telephone preference service, but I haven't bothered with it. GDPR seems to have worked well - companies can't sell your phone number without your affirmative consent.
Most of us never get SMS spam or robocalls. I get some recruiters, who have an annoying habit of calling back again immediately if I decline. That gets them insta-blocked. Pixel phones have a call screening function where the phone talks to them and asks what they want, and that usually gets rid of them.
Re: (Score:2)
The problem is the phone companies refuse to implement a system where the call recipient can verify the caller's phone number or ID. The caller ID system is laughably easy to spoof. Blocking the number doesn't help since it's not the number the spammer is actually calling from; and it may
Re: (Score:2)
In the UK we don't really get many spam calls. There is a telephone preference service, but I haven't bothered with it. GDPR seems to have worked well - companies can't sell your phone number without your affirmative consent.
Most of us never get SMS spam or robocalls. I get some recruiters, who have an annoying habit of calling back again immediately if I decline. That gets them insta-blocked. Pixel phones have a call screening function where the phone talks to them and asks what they want, and that usually gets rid of them.
Even though, I still get those random "We've heard you bin in an accident" calls every few months. Usually with atrocious grammar. I usually ignore unknown calls, but at the moment I'm expecting vendors to call me so I have to pick them up.
I'm guessing you're like me where you don't give out your number to everyone and sundry. I.E. competitions, radio call-ins, et al. as just about anyone can sell your number even with the GDPR as it's impossible to prove who sold it. It's getting harder to avoid using t
Re: (Score:2)
Also exactly the reason why I just leave Discord servers that require me to have "2FA" with my phone number.
No one needs my phone number for 2FA, or for confirmation I am who I am. It's absolute bullshit.
Re: (Score:2)
At one point in the not-so-distant past, SMS two-factor was something that basically everyone had access to. Now we all have smartphones, so I wish that all these systems that use SMS would just upgrade to the far more secure TOTP standard.
We can all download Google Authenticator for free, or use other standards-compliant TOTP stores such as 1Password that are even shared between devices and automatically backed up. SMS two-factor needs to just go away.
No number for you (Score:5, Insightful)
>"FTC Fines Twitter $150 Million For Using 2FA Phone Numbers For Ad Targeting"
This stuff happens ALL THE TIME. This is why I never give my cell number to ANY company. Screw them. They can either use Email or TOTP with a client of *MY* choice. For example, Redhat's open-source one (or the fork) that I know has no clue what device it is on or what phone number is associated with it (if it even has one, since you can even use a tablet).
https://en.wikipedia.org/wiki/... [wikipedia.org]
https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
FIDO2 is best. Use a hardware key. You can get an NFC reader for your computer so you don't even have to plug it in, just tap it on the reader. I attached mine to the underside of my desk. Some laptops have NFC built in too.
Really? (Score:2)
Does anybody actually think that any web site asking for a phone/cell phone number won't use this for nefarious purposes?
"Sign up for FREE weather/news alerts now! Just give us your toy mobile phone number! Spam awaaay!"
At this very moment... (Score:2)
Facebook needs to be next (Score:2)
For years I've avoided giving phone numbers to social media because I felt that initially, using that number for ads and marketing was EXACTLY why they wanted it.
Sure enough, I finally caved and added my phone number to Facebook for 2FA and I immediately started getting SMS updates from all possible sources in Facebook. I had to manually disable the alerts to stop it.
F-them. Make the fines hurt.
US fine vs EU fines (Score:4, Insightful)
When it comes to fines that businesses worry about it will always be the EU that comes out tops. The US fines always be a gentle slap, rather than anything meaningful.
No notification for users whose numbers were sold? (Score:4, Interesting)
The penalty here should be Twitter is barred from storing user phone numbers *and* has to notify every user whose number they sold with a message saying "We illegally sold your phone number to [list of third party data vendors]. Here's how you contact them to get your information removed from their lists." Hit them where it actually hurts: user goodwill.
Re: (Score:2)
Slap on the wrist... (Score:2)
The rule should be that if they did something illegally or against agreement, they will be fined 10-100 times more than the amount they made based on the accused activity. Sadly, the FTC, or the SEC or any other 3-letter government agency are just dogs with no teeth. The fine amount that barely scratches their pocket is just weak.