FTC doesn’t fine OkCupid for sharing users’ personal data

The Federal Trade Commission (FTC) is taking action against OkCupid and Match Group Americas (both owned by Match Group, Inc.), following OkCupid’s alleged sharing of user data. But the agency is not fining the popular dating app.

The FTC alleged that OkCupid disclosed the personal information of nearly 3 million users, including their photos and locations, to an unauthorized third party, AI company Clarifai.

According to the FTC complaint, in September 2014, Clarifai requested large datasets of OkCupid photos from Humor Rainbow, the former owner of OkCupid and current subsidiary of Match Group Inc.. There was no business relationship with Clarifai and Humor Rainbow, but the founders of OkCupid were financial investors in Clarifai.

Humor Rainbow then gave Clarifai access not only to photos, but also to users’ demographic and location information.

This apparently violated OkCupid’s privacy policy, which stated that the app would not share personal information with parties not listed in the policy (service providers, business partners, or family affiliates), or that it would notify users and give them the opportunity to opt out.

Not only that, but the FTC also claimed that OkCupid and Match had largely covered up these actions since September 2014, including attempting to obstruct the FTC’s investigation.

“The FTC enforces the privacy promises companies make,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a press release. “We will investigate and, where appropriate, take action against companies that promise to protect your data but fail to follow through, even if it means we have to assert our civil investigative claims in court.”

According to the FTC’s press release, the agency enforced its civil investigative request in federal court and OkCupid was required to turn over the information requested by the FTC.

The proposed settlement, filed yesterday, states that OkCupid, Match Group Americas and Humor Rainbow will be permanently prohibited from misrepresenting the manner in which they process (collect, maintain, use, disclose, delete or protect) user information, the purposes of this behavior, and the functions and operations of their privacy controls. The ordinance will remain in effect for 20 years.

A financial settlement is not mentioned in the press release.