The identity theft protection company LifeLock will pay $100 million to settle Federal Trade Commission charges that it violated the terms of a 2010 FTC settlement over what the agency describes as "deceptive claims about its identity theft protection services" and failure "to take steps required to protect its users data."
About two-thirds of the settlement some $68 million will be paid to LifeLock customers who participated in class-action suits against the company over the behavior alleged by the FTC. The order stipulates that none of those funds can be used for LifeLock s legal or administrative expenses in handling those suits.
The settlement the largest in FTC history for an enforcement action also puts LifeLock on a short leash with the Commission. It requires the company to keep the agency regularly informed of its compliance with the order, as well as transactions with consumers, changes in company personnel and other corporate data for up to 13 years.
In a statement about the settlement, LifeLock said it neither confirms nor denies the allegations of the FTC and the class-action litigants. It also asserts that there is no evidence that LifeLock has ever had any of its customers' data stolen, and the FTC did not allege otherwise.
The latter claim is correct, based on the FTC s settlement, which focuses on the company s shortcomings in addressing the risk of identity theft. LifeLock, the FTC says, failed to establish and maintain a comprehensive information security program to protect users sensitive personal information including their social security, credit card and bank account numbers. While three of the four FTC commissioners voted for the settlement, the fourth, Maureen K. Ohlhausen, voted no, citing a lack of clear and convincing evidence that LifeLock s security program was as inadequate as the charges allege.
The settlement also covers the FTC s charges that LifeLock falsely advertised that it protected consumers sensitive data with the same high-level safeguards used by financial institutions. LifeLock avoided directly addressing those charges in its statement, saying only that the allegations raised by the FTC are related to advertisements that we no longer run and policies that are no longer in place.
The 2010 FTC settlement that laid the groundwork for the current one required LifeLock, among other steps, to refund $12 million to its customers, make changes to its advertising and better ensure the security of its customers information.
Top Ten Reviews has given LifeLock's Ultimate Plus service high marks in our review, which has not yet been amended in response to the FTC settlement. We will, however, be considering changes as we prepare to update our review of Identity Theft Protection Services in early 2016.