Snapchat, Inc.; Analysis of Proposed Consent Order to Aid Public Comment, 27611-27613 [2014-11111]
Agencies
[Federal Register Volume 79, Number 93 (Wednesday, May 14, 2014)] [Notices] [Pages 27611-27613] From the Federal Register Online via the Government Printing Office [www.gpo.gov] [FR Doc No: 2014-11111] ======================================================================= ----------------------------------------------------------------------- FEDERAL TRADE COMMISSION [File No. 132 3078] Snapchat, Inc.; Analysis of Proposed Consent Order to Aid Public Comment AGENCY: Federal Trade Commission. ACTION: Proposed consent agreement. ----------------------------------------------------------------------- SUMMARY: The consent agreement in this matter settles alleged violations of federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the draft complaint and the terms of the consent order--embodied in the consent agreement-- that would settle these allegations. DATES: Comments must be received on or before June 9, 2014. ADDRESSES: Interested parties may file a comment at https://ftcpublic.commentworks.com/ftc/snapchatconsent online or on paper, by following the instructions in the Request for Comment part of the SUPPLEMENTARY INFORMATION section below. Write ``Snapchat, Inc.-- Consent Agreement; File No. 132 3078'' on your comment and file your comment online at https://ftcpublic.commentworks.com/ftc/snapchatconsent by following the instructions on the web-based form. If you prefer to file your comment on paper, mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW., Suite CC-5610, (Annex D), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW., 5th Floor, Suite 5610, (Annex D), Washington, DC 20024. FOR FURTHER INFORMATION CONTACT: Allison M. Lefrak, Bureau of Consumer Protection, (202-326-2804), 600 Pennsylvania Avenue NW., Washington, DC 20580. SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule 2.34, 16 CFR 2.34, notice is hereby given that the above-captioned consent agreement containing consent order to cease and desist, having been filed with and accepted, subject to final approval, by the Commission, has been placed on the public record for a period of thirty (30) days. The following Analysis to Aid Public Comment describes the terms of the consent agreement, and the allegations in the complaint. An electronic copy of the full text of the consent agreement package can be obtained from the FTC Home Page (for May 8, 2014), on the World Wide Web, at https://www.ftc.gov/os/actions.shtm. You can file a comment online or on paper. For the Commission to consider your comment, we must receive it on or before June 9, 2014. Write ``Snapchat, Inc.--Consent Agreement; File No. 132 3078'' on your comment. Your comment--including your name and your state--will be placed on the public record of this proceeding, including, to the extent practicable, on the public Commission Web site, at https://www.ftc.gov/os/publiccomments.shtm. As a matter of discretion, the Commission tries to remove individuals' home contact information from comments before placing them on the Commission Web site. Because your comment will be made public, you are solely responsible for making sure that your comment does not include any sensitive personal information, like anyone's Social Security number, date of birth, driver's license number or other state identification number or foreign country equivalent, passport number, financial account number, or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, like medical records or other individually identifiable health information. In addition, do not include any ``[t]rade secret or any commercial or financial information which . . . is privileged or confidential,'' as discussed in Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2). In particular, do not include competitively sensitive information such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names. If you want the Commission to give your comment confidential treatment, you must file it in paper form, with a request for confidential treatment, and you have to follow the procedure explained in FTC Rule 4.9(c), 16 CFR 4.9(c).\1\ Your comment will be kept confidential only if the FTC General Counsel, in his or her sole discretion, grants your request in accordance with the law and the public interest. --------------------------------------------------------------------------- \1\ In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request, and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c), 16 CFR 4.9(c). --------------------------------------------------------------------------- Postal mail addressed to the Commission is subject to delay due to heightened security screening. As a result, we encourage you to submit your comments online. To make sure that the [[Page 27612]] Commission considers your online comment, you must file it at https://ftcpublic.commentworks.com/ftc/snapchatconsent by following the instructions on the web-based form. If this Notice appears at https://www.regulations.gov/#!home, you also may file a comment through that Web site. If you file your comment on paper, write ``Snapchat, Inc.--Consent Agreement; File No. 132 3078'' on your comment and on the envelope, and mail your comment to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610, (Annex D), Washington, DC 20580, or deliver your comment to the following address: Federal Trade Commission, Office of the Secretary, Constitution Center, 400 7th Street SW., 5th Floor, Suite 5610, (Annex D), Washington, DC 20024. If possible, submit your paper comment to the Commission by courier or overnight service. Visit the Commission Web site at https://www.ftc.gov to read this Notice and the news release describing it. The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before June 9, 2014. You can find more information, including routine uses permitted by the Privacy Act, in the Commission's privacy policy, at https://www.ftc.gov/ftc/privacy.htm. Analysis of Proposed Consent Order To Aid Public Comment The Federal Trade Commission has accepted, subject to final approval, a consent order applicable to Snapchat, Inc. (``Snapchat''). The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement's proposed order. Snapchat provides a mobile application that allows consumers to send and receive photo and video messages known as ``snaps.'' Both the iTunes App Store and the Google Play store list Snapchat among the top 15 free applications. As of September 2013, users transmitted more than 350 million snaps daily. Before sending a snap, the application requires the sender to designate a period of time that the recipient will be allowed to view the snap, up to ten seconds. Snapchat markets the application as an ``ephemeral'' messaging application, and claimed that once the timer expires, the snap ``disappears forever.'' Snapchat represented, for a certain period, on its product description page on the iTunes App Store and Google Play and on the ``FAQ'' page on its Web site that snaps disappear when the timer expires. Snapchat further claimed that if a recipient took a screenshot of a snap, the sender would be notified. Snapchat also provides its users with a feature to find friends on the service, and prompts users during registration