8 ms·
Path fined $800,000 by FTC
- dkulchenko 13y agoGood. But why does Facebook get off scot-free? I feel like their contact-uploading behavior was even more egregious than Path's. EDIT: I missed when originally reading the post that the fine was for violating COPPA, while the other provisions (privacy assessment every 2 years) are for their privacy violations.
- cbhl 13y agoFacebook doesn't allow account creation by under-13s, and is well aware of COPPA.
- jnorthrop 13y agoThey don't. The FTC settled with Facebook in February of 2012 with similar terms.[1] Regardless, however you feel about Facebook, they do have robust privacy controls if users choose to learn them and are transparent about what they do with personal data. While they do quite a bit with users' data they do comply with current laws and regulations. http://ftc.gov/opa/2012/08/facebook.shtm http://ftc.gov/opa/2012/08/facebook.shtm
- fakeer 13y agoAgreed. If you really choose to control your Facebook privacy, you can do it but then the engagement experience becomes very limited. Facebook gives you controls but then it's given in a manner that it becomes a choice between use it or not use it.
- niggler 13y agoCan someone more familiar with COPPA give a summary of the requirements?
- mvelie 13y agoSimple answer: Don't get information from kids under 13 unless you have parents permission. You must also have a privacy policy. Complex answer: How you determine if the person is under 13 and how you get the parents permission can be done a lot of different ways. Some of the most popular is doing a test charge against a credit card number, assuming kids won't have those.
- citricsquid 13y agowait wait wait, surely putting "You cannot use this website if you are under 13" in their terms of service is enough? I know COPPA is pretty ridiculous but if they require actual proactive enforcement of no under 13s they would literally break the internet. I thought that there were 2 options with COPPA compliance: Allow <13s to register and have an email sent to their parents IF they select that they are under 13 OR disallow under 13s through a terms of service "Do not register if you are under 13" type clause. Is that not compliant?
- BoyWizard 13y agoI'm not an expert, but I imagine there's something in there about if you know people under 13 are using your product and they shouldn't be, you have to proactively do something about it. Facebook delete accounts belonging to minors, perhaps Path weren't and this played into it?
- Terretta 13y ago> wait wait wait, surely putting "You cannot use this website if you are under 13" in their terms of service is enough? Absolutely categorically not. A ToS clause alone has been tested and found not compliant. For a while, when the ToS clause was tested and failed, the panic reaction acid test was asking for a valid CC. Over the past decade best practice has relaxed to a gating page asking for confirmation of over age, or, for the more cautious, asking for the user to explicitly provide their birth year (not birthday).
- codev 13y agoThat isn't how it works. COPPA is pretty narrowly defined. You only have to take action to get parent's permission if: a) Your site or app is very specifically targeting children (LEGO or Disney for example) b) You have asked for some information from the user that positively identifies them as a child - birthdate is the main one Path were fined because they asked for birthdate during the signup process and then allowed registration even if the user was under 13.
- yefim323 13y agoDespite how odd it is that they chose to specifically fine Path, I'm rather stunned to see the U.S. government even somewhat reacting to the startup culture.
- deleted_account 13y agoPath gained quite a bit of attention when this happened: https://www.google.com/search?q=path+upload+contacts https://www.google.com/search?q=path+upload+contacts And the FTC policing COPPA isn't really new either: https://www.google.com/search?q=coppa+violation+cases https://www.google.com/search?q=coppa+violation+cases
- mehwoot 13y agoI'm rather stunned to see the U.S. government even somewhat reacting to the startup culture. Huh? Path is a company, they broke the law, and were investigated and fined as a result. How is that "stunning"? It happens all the time. It's got almost nothing to do with "startup culture", it is just a business that didn't play by the rules.
- joseph_cooney 13y agoAgree. When was first discussed here everyone was up-in-arms. Why is it now bad that the government is holding path accountable?
- ronilan 13y ago> company, they broke the law, and were investigated and fined as a result. How is that "stunning"? I believe the answer is somewhere in the question.
