As one of the first journalists to write about the identity theft phenomenon more than a decade ago, people often ask me if I think LifeLock is worth it. I’ve never been a fan of the company, which began its uneasy existence with a brazen advertising campaign that included plastering the founder’s Social Security number all over the place. Many of LifeLock’s services can be completed for free by consumers. Others, like ID theft recovery assistance, are often available for little or no cost through insurance policies or workplaces benefits.
On the other hand, I do understand why people might be inclined to pay a few bucks every month for additional piece of mind. Plenty of people do so. LifeLock says it has 4 million customers.
(NOTE: A couple of bucks? LifeLock Ultimate costs $329 a year.)
But if you plan to sign up for any monthly service, it’s really important to search out the complaint history of the firm involved. Now, when you do so, you’ll see that LifeLock has agreed to pay the largest FTC enforcement case settlement ever. The case involves allegations that LifeLock didn’t do enough to protect consumer data — remember, consumers were paying the firm to protect them from ID theft.
On Thursday, LifeLock agreed to pay $100 million to settle accusations that it violated the provisions of an earlier settlement with the FTC. The FTC accused LifeLock of the following:
- From at least Oct. 2012 through March 2014, failing to establish and maintain a comprehensive information security program to protect its customers’ sensitive personal information, including credit card, Social Security, and bank account numbers.
- During that period falsely advertising that it protected consumers’ sensitive data with the same high-level safeguards as financial institutions.
- Falsely advertising that it would send alerts “as soon as” it received any indication that a consumer may be a victim of identity theft from January 2012 through December 2014.
- Failing to meet the 2010 order’s recordkeeping requirements.
Lifelock issued the following statement in reaction to the news:
“The allegations raised by the FTC are related to advertisements that we no longer run and policies that are no longer in place. The settlement does not require us to change any of our current products or practices. Furthermore, there is no evidence that LifeLock has ever had any of its customers’ data stolen, and the FTC did not allege otherwise,” the firm said. “As part of our commitment to continual improvement, in recent years we have made significant investments in our people, process and systems throughout the company to address ever more complex and pervasive identity threats. We are pleased to put this matter behind us and look forward to continuing to provide industry-leading identity protection services to our members.”
It’s worth noting that one of five FTC commissions voted against the enforcement action, saying the case lacked “clear and convincing evidence” that consumer information wasn’t protected.
It’s also worth noting that $100 million is a heck of a lot of money.
“Of that $100 million, $68 million may be used to redress fees paid to LifeLock by class action consumers who were allegedly injured by the same behavior alleged by the FTC. These funds, however, must be paid directly to and received by consumers, and may not be used for any administrative or legal costs associated with the class action,” the FTC said.
So if you are one of LifeLock’s