The identity theft protection company LifeLock will pay $100 million to settle Federal Trade Commission charges that it violated the terms of a 2010 FTC settlement over what the agency describes as "deceptive claims about its identity theft protection services" and failure "to take steps required to protect its users  data."

About two-thirds of the settlement   some $68 million   will be paid to LifeLock customers who participated in class-action suits against the company over the behavior alleged by the FTC. The order stipulates that none of those funds can be used for LifeLock s legal or administrative expenses in handling those suits.

The settlement   the largest in FTC history for an enforcement action   also puts LifeLock on a short leash with the Commission. It requires the company to keep the agency regularly informed of its compliance with the order, as well as transactions with consumers, changes in company personnel and other corporate data for up to 13 years.

In a statement about the settlement, LifeLock said it neither  confirms nor denies the allegations  of the FTC and the class-action litigants. It also asserts that  there is no evidence that LifeLock has ever had any of its customers' data stolen, and the FTC did not allege otherwise. 

The latter claim is correct, based on the FTC s settlement, which focuses on the company s shortcomings in addressing the risk of identity theft. LifeLock, the FTC says, failed  to establish and maintain a comprehensive information security program to protect users  sensitive personal information including their social security, credit card and bank account numbers.  While three of the four FTC commissioners voted for the settlement, the fourth, Maureen K. Ohlhausen, voted no, citing a lack of  clear and convincing evidence  that LifeLock s security program was as inadequate as the charges allege.

The settlement also covers the FTC s charges that  LifeLock falsely advertised that it protected consumers  sensitive data with the same high-level safeguards used by financial institutions.  LifeLock avoided directly addressing those charges in its statement, saying only that  the allegations raised by the FTC are related to advertisements that we no longer run and policies that are no longer in place. 

The 2010 FTC settlement that laid the groundwork for the current one required LifeLock, among other steps, to refund $12 million to its customers, make changes to its advertising and better ensure the security of its customers  information.

Top Ten Reviews has given LifeLock's Ultimate Plus service high marks in our review, which has not yet been amended in response to the FTC settlement. We will, however, be considering changes as we prepare to update our review of Identity Theft Protection Services in early 2016.

More Top Stories