Spokeo Hit With $800,000 Settlement On Allegations Of Haphazardly Marketing Personal Info To Employers

It’s one thing for your employer or potential employer to do a Google search on you, or scour through your public Facebook profile. It’s another for a company to market this information to employers and human resources departments for the express purpose of background screening. Doing so haphazardly could result in a violation of the Fair Credit Reporting Act.

This is the lesson being learned by Spokeo, which aggregates publicly available data info on consumers from social media networks and other sources — and which we first mentioned as a potential problem back in 2008 — and creates detailed profiles with information including name, address, age range, e-mail address, hobbies, ethnicity, religion, and photos.

Between 2008 and 2010, the Federal Trade Commission says Spokeo marketed a subscription service to human resources professionals, job recruiters, and others as an employment screening tool.

By doing so, Spokeo is alleged to have operated as a consumer reporting agency. However, the FTC claims that the company failed to provide three mandated protections of the FCRA:
1. To maintain reasonable procedures to verify who its users are and that the consumer report information would be used for a permissible purpose;
2. To ensure accuracy of consumer reports;
3. To provide a user notice to any person that purchased its consumer reports.

In 2010, the company changed its terms of service to state that Spokeo is not a consumer reporting agency and that the information on the site could not be used for purposes covered by the FCRA.

However, alleges the FTC complaint, “Spokeo failed to revoke access or to otherwise ensure that existing users, including subscribers who may have joined Spokeo through its Spokeo.com/HR page… did not use the company’s website or information for FCRA-covered purposes.”

In addition to the $800,000 civil penalty, the settlement order bars Spokeo from future violations of the FCRA (which is a bit redundant, as it should not be violating the law to begin with), and bars the company from making misrepresentations about its endorsements or failing to disclose a material connection with endorsers.

This is the first FTC case involving the sale of Internet and social media data in the employment screening context.

Comments

Edit Your Comment

  1. Blueskylaw says:

    Never, ever, ever, write things on the internet that you don’t want the world to see. Even if you think it is set to “private”, assume it is not (you can thank Facebook for that). Young people don’t realize that there are social site and data aggregators that archive EVERYTHING you write and pictures you post. Ten years from now when you graduate from college and go looking for a real job, your potential employer will contact one of these aggregators and show your potential employer all of your posts with spelling errors, pictures of you holding your guns while drinking from a bottle of Jack Daniel’s (while you’re still 17 years old), and all your other “youthful acts of indiscretion.” Employers love information like this because it allows them to narrow the pool of applicants even further and faster with a minimal amount of effort on their part.

    • incident_man says:

      That’s EXACTLY the reason why I don’t have a Facebook, Twitter or any other “social networking” account. What I do is MY business only.

    • highfructosepornsyrup says:

      It’s not just *you* though. Other people put stuff on the internet about you that you might not have any control over.

      • incident_man says:

        True enough, but I’m very selective about whom I share the details of my life with, and they KNOW I don’t want it posted for all to see. The consequences are the cessation of our friendship.

        Consequently, I’m not “friends” with many people. However, those who I am “friends” with are ones I can trust. Quality trumps quantity.

    • VintageLydia says:

      Obviously, many people are too free with the information they provide online–I certainly have been in the past. But these services, or even a simple Google search of someone’s name, can bring up false leads. People may post up pictures of you or talk about you without your knowledge and misrepresent you, they may post AS you, or people with similar or the same name as you may come up. Google my name and you come up with a Realtor in a nearby city and you have to sift through several pages before you find me. I’m just glad someone might mistake me for a professional rather than someone who doesn’t represent me or my values at all.

      Employers really shouldn’t use the information they find out about you online unless they are certain it is you and you posted what is found and any photos they find are not photoshopped to look compromising. Tall order, I know.

      • catastrophegirl chooses not to fly says:

        i had an ex make a fake myspace profile of me years ago after a bad breakup. fortunately it was just on myspace and he still didn’t use my real name. i tried to get it taken down but myspace wanted to fight over the proof so i gave up. he didn’t have most of the info right anyway. since then i’ve been encouraging the existence of fake and incorrect info about me because it threw a stalker off my trail. turned out to be very useful in the long run

    • samonela says:

      You imply that adults never do things like this?

  2. humphrmi says:

    A settlement is when both parties agree to terms. A judgement is when one party, usually the government, imposes a penalty or other terms. A party can not be “hit” with a settlement.

    Just sayin’. Also, expressed, not express.

    Yeah, I’m feeling IANAL today.

  3. Sarek says:

    I keep wondering if the other guy with my name’s Facebook picture showing him with a bong has kept me from getting jobs I’m qualified for. I don’t think these search companies are smart or diligent enough to make sure they get info on the correct guy.

  4. Shadowfire says:

    How about this: free access to my own report. I get yearly access to my credit reports (which is not enough, I should have free access any time I damn well choose), I should also have free access to any information a company stores and sells regarding my life.

