[{"url":"https://www.ftc.gov/business-guidance/blog/2019/06/data-security-settlement-service-provider-includes-updated-order-provisions","titre":"Data security settlement with service provider includes updated order provisions","pubDate":"Tue, 06 Oct 2026 08:06:23 +0200","description":"Data security settlement with service provider includes updated order provisions lfair June 12, 2019 | 11:39AM Data security settlement with service provider includes updated order provisions By Lesley Fair The domino principle. The ripple effect. The butterfly phenomenon. Apply the analogy of your choice to describe what happens when one software developer ’s allegedly lax security practices result in the breach of confidential customer information maintained by multiple businesses that use the software. If your business is a service provider – or if your company uses third-party service providers to help manage your data – a proposed FTC settlement merit s your attention. One notable aspect of the case: a proposed order that includes new data security requirements reflecting the current Commission priority of updating its data security orders. Many third-party service providers sell industry-specific data management software to consumer-facing businesses. One example is DealerBuilt, software for auto dealers developed by LightYear Dealer Technologies. DealerBuilt is a big name in the business, numbering some of the largest dealerships in the country as clients. Dealerships that license DealerBuilt’s software collect and maintain large amounts of sensitive financial, payroll, accounting, and other information about consumers and employees. Dealers who use the software can have DealerBuilt host their data or they can host it on their own servers. Businesses that choose the second option regularly back up their databases onto DealerBuilt’s network. Before getting to the inevitable information uh-oh that led to law enforcement action, let’s hit pause to consider some of DealerBuilt’s practices during the time relevant to the FTC’s proposed administrative complaint . According to the FTC: DealerBuilt stored information in clear text, without any access controls or authentication protections like passwords or tokens. Data transmitted between dealerships and DealerBuilt’s backup database was in clear text, too. DealerBuilt didn’t have a written information security policy in place. DealerBuilt didn’t provide reasonable data security training for employees or contractors. DealerBuilt didn’t assess risks to the sensitive data on its network by conducting periodic risk assessments or performing vulnerability and penetration testing. DealerBuilt didn’t use readily available security measures to monitor – among other things – unauthorized attempts to transfer sensitive information . DealerBuilt didn’t put reasonable data access controls in place – for example, systems to limit inbound connections to known IP addresses or require authentication to access backup databases. DealerBuilt didn’t have a reasonable process to select, install, and secure devices with access to personal information. Against that backdrop of alleged security failures, what happened next shouldn’t come as a surprise. To increase available backup storage, a DealerBuilt employee bought a storage device and installed it on the company’s network in April 2015. According to the FTC, DealerBuilt management didn’t take steps to ensure the device was set up securely. Had someone checked, they would have learned the device created an open connection port that allowed transfers of information. Fast forward to late October 2016 when a hacker “walked through” that open port to gain unauthorized access to DealerBuilt’s backup database, including the unencrypted personal information of more than 12 million consumers that 130 of its client dealerships had stored with the company. The hacker attacked the system multiples times, downloading the personal information of 69,283 consumers and the entire backup directories of five dealerships. And that’s not all because for a substantial period of time, DealerBuilt’s insecure settings were indexed on a public website hackers use to locate insecure connected devices. What was","id":3199072,"source":"FTC USA Business Blog Posts"},{"source":"Federal Trade Commission - Protecting America's Consumers","id":2899689,"description":"The Federal Trade Commission will require Cox Media Group (CMG) and two smaller marketing firms to pay a total of $930,000 to settle allegations they deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers’ smart devices and that consumers had opted into such targeting. In three separate complaints, the FTC alleged that Georgia-based media and marketing company CMG Media Corporation, which does business as Cox Media Group , and two marketing firms it worked with, New Hampshire-based MindSift LLC and Wisconsin-based 1010 Digital Works LLC , deceived customers by claiming they used a special algorithm to listen in on and detect pertinent conversations from smart devices in order to target ads to consumers within a specific geographic region. Contrary to these companies’ claims, however, the marketing service wasn’t based on voice data and consumers hadn’t opted into this service. “Not only did the product these companies marketed not do what they claimed it did, but they also misled potential customers by claiming consumers had opted into this service when it’s clear they did not,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It is a basic rule of business that you need to be honest with your customers, and these companies failed to do that.” CMG, MindSift and 1010 Digital Works claimed their “Active