Updated at 5p.m. with LifeLock comment, closing share price
LifeLock, the identity-theft protection company, has agreed to pay $100 million to settle charges from the Federal Trade Commission that it failed to properly secure its customers’ information and misrepresented the strength of its security. This is the largest order-enforcement case to date to come out of the FTC.
Under the terms of Thursday’s settlement, the company will use a portion of its fee — $68 million — to pay back consumers who sued the company in a class action suit, who made similar complaints about the company’s services.
“This settlement demonstrates the Commission’s commitment to enforcing the orders it has in place against companies, including orders requiring reasonable security for consumer data,” said FTC Chairwoman Edith Ramirez in a statement. “The fact that consumers paid Lifelock for help in protecting their sensitive personal information makes the charges in this case particularly troubling.”
LifeLock had previously settled with the FTC and 35 state attorneys general in 2010, paying $12 million for not securing customer information and for making “false claims.” At the time, it signed an agreement saying it would change its behavior in the future. This July, the FTC announced it would file a complaint against the company for violating that order.
According to the FTC, LifeLock violated several terms of its previous agreement. First, the agency said, its security system was not up to the task of protecting users’ sensitive personal information, including Social Security numbers, credit card information and bank account numbers. Second, the complaint said that LifeLock falsely advertised that its systems were protected using the same technology as financial institutions.
The agency added that LifeLock also made false claims about an alert feature that promised to let customers know immediately if they may be a victim of identity theft. Finally, the complaint also says that LifeLock did not abide by the record-keeping agreements it said it would in the 2010 order.
In the court filing, LifeLock did not admit or deny those charges.
LifeLock said in a statement that it had already done system upgrades and taken other steps to address issues raised by the government.
“The allegations raised by the FTC are related to advertisements that we no longer run and policies that are no longer in place,” the company said. “There is no evidence that LifeLock has ever had any of its customers’ data stolen, and the FTC did not allege otherwise.”
Lifelock’s stock closed Thursday at $13.99, down 30 cents, or 2 percent. When the FTC’s order was announced in July, the shares lost about half their value in a day, plummeting to just above $8 a share.
Reuters contributed to this story