- DannyBee 13y agoThis is from february. The money is almost immaterial, the rest of the consent decree is interesting, since Path is now stuck doing stuff for 20 years. It can be found here: http://www.ftc.gov/os/caselist/1223158/130201pathincdo.pdf http://www.ftc.gov/os/caselist/1223158/130201pathincdo.pdf The real stuff starts on page 12 There are always little idiosyncrasies in these things, like, for example "Defendant shall provide the initial Assessment by overnight courier (not the U.S. Postal Service) to the Associate Director for Enforcement". I'm not sure what triggered them to add that, but google searching '"not the U.S. Postal Service" ftc' pulls up a crap load of consent decrees.
- thors_hammer 13y agoWhy is this being posted now? (Thanks for pointing out the date.) Still news to me, but I don't understand why the new interest...
- Me1000 13y agoPath broke 10M users yesterday. It's likely someone was reading up on the company and found this... Sidenote: after the address book debacle people are pretty quick to jump to conclusions about what the fine was really for though.
- anigbrowl 13y agoPeople use the argument 'it's in the mail' as an excuse to temporize or avoid their obligations. Requiring overnight courier delivery creates a paper trail (via the tracking #) and also says 'we really mean it.'
- chrischen 13y agoBut the USPS offers tracking as well...
- timjahn 13y agoHave you ever used it? Their tracking consists of a notification when the package has shipped and a notification when it is delivered. If you're wondering where your package is between those two, too bad. You just hope you get that delivery confirmation sometime this decade.
- duey 13y agoCurious, if Path is acquired does the purchaser also acquire the 20 year privacy assessment requirements? Does this make acquisition unlikely?
- OGinparadise 13y ago>>Curious, if Path is acquired does the purchaser also acquire the 20 year privacy assessment requirements? Probably, or else Path2 made of the same investors could buy Path and get out of the agreement.
- ars 13y agoPath will probably just sell the tech, and the employees, and not the actual company. Corporations can do strange things like that.
- new299 13y agoYep, quite possible. I guess they may also forget to reissue share options to non-execs in the process. ;)
- fizx 13y agoAll of the big players have already gotten similar consent decrees. Twitter got one over a password leak. Google got one over Buzz. Microsoft got one over Passport/Wallet (though that has perhaps expired). Facebook got one over Beacon. Everyone gets one sooner or later, it seems. It's a giant PITA, but everyone has the audit infrastructure in place by now, so I wouldn't expect it to matter too much.
- hexis 13y agoIt's a convenient way to regulate an industry without having to pass any additional laws.
- deleted 13y ago[deleted]
- sidcool 13y agoThis is very unethical. None of these companies who blow the trumpet of innovation and user experience care about privacy. No one. Neither Google nor Facebook. I can count on Mozilla. But rest all are prowling for info to show us targeted ads. Period.
- ameen 13y agoThe problems is the millennials aren't as focussed on privacy as the generations before. They're open to participating in targeted content whether it be ads, stories, offers, etc. But this isn't to discredit privacy concerns at all. Google anonymizes its users so that individuals aren't identified. This is a better approach compared to other questionable "targeting methods".
- rayiner 13y agoI think it's overstated to say that millennials are properly perceiving the privacy issues in play and making a reasoned judgment to participate anyway. None of my friends (not millennials, but 20-somethings) really understand all the things Facebook allows themselves to do with your information via their ToS (and many of them are lawyers!) They just assume that it wouldn't be legal to do anything really egregious (which is how most people view most things, actually).
- wes-exp 13y agoFurthermore, you can't point to a group consisting entirely of young people and just write off their behavior as "generational". A lot of youth behavior is simply driven by... youth. Youths are known to take greater risks even when fully informed of the potential consequences.
- ldn_tech_exec1 13y agoI'd rather see targeted ads than non-targeted ads
- ldn_tech_exec1 13y agoHow does a startup with no revenue expect to pay an $800k debt?
- Tyrannosaurs 13y agoThe same way it's paying for everything else - out of VC money.
- hboon 13y agoThey might not (I don't know) have turned a profit, but they certainly have a revenue stream selling filters and stickers.
- taigeair 13y agowhy were they collecting it anyways? to notify you if someone you knew joined?
- tjbiddle 13y agoShould this really have been posted now? It's from February and may cause confusion over the current kerfuffle on the front page.