A phone number can serve two very different business purposes: securing an account and matching a person to an advertisement. The Federal Trade Commission alleged on May 25, 2022, that Twitter used contact details gathered with security assurances for the second purpose without disclosing it. Advertisers could match the details with information they already held or bought from data brokers, according to the complaint. [ftc]

That mechanism explains why the proposed remedy went beyond a payment. The FTC said its proposed order would prohibit Twitter from profiting from deceptively collected data and limit employee access to personal information. It also would allow authentication methods that do not require a phone number. In operational terms, the proposal drew boundaries around using an identifier, accessing it and making it necessary for account protection. [ftc]

The Justice Department outlined another boundary: a privacy review with a written report before a new product or service collects private user information. Regular safeguard testing and independent assessments would follow. Twitter had agreed to those compliance measures and a $150 million civil penalty, DOJ said, but the settlement required federal court approval. These were proposed operating constraints, not a completed change to the advertising business. [doj]

The economic question is whether the rules would keep the security function from quietly becoming an input for another commercial purpose. That is an analytical question, not a forecast of revenue losses or a claim about competitors. Neither release measures the advertising income attributable to the alleged practice, so the penalty alone cannot establish whether the conduct paid. Both sources belong to the same government case, and neither demonstrates the future effectiveness of the proposed controls. [ftc][doj]

Source documents

  1. FTC Charges Twitter with Deceptively Using Account Security Data to Sell Targeted Adshttps://www.ftc.gov/news-events/news/press-releases/2022/05/ftc-charges-twitter-deceptively-using-account-security-data-sell-targeted-ads
  2. Twitter Agrees with DOJ and FTC to Pay $150 Million Civil Penalty and to Implement Comprehensive Compliance Program to Resolve Alleged Data Privacy Violationshttps://www.justice.gov/archives/opa/pr/twitter-agrees-doj-and-ftc-pay-150-million-civil-penalty-and-implement-comprehensive