“This settlement demonstrates the Commission’s commitment to enforcing the orders it has in place against companies, including orders requiring reasonable security for consumer data,” said FTC Chairwoman Edith Ramirez in a statement. “The fact that consumers paid Lifelock for help in protecting their sensitive personal information makes the charges in this case particularly troubling.”
LifeLock had previously settled with the FTC and 35 state attorneys general in 2010, paying $12 million for not securing customer information and for making "false claims." At the time, it signed an agreement saying it would change its behavior in the future. This July, the FTC announced it would file a complaint against the company for violating that order.
According to the FTC, LifeLock violated several terms of its previous agreement. First, the agency said, its security system was not up to the task of protecting users' sensitive personal information, including Social Security numbers, credit card information and bank account numbers. Second, the complaint said that LifeLock falsely advertised that its systems were protected using the same technology as financial institutions.
The agency added that LifeLock also made false claims about an alert feature that promised to let customers know immediately if they may be a victim of identity theft. Finally, the complaint also says that LifeLock did not abide by the record-keeping agreements it said it would in the 2010 order.
Commissioner Maureen Ohlhausen, a Republican, was the dissenting voice in the 3-1 decision from the FTC, saying that she does not believe there’s clear evidence that LifeLock violated the 2010 order, saying that the company had third-party certification of its security systems.
In the court filing, LifeLock did not admit or deny those charges. In a statement, the company said, “The FTC’s approval is a key component of a comprehensive settlement designed to enable LifeLock to move forward with a singular focus on protecting our members from threats to their identity. Our members are our highest priority and we are gratified by their confidence in us, reflected in the performance and continued growth of our business.
LifeLock’s customers should know that their information was “never at risk,” said David Boies, the chairman of Boies, Schiller & Flexner, who represents LifeLock. “There was never a breach. There has never been any claim that data was breached,” he said.
He also said that the advertisements the FTC noted in its complaint are no longer being used. “LifeLock is not required to change any current products or practices,” he said, adding that the company is pleased that the class action suit and FTC action have been resolved in this global settlement.
Lifelock's stock dipped following the FTC’s official announcement, falling about two percent to $13.99 a share in regular trading. When the FTC's order was announced in July, the shares lost about half their value in a day, plummeting to just above $8 a share.