Listening” branded marketing service listened in on consumers’ conversations overheard by smart devices, in real time, to target advertising, according to the complaints. The three companies claimed the Active Listening service would allow small businesses to advertise to consumers in the small businesses’ desired locations. According to the complaints, this service did not, in fact, listen in on consumers’ conversations or use voice data at all—nor did the service accurately place ads in customers’ desired locations. Instead, the service the companies provided consisted of reselling—at a significant markup—email lists obtained from other data brokers. The FTC also alleged that all three companies deceived potential customers by claiming that consumers had opted into the Active Listening service. The company, however, did not seek or obtain consumers’ consent, according to the complaints. Instead, the companies claimed that consumers had “opted in” by agreeing to the terms of service that people have to accept when downloading and using apps. Clicking through mandatory terms of service does not constitute “opt-in consent” for such an invasive service or for use of consumers’ voice data from inside their homes. If the Active Listening service had functioned as advertised, this collection and use of consumers’ voice data without adequate consent would itself violate Section 5 of the FTC Act. The FTC alleged that these practices violated the FTC Act. The FTC also charged MindSift and 1010 Digital Works with a second count of violating the FTC Act by providing CMG with the “means and instrumentalities” to deceive customers through marketing materials, sales pitches and responses to customer questions that misled small businesses about the capabilities of the Active Listening service. Under the proposed orders settling the FTC’s allegations, CMG must pay $880,000 while both MindSift and 1010 Digital Works will each pay $25,000, which will be used to provide redress to CMG customers impacted by these practices. In addition, each defendant will be prohibited from making any misrepresentation about: the qualities or features of its advertising or marketing services; the collection and use of voice data and whether consumers have provided their consent to collect, use or disclose their voice data; and the geographic targeting capabilities of its advertising or marketing services. The Commission voted 2-0 to issue the proposed","pubDate":"Fri, 22 May 2026 08:06:49 +0200","url":"https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-require-cox-media-group-two-other-firms-pay-nearly-1-million-settle-charges-they-deceived","titre":"FTC to Require Cox Media Group, Two Other Firms to Pay Nearly $1 Million to Settle Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service"},{"titre":"FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data to Settle Charges They Sold Location Data Linked to Millions of Mobile Devices","url":"https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data","pubDate":"Tue, 05 May 2026 08:04:47 +0200","source":"Federal Trade Commission - Protecting America's Consumers","description":"The Federal Trade Commission will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumers’ affirmative express consent to settle allegations the companies sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals.    The FTC  sued Idaho-based Kochava in August 2022 alleging that its collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship. The FTC alleged that because consumers were unaware of and did not consent to this data sharing, consumers had no way of avoiding the harm resulting from its collection and disclosure. Under the proposed order resolving the FTC’s litigation, Kochava and its subsidiary,  Collective Data Solutions (CDS), which has taken over Kochava’s data broker business, will be prohibited from selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer. The subsidiary and Kochava (if Kochava sells or uses precise location data) also are required to: Establish and implement a sensitive location data program to develop a comprehensive list of sensitive locations to prevent the sale, transfer or disclosure of sensitive location data; Implement a supplier assessment program designed to confirm that consumers have provided consent for the collection and use of all location data obtained by the subsidiary or Kochava; Submit incident reports to the FTC when the companies determine a third party shared consumers’ precise location data in violation of contractual requirements; Allow consumers to request the names of any business or individual to which CDS or Kochava has knowledge that consumers’ precise location data was sold, and provide consumers with an easy way to withdraw consent for the sale of their device’s precise location data; and Create a data retention schedule that will require the deletion of data on an established timeframe. The Commission vote approving the stipulated final order was 2-0. The FTC filed the proposed order   in the U.S. District Court for the District of Idaho. NOTE:  Stipulated final orders have the force of law when approved and signed by the District Court judge. The lead attorneys on this matter are Jennifer Rimm, Erik Jones, Mike Sherling, Elizabeth C. Scott, and Julia Horwitz in the FTC’s Bureau of Consumer","id":2865224},{"id":2577895,"description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer","source":"Federal Trade Commission - Protecting America's Consumers","pubDate":"Wed, 17 Dec 2025 09:50:37 +0100","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program","titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program"}]