Twitter Fined $150m For Selling User Data

Just 6 months ago, in Europe, Twitter was fined £400k for breaking the EU’s GDPR data privacy rules in 20121. Now, the US regulatory authorities fined Twitter $150 million (£119 million) for misusing users’ data in order to help sell targeted ads.

Twitter has been collecting users’ email addresses and phone numbers and then in addition to using phone numbers and email addresses for security, Twitter also used the information to serve users targeted ads, which earned the firm millions of dollars.

The Federal Trade Commission (FTC) and the Department of Justice (DOJ) say Twitter violated an agreement it had with regulators when the firm secretly exploited the personal data users handed over for security reasons. While Twitter had promised the regulators that it would not give personal information like phone numbers and email addresses to advertisers, the FTC say the social media company broke those rules.

The FTC is an independent agency of the US government whose mission is the enforcement of anti-trust law and the promotion of consumer protection. It accused Twitter of breaching a 2011 FTC order that explicitly prohibited the company from misrepresenting its privacy and security practices. “While Twitter represented to users that it collected their telephone numbers and email addresses to secure their accounts, Twitter failed to disclose that it also used user contact information to aid advertisers in reaching their preferred audiences,” said a court complaint filed by the DoJ.

Twitter generates most of its revenue from advertising on its platform, which allows users ranging from consumers to celebrities to corporations to post 280-character messages, or tweets. Twitter makes 90% of its annual revenue of $5bn (£3.8bn) from advertising.

According to a complaint filed by the Department of Justice on behalf of the FTC, Twitter in 2013 began asking users to provide either a phone number or email address to improve account security. “Twitter obtained data from users on the pretext of harnessing it for security purposes but then ended up also using the data to target users with ads.” FTC chair, Lina Khan observed. “This practice affected more than 140 million users while boosting Twitter’s primary source of revenue… Twitter obtained data from users on the pretext of harnessing it for security purposes, but then ended up also using the data to target users with ads”.

To authenticate an account, Twitter requires people to provide a telephone number and email address.
That information also helps people reset their passwords and unlock their accounts if required, as well as for enabling two-factor authentication. Two-factor authentication provides an extra layer of security by sending a code to either a phone number or email address to help users log into Twitter along with a username and password.

According to the FTC, until at least September 2019, Twitter was also using that information to boost its advertising business.

It is accused of allowing advertisers access to users’ security information. In addition to the fine, Twitter must also:

Prohibit using the phone numbers and email addresses it illegally collected.
Tell users about its improper use of security information.
Explain to users about the FTC law enforcement action.
Tell how to turn off personalised adverts and review multi-factor authentication settings.
Provide multi-factor authentication options that do not need a phone number.
Implement an enhanced privacy and security programme which includes reporting incidents to the FTC within 30 days.

“The $150m penalty reflects the seriousness of the allegations against Twitter, and the substantial new compliance measures to be imposed as a result of the proposed settlement will help prevent further misleading tactics that threaten users’ privacy…. “The Department of Justice is committed to protecting the privacy of consumers’ sensitive data,” said Vanita Gupta, the US associate attorney general.

Twitter’s settlement follows years of controversy over the privacy practices of social media and technology companies.

In 2018 it was disclosed that Facebook, the world’s biggest social network, was using phone numbers provided for two-factor authentication to serve ads enraged privacy advocates. Facebook, now called Meta, similarly settled with the FTC over the issue as part of a $5bn agreement reached in 2019.

Elon Musk, who has an agreement to buy Twitter for $44b has slammed its advertising based business model and has promised to diversify its income streams. “If Twitter was not truthful here, what else is not true? This is very concerning news,” he said in a recent tweet.