    Pipe dream, I know. Just trying to look out for those of us getting fuc^H^H^H stal^H^H^H^H tracked by these companies.

    • Tim says:

      I believe reports covered under FCRA have that requirement. But if you simply put a disclaimer on your site saying it’s not a consumer report, you’re exempt.

      Spokeo, does, however, allow you to remove your report from their site. It’s in their FAQ.

      • RvLeshrac says:

        At which point they’ll report to employers that you requested removal from the database, which may actually be worse.

    • who? says:

      Spokeo is aggregating what’s publicly available on the internet. If you want to see what’s Spokeo has, google your email address.

      I had a Spokeo account for a short time, and ran reports on myself and all my family members. The only thing it found that I couldn’t have found from a fairly simple google search was it told me about accounts I’d created, but didn’t really remember, on a bunch of random websites, all the way back into the 90′s. I immediately spent a couple of hours closing accounts.

      My boss, however…name, age, income, pictures of his house. Creepy.

      • The Colonel says:

        I just did the google thing with my email address . . . first hit was a guy with the same name, aged 46 in New York (I’m 35 in Iowa). This of course is the problem with spokeo.

        • Shadowfire says:

          My e-mail only comes up once, with a message board hit from Hurricane Irene (when I was volunteering my services). So, it’s me, but… meh?

        • who? says:

          When I used spokeo, I found that someone in the Philipines uses a similar username as me on a bunch of Asian “hot chicks” dating sites. I figure if a potential employer can’t figure that out, then I probably don’t want to work there.

          But yes, Spokeo is like credit reports, only without any legal controls.

          Spokeo itself isn’t the real problem. The real problem is the lack of legal protections for our personal data. I’m much more worried about a company that’s selling data in bulk, filtered by some sort of demographic criteria, like income, or job type. The kind of data that Spokeo collects would be very valuable to criminals looking for a particular type of victim.

      • Martha Gail says:

        Hah! All of Spokeo’s information about me is wrong.

      • Parnassus says:

        How do you google an email address? It strips the @ so the results don’t seem very accurate to me.

  5. highfructosepornsyrup says:

    I’m going to start making up all sorts of awesome fake stuff about myself and put it all over the internet. It’ll save me the trouble of actually lying on my resume…

    • Quixiotic... Yea it's a typo (╯°□°)╯彡┻━┻ says:

      Ah the Lorenzo Von Matterhorn approach. I like it!

  6. Kimaroo - 100% Pure Natural Kitteh says:

    Spokeo’s info on me was ridiculously inaccurate. Stories like this tick me off because there’s no way to know if a potential employer is going to use services like this, and no way to verify that the information they receive is correct or not.

    Spokeo should not market themselves like this if they don’t verify their information.

    • HogwartsProfessor says:

      Exactly. I just found (and deleted) my stuff on there, and it had my current address as a place I lived over ten years ago!

    • madanthony says:

      same here. It’s got the address I lived at 10 years ago (with the wrong initial) and the one where I lived 6 years ago, but not the one I currently live at – even though I’ve lived there for 6 years, and own the house, and live in a state where real estate records can be accessed for free online from the state.

      I’m keeping the stale info up because I enjoy sewing confusion.

  7. trimetrov says:

    $800k…now THAT is a fine. This is the kind of hit-em-in-the-wallet punishment that exacts real change in companies, not piddling slaps on the wrist.

    I’m guessing Spokeo’s next move will be to hire some lobbyists.

  8. Jawaka says:

    $800,000 is nothing. Assuming that an average to low pay is $40,000 a year that means that they were held responsible for only 20 people who may not have gotten a job because of their service.

  9. britswim04 says:

    My wife and I use spokeo to check out Internet swinger hoookups. It’s fabulous at weeding out fakes and pic collectors.

    TMI?

  10. Nowaxz says:

    Everyone posting their thoughts here should realize that your comments may be linked back to you, too. If you think that’s crazy, I’ve read many news stories where they say something like, “the killer posted a comment on the KKK blog…” I was curious, so I did a little research. Blog posts can be easily traced back to the people that have posted them, if you use the same name or email for more than one site (and that site isn’t very careful about leaking or deliberately leaks information to data companies) you’ve just made a bread-trail for a data aggregator that right back to you.

    • HogwartsProfessor says:

      I do not care. If I were worried about stating my opinion, I would never even talk. If someone didn’t hire me because I support gay rights, or because I said I thought politicians were dickholes, then fine, I don’t want to work for you anyway. I wouldn’t have two blogs and I wouldn’t have Facebook either. Nor would I bother writing books that contain curse words, sex scenes and a few zaps at organized religious nutbrains.

    • who? says:

      And ^this^ is *exactly* what Spokeo truly shines at.

  11. evilpete says:

    I bought a 3 month subscription for spokeo and got slammed with a 15 dollar the the month credit monitoring service builded to my card, it took many hours on the phone to get the charges reversed