Messaging app Snapchat promised users that the photos and videos they send disappear forever seconds after they're opened. But security and privacy advocates have repeatedly reported that that's not always true.
On Thursday, the Federal Trade Commission announced that the smartphone app maker has agreed to settle charges alleging that the company had deceived consumers with assurances about the "disappearing nature" of messages sent through the service and other data collection and security practices.
The FTC complaint laid out several ways that photo "snaps" sent through the application could be saved without the users' knowledge. For example, some third-party apps could be used to capture messages sent through the service, the FTC said, and video messages remained accessible to recipients who connected their smartphone to a computer.
The FTC also alleged that the app collected data from users without their consent or knowledge -- including geolocation information from those using the Android version of the app and contacts from the address books of those using the Apple iOS version.
Additionally, the complaint alleged that Snapchat failed to properly secure it's "Find Friends" feature -- resulting in the widely reported security breach that allowed attackers to compile a database of 4.6 million Snapchat usernames and phone numbers. Snapchat later released an update that fixed the issue and let users to opt out of the feature.
Under the terms of its settlement, Snapchat will not be fined. But the app maker will be prohibited from misrepresenting the privacy, security or confidentiality of user data within the app and be required to implement a comprehensive privacy program to be monitored by an independent party over the next 20 years. If Snapchat violates the settlement in the future, it could face financial penalties.
Although the consent decree did not require Snapchat to admit fault, the app maker acknowledged in a statement to The Washington Post that it had made mistakes. "While we were focused on building, some things didn’t get the attention they could have," Snapchat said in the statement, noting that it should have been "more precise" in how it communicated with users.
But the company also insisted that it had resolved many of the issues in the complaint before the settlement was announced and that it is "devoted to promoting user privacy and giving Snapchatters control over how and with whom they communicate."
A recent update to Snapchat added new capabilities, including text messaging and video conferencing. The text messaging feature will allow recipients to save exchanges without notifying the sender -- a significant departure from the supposedly disappearing picture messages that drove the app's initial growth.
Update: Julia Horwitz, Consumer Protection Counsel at the Electronic Privacy Information Center which originally complained to the FTC about Snapchat, told the Post it was happy with the resolution. "We're extremely pleased that the FTC is taking its data privacy protection seriously and is recognizing behaviors by companies like Snapchat that breach promises to consumers," she said. "This was a real success."
"But this consent order's true effectiveness depends upon the agency's consistent enforcement over the next 20 years," she cautioned.