to enter their mobile telephone number in order to find friends. Count 1 of the Commission's complaint alleges that Snapchat misrepresented that when sending a message though its application, the message would disappear forever after the user-set time period expires. Count 2 of the complaint alleges that Snapchat misrepresented that the sender will be notified if the recipient takes a screenshot of a snap. The complaint alleges that several methods exist by which a recipient can use tools outside of the application to save snaps, allowing the recipient to view them indefinitely. Additionally, the complaint alleges that widely publicized methods existed by which recipients could easily circumvent Snapchat's screenshot detection mechanism and capture a screenshot of a snap without the sender being notified. Count 3 of the complaint alleges that Snapchat misrepresented in its privacy policy that it does not access location-specific information from consumers' mobile devices. Contrary to this representation, the complaint alleges that for a certain period, the Snapchat application on Android transmitted Wi-Fi based and cell-based location information from user's mobile devices to an analytics tracking provider. Count 4 of the complaint alleges that Snapchat misrepresented, for a certain period, in its user interface that a user's mobile phone number was the only personal information that Snapchat collected in order to find the user's friends. Count 5 of the complaint alleges that Snapchat misrepresented in its privacy policy that it collected only the user's email, phone number, and Facebook ID for the purpose of finding friends. However, the complaint alleges that when the user chose to find friends, Snapchat collected not only the user's phone number, but also, without informing the user, the names and phones numbers of all the contacts in the user's mobile device address book. Finally, Count 6 of the complaint alleges that Snapchat misrepresented that it employed reasonable security measures in the design of its find friends feature. Specifically, the complaint alleges that for a certain period of time, Snapchat failed to verify that the phone number that an iOS user entered into the application did, in fact, belong to the mobile device being used by that individual. Due to this failure, an individual could create an account using a phone number that belonged to another consumer, enabling the individual to send and receive snaps associated with another consumer's phone number. Additionally, for a certain period, Snapchat allegedly failed to implement effective restrictions on the number of find friends requests that any one account could make. Further, Snapchat allegedly failed to implement any restrictions on serial and automated account creation. As a result of these security failures, in December 2013, attackers were able to use multiple accounts to send millions of find friends requests and compile a database of 4.6 million Snapchat usernames and the associated phone numbers. The proposed order contains provisions designed to prevent Snapchat from engaging in the future in practices similar to those alleged in the complaint. Part I of the proposed order prohibits Snapchat from misrepresenting the extent to which Snapchat or its products or services protect the privacy, security, or confidentiality of covered information, including: (1) The extent to which a message is deleted after being viewed by the recipient; (2) the extent to which Snapchat or its products or services are capable of detecting or notifying the sender when a recipient has captured a screenshot of, or otherwise saved, a message; (3) the categories of covered information collected; or (4) the steps taken to protect against misuse or unauthorized disclosure of covered information. Part II of the proposed order requires Snapchat to establish and maintain a comprehensive privacy program that is reasonably designed to: (1) Address privacy risks related to the development and management of new and existing products and services for consumers, and (2) protect the privacy and confidentiality of covered information, whether collected by Snapchat or input into, stored on, captured with, or accessed through a computer using Snapchat's products or services. The privacy program must contain privacy [[Page 27613]] controls and procedures appropriate to Snapchat's size and complexity, the nature and scope of Snapchat's activities, and the sensitivity of the covered information. Specifically, the proposed order requires Snapchat to:Designate an employee or employees to coordinate and be accountable for the privacy program; identify material internal and external risks that could result in Snapchat's unauthorized collection, use, or disclosure of covered information, and asses the sufficiency of any safeguards in place to control these risks; design and implement reasonable privacy controls and procedures to address the risks identified through the privacy risk assessment, and regularly test or monitor the effectiveness of the privacy controls, and procedures; develop and use reasonable steps to select and retain service providers capable of maintaining security practices consistent with the order, and require service providers by contract to implement and maintain appropriate safeguards; and evaluate and adjust its privacy program in light of the results of testing and monitoring, any material changes to operations or business arrangement, or any other circumstances that Snapchat knows or has reason to know may have a material impact on its privacy program. Part III of the proposed order requires Snapchat to obtain within the first one hundred eighty (180) days after service of the order, and on a biennial basis thereafter for a period of twenty (20) years, an assessment and report from a qualified, objective, independent third- party professional, certifying, among other things, that: (1) It has in place a privacy program that provides protections that meet or exceed the protections required by Part II of the proposed order; and (2) its privacy program is operating with sufficient effectiveness to provide reasonable assurance to protect the privacy of covered information. Parts IV through VIII of the proposed order are reporting and compliance provisions. Part IV requires Snapchat to retain documents relating to its compliance with the order. The order requires that all of the documents be retained for a five-year period. Part V requires dissemination of the order now and in the future to all current and future principals, officers, directors, and managers, and to persons with responsibilities relating to the subject matter of the order. Part VI ensures notification to the FTC of changes in corporate status. Part VII mandates that Snapchat submit a compliance report to the FTC within 60 days, and periodically thereafter as requested. Part VIII is a provision ``sunsetting'' the order after twenty (20) years, with certain exceptions. The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed complaint or order or to modify the order's terms in any way. By direction of the Commission. Donald S. Clark, Secretary. [FR Doc. 2014-11111 Filed 5-13-14; 8:45 am] BILLING CODE 6750-01-P
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
