The Federal Trade Commission announced on Mar. 30 that it has reached a settlement with OkCupid and its affiliate, Match Group Americas, following allegations that the dating app shared users' personal information with an unrelated third party without consent.
The action is significant because it addresses concerns about how companies handle sensitive user data and uphold privacy promises made to consumers. The FTC's enforcement seeks to ensure transparency and accountability in the collection and sharing of personal information.
According to the FTC, OkCupid provided access to millions of user photos, location details, and other information to a third party not identified as a service provider or business partner in its privacy policy. The agency said this occurred despite OkCupid's assurances that such data would only be shared under specific circumstances outlined in its policy or after informing users and offering them an opt-out option.
“The FTC enforces the privacy promises that companies make,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “We will investigate, and where appropriate, take action against companies that promise to safeguard your data but fail to follow through—even if that means we have to enforce our Civil Investigative Demands in court.”
The complaint also alleges that since September 2014, both Match Group Americas and OkCupid attempted to conceal their actions by obstructing the investigation and denying any involvement when questioned by media outlets. When news emerged about large datasets being obtained by a third party linked financially to OkCupid’s founders, the company denied involvement both publicly and directly to users.
Under the proposed settlement filed in federal court in Dallas, Texas, OkCupid and Match are permanently barred from misrepresenting how they collect or share personal information. This includes restrictions on statements about privacy controls offered through user interfaces or under state laws regarding consumer choices related to personal data processing.
The Commission approved filing the complaint by a unanimous vote. Stipulated final orders like this one become legally binding once signed by a district court judge.
