Twitter to pay $150 million fine for allegedly collecting and selling users’ personal data

Twitter will pay a $150 million penalty and put in new safeguards to settle federal regulators’ allegations that the social platform failed to protect the privacy of users’ data over a six-year span.

Twitter was found to be in violation of a 2011 privacy settlement with the Federal Trade Commission.

“This practice affected more than 140 million Twitter users, while boosting Twitter’s primary source of revenue,” FTC Chair Lina Khan said in a statement.

Twitter, until at least September 2019, was also using that information to boost its advertising business by allowing advertisers access to users’ phone numbers and email addresses. That ran afoul of the agreement the company had with regulators.

“If you’re telling people you’re using their phone numbers to secure their accounts, and then you use them for other purposes, you’re deceiving them and breaking the law,” said Sam Levine, who leads the FTC’s Bureau of Consumer Protection, in an interview with NPR.

The FTC and the Department of Justice (DOJ) claimed that Twitter told its users that it was collecting their telephone numbers and email addresses for account-security purposes, yet had failed to disclose that it also would use that information to help companies send targeted advertisements to consumers.

“The Department of Justice is committed to protecting the privacy of consumers’ sensitive data,” said Associate Attorney General Vanita Gupta, also in a statement on Wednesday. “The $150 million penalty reflects the seriousness of the allegations against Twitter, and the substantial new compliance measures to be imposed as a result of today’s proposed settlement will help prevent further misleading tactics that threaten users’ privacy.”

Twitter agreed to settle the government’s allegations by paying the $150 million civil penalty. It also agreed to implement significant new compliance measures that are intended to ensure that the platform improves its data privacy practices.

Among those measures, Twitter will be required to develop and maintain a detailed privacy and information-security program, carry-out a privacy review with a written report prior to implementing any new product or service that collects users’ private information, and conduct regular testing of its data privacy safeguards, the DOJ confirmed.