The US FTC has caught two companies improperly using consumer data. You can get away with a settlement with no penalty. The US app Flo, which calculates menstruation and ovulation dates, had promised to protect all data entered. The operating company Flo Health is said to have secretly passed the data on to Facebook, Google, AppsFlyer and Flurry – for advertising and analysis purposes, says the FTC.

The company Everalbum offered the storage of private photos and videos in the cloud under the name Ever. In February 2017 Ever activated face recognition. At that time, Ever introduced a “Friends” feature, with which it automatically compiles photos into image collections based on facial recognition. From September of the same year, Everalbum used photos saved by its customers to develop their own face recognition algorithms.

Secretly exploited private recordings The affected customers knew nothing about it. On the contrary, from July 2018 to April 2019 Ever even claimed that no facial recognition would run on customer images without explicit consent. In fact, however, face recognition should have run automatically over all files. From May 2018 customers in the EU and three US states had the option to switch off face recognition.

The algorithms trained on the basis of customer data formed the basis for Everalbum’s face recognition service “Paravision”. E is now marketed as “Number 1 in the US; UK and Europe” (sic), particularly to large corporations. Everalbum admits to having used the data without consent, but does not want to have revealed any pictures or customer names to its Paravision customers. Everalbum discontinued its cloud storage service Ever last summer.

To make matters worse, Ever allegedly claimed to delete all photos and videos when customers delete their accounts. The FTC accuses the company of keeping all photos and videos of former customers at least until October 2018.

Flo Disclosed Pregnancies Flo has disclosed sensitive personal information, including the fact of pregnancies, according to the FTC. At the same time, Flo is said to have refrained from imposing conditions on the recipients of this data about their further use. Because users in the EU and Switzerland are also affected, Flo has also violated the Privacy Shield, which has now been repealed, and the Swiss-US Privacy Shield.

Knowledge about pregnancy is valuable for advertisers. You can offer pregnant women and their partners a variety of products and services with hefty margins. Above all, however, pregnancies and the following baby phase are one of the few occasions when consumers are particularly receptive to switching to high-margin branded products.

Comparison with the FTC Both companies have negotiated a settlement with the FTC. Flo should undertake not to lie to his customers about data protection and to inform those already affected about the data protection breach. In addition, Flo should instruct his business partners to delete all health data of Flo users.

Everalbum should delete the facial data extracted from the customer data and also all algorithms trained with it. At the same time, Everalbum should now really delete the files uploaded by former customers. The company also undertakes not to lie to customers about the use of their data. And should Everalbum ever be active in the consumer market again, it must obtain express consent before it collects biometric data.

Should the comparisons become final, violations could result in fines of up to 43. 280 US dollars per violation (approximately 35, 500 Euro). The FTC cannot impose penalties under US law for initial violations. First of all, the FTC will give everyone days to comment on the draft settlement.

Draft settlement with Flo Health, Inc., Az. 1923133 Draft comparison with Everalbum, Inc. , Az. 1923172 (ds)