Path fined $800,000 by FTC

http://www.ftc.gov/opa/2013/02/path.shtm

by tzm • 13 years ago

177 50 13 years ago

dkulchenko• 13 years ago

Good. But why does Facebook get off scot-free? I feel like their contact-uploading behavior was even more egregious than Path's.

EDIT: I missed when originally reading the post that the fine was for violating COPPA, while the other provisions (privacy assessment every 2 years) are for their privacy violations.

cbhl• 13 years ago

Facebook doesn't allow account creation by under-13s, and is well aware of COPPA.

jnorthrop• 13 years ago

They don't. The FTC settled with Facebook in February of 2012 with similar terms.[1] Regardless, however you feel about Facebook, they do have robust privacy controls if users choose to learn them and are transparent about what they do with personal data. While they do quite a bit with users' data they do comply with current laws and regulations.

http://ftc.gov/opa/2012/08/facebook.shtm

fakeer• 13 years ago

Agreed.

If you really choose to control your Facebook privacy, you can do it but then the engagement experience becomes very limited. Facebook gives you controls but then it's given in a manner that it becomes a choice between use it or not use it.

niggler• 13 years ago

Can someone more familiar with COPPA give a summary of the requirements?

mvelie• 13 years ago

Simple answer: Don't get information from kids under 13 unless you have parents permission. You must also have a privacy policy.

Complex answer: How you determine if the person is under 13 and how you get the parents permission can be done a lot of different ways. Some of the most popular is doing a test charge against a credit card number, assuming kids won't have those.

citricsquid3• 13 years ago

wait wait wait, surely putting "You cannot use this website if you are under 13" in their terms of service is enough? I know COPPA is pretty ridiculous but if they require actual proactive enforcement of no under 13s they would literally break the internet.

I thought that there were 2 options with COPPA compliance: Allow <13s to register and have an email sent to their parents IF they select that they are under 13 OR disallow under 13s through a terms of service "Do not register if you are under 13" type clause. Is that not compliant?

codev2• 13 years ago

That isn't how it works. COPPA is pretty narrowly defined.

You only have to take action to get parent's permission if:

a) Your site or app is very specifically targeting children (LEGO or Disney for example)

b) You have asked for some information from the user that positively identifies them as a child - birthdate is the main one

Path were fined because they asked for birthdate during the signup process and then allowed registration even if the user was under 13.

droopybuns• 13 years ago

Is the simplest answer then to have a T.o.S. that states no one under 13 is allowed to use your product until you can afford staff charged with handling security & privacy?

Then you can CFAA those little twerps.

yefim323• 13 years ago

Despite how odd it is that they chose to specifically fine Path, I'm rather stunned to see the U.S. government even somewhat reacting to the startup culture.

deleted_account• 13 years ago

Path gained quite a bit of attention when this happened: https://www.google.com/search?q=path+upload+contacts

And the FTC policing COPPA isn't really new either: https://www.google.com/search?q=coppa+violation+cases

mehwoot• 13 years ago

I'm rather stunned to see the U.S. government even somewhat reacting to the startup culture.

Huh? Path is a company, they broke the law, and were investigated and fined as a result. How is that "stunning"? It happens all the time.

It's got almost nothing to do with "startup culture", it is just a business that didn't play by the rules.

ronilan• 13 years ago

> company, they broke the law, and were investigated and fined as a result. How is that "stunning"?

I believe the answer is somewhere in the question.

joseph_cooney• 13 years ago

Agree. When was first discussed here everyone was up-in-arms. Why is it now bad that the government is holding path accountable?

DannyBee2• 13 years ago

This is from february. The money is almost immaterial, the rest of the consent decree is interesting, since Path is now stuck doing stuff for 20 years. It can be found here:

http://www.ftc.gov/os/caselist/1223158/130201pathincdo.pdf

The real stuff starts on page 12

There are always little idiosyncrasies in these things, like, for example "Defendant shall provide the initial Assessment by overnight courier (not the U.S. Postal Service) to the Associate Director for Enforcement".

