FTC doesn't fine OkCupid for sharing millions of users' personal data

The Federal Trade Commission (FTC) is taking action against OkCupid and Match Group Americas (both owned by Match Group, Inc.), following OkCupid's alleged sharing of user data. But the agency isn't fining the popular dating app.

The FTC alleged that OkCupid disclosed the personal information of nearly 3 million users, including their photos and locations, to an unauthorized third party, the AI company Clarifai.

According to the FTC's complaint, in Sept. 2014, Clarifai asked Humor Rainbow, OkCupid's former owner and current Match Group Inc. subsidiary, for large datasets of OkCupid photos. There wasn't a business relationship with Clarifai and Humor Rainbow, but the OkCupid founders were financial investors in Clarifai.

Humor Rainbow then gave Clarifai access not just to photos, but also to users' demographic and location information.

This apparently violated OkCupid's Privacy Policy, which stated that the app wouldn't share personal information with parties not listed in the policy (service providers, business partners, or family affiliates), or it would inform users and give them a chance to opt out.

Not only that, but the FTC also claimed that OkCupid and Match extensively concealed these actions since Sept. 2014, including attempting to obstruct the FTC investigation.

"The FTC enforces the privacy promises that companies make," FTC Bureau of Consumer Protection Director Christopher Mufarrige stated in a press release. "We will investigate, and where appropriate, take action against companies that promise to safeguard your data but fail to follow through — even if that means we have to enforce our Civil Investigative Demands in court."

According to the FTC's press release, the agency has enforced its Civil Investigative Demand in federal court, and OkCupid had to hand over the information the FTC requested.

The proposed settlement, filed yesterday, states that OkCupid, Match Group Americas, and Humor Rainbow will be permanently prohibited from misrepresenting how they handle (collect, maintain, use, disclose, delete, or protect) user information, the purposes for doing so, and the functions and operations of their privacy controls. The order will remain in effect for 20 years.

A financial settlement isn't mentioned in the press release.