Twitter fined £119,000,000 in the US for selling users' data

Twitter in the US must pay a £119,000,000 fine after law enforcement officials accused it of illegally using users' data to help sell targeted ads.

The Federal Trade Commission and the Department of Justice say Twitter violated an agreement it had with regulators; court documents showed.

Twitter had vowed to not give personal information like phone numbers and email addresses to advertisers.

Federal investigators say the social media company broke those rules.

Twitter was fined £400,000 in December 2020 for breaking Europe's GDPR data privacy rules.

The Federal Trade Commission is an independent agency of the US government whose mission is the enforcement of anti-trust laws and the promotion of consumer protection.

It accuses Twitter of breaching a 2011 Federal Trade Commission order that explicitly prohibited the company from misrepresenting its privacy and security practices.

Twitter generates most of its revenue from advertising on its platform, which allows users ranging from consumers to celebrities to corporations to post 280-character messages or tweets.

According to a complaint filed by the Department of Justice on behalf of the Federal Trade Commission, Twitter 2013 began asking users to supply either a phone number or email address to improve account security.

"As the complaint notes, Twitter obtained data from users on the pretext of harnessing it for security purposes, but then ended up also using the data to target users with ads," said Lina Khan, who chairs the Federal Trade Commission.

"This practice affected more than 140,000,000 Twitter users while boosting Twitter's primary source of revenue."

Ian Reynolds, managing director of computer security firm Secure Team, told the BBC: "Once again, Twitter is violating the trust that their users have in their platform by using their confidential information to their advantage and increasing their revenue."

He added: "Twitter led their customers into a false sense of security by acquiring their data through claiming it was for security purposes and protecting their account, but ultimately ended up using the data to target their users with ads.

"This reality shows the power that companies still have over your data and that there is a long way to go before users can be comfortable knowing that they have full control over their digital footprint."

To authenticate an account, Twitter requires people to supply a telephone number and email address.

That information also helps people reset their passwords and unlock their accounts if needed, as well as enables two-factor authentication.

Two-factor authentication provides an extra layer of security by sending a code to either a phone number or email address to help users log into Twitter along with a username and password.

But, according to the Federal Trade Commission, until at least September 2019, Twitter was also using that information to boost its advertising business.

It is accused of allowing advertisers access to users' security information.

In addition to the fine, Twitter must also:

• stop using the phone numbers and email addresses it illegally collected

• notify users about its improper use of security information

• tell users about the Federal Trade Commission law enforcement action

• explain how to turn off personalised adverts and review multi-factor authentication settings

• supply multi-factor authentication options that do not need a phone number

• implement an enhanced privacy and security programme which includes reporting incidents to the Federal Trade Commission within 30 days

"The Department of Justice is committed to protecting the privacy of consumers' sensitive data," said Vanita Gupta, the US associate attorney general.

"The £119,000,000 penalty reflects the seriousness of the allegations against Twitter, and the substantial new compliance measures to be imposed as a result of the proposed settlement will help prevent further misleading tactics that threaten users' privacy."