I'm not sure what triggered them to add that, but google searching '"not the U.S. Postal Service" ftc' pulls up a crap load of consent decrees.

anigbrowl• 13 years ago

People use the argument 'it's in the mail' as an excuse to temporize or avoid their obligations. Requiring overnight courier delivery creates a paper trail (via the tracking #) and also says 'we really mean it.'

chrischen• 13 years ago

But the USPS offers tracking as well...

DannyBee2• 13 years ago

USPS actually offers overnight express mail, and it's standard practice to courier this stuff anyway when dealing with agencies. My guess is that someone wasn't really trying to avoid obligations (consent decrees are immediately enforceable, there would be no trial, so this would be a bad move), but just messing with them by sending stuff worst class mail. In most jurisdictions, service by postal mail is effected on deposit, etc.

I'm not sure why you'd try to piss off the FTC though.

thors_hammer• 13 years ago

Why is this being posted now? (Thanks for pointing out the date.) Still news to me, but I don't understand why the new interest...

Me1000• 13 years ago

Path broke 10M users yesterday. It's likely someone was reading up on the company and found this...

Sidenote: after the address book debacle people are pretty quick to jump to conclusions about what the fine was really for though.

duey• 13 years ago

Curious, if Path is acquired does the purchaser also acquire the 20 year privacy assessment requirements? Does this make acquisition unlikely?

OGinparadise• 13 years ago

>>Curious, if Path is acquired does the purchaser also acquire the 20 year privacy assessment requirements?

Probably, or else Path2 made of the same investors could buy Path and get out of the agreement.

ars• 13 years ago

Path will probably just sell the tech, and the employees, and not the actual company. Corporations can do strange things like that.

new299• 13 years ago

Yep, quite possible. I guess they may also forget to reissue share options to non-execs in the process. ;)

fizx• 13 years ago

All of the big players have already gotten similar consent decrees. Twitter got one over a password leak. Google got one over Buzz. Microsoft got one over Passport/Wallet (though that has perhaps expired). Facebook got one over Beacon.

Everyone gets one sooner or later, it seems. It's a giant PITA, but everyone has the audit infrastructure in place by now, so I wouldn't expect it to matter too much.

hexis• 13 years ago

It's a convenient way to regulate an industry without having to pass any additional laws.

sidcool• 13 years ago

This is very unethical. None of these companies who blow the trumpet of innovation and user experience care about privacy. No one. Neither Google nor Facebook. I can count on Mozilla. But rest all are prowling for info to show us targeted ads. Period.

ameen• 13 years ago

The problems is the millennials aren't as focussed on privacy as the generations before. They're open to participating in targeted content whether it be ads, stories, offers, etc.

But this isn't to discredit privacy concerns at all. Google anonymizes its users so that individuals aren't identified. This is a better approach compared to other questionable "targeting methods".

rayiner• 13 years ago

I think it's overstated to say that millennials are properly perceiving the privacy issues in play and making a reasoned judgment to participate anyway. None of my friends (not millennials, but 20-somethings) really understand all the things Facebook allows themselves to do with your information via their ToS (and many of them are lawyers!) They just assume that it wouldn't be legal to do anything really egregious (which is how most people view most things, actually).

ldn_tech_exec12• 13 years ago

I'd rather see targeted ads than non-targeted ads

ldn_tech_exec12• 13 years ago

How does a startup with no revenue expect to pay an $800k debt?

Tyrannosaurs• 13 years ago

The same way it's paying for everything else - out of VC money.

hboon• 13 years ago

They might not (I don't know) have turned a profit, but they certainly have a revenue stream selling filters and stickers.

taigeair• 13 years ago

why were they collecting it anyways? to notify you if someone you knew joined?

tjbiddle• 13 years ago

Should this really have been posted now? It's from February and may cause confusion over the current kerfuffle on the front page.

Path fined $800,000 by FTC

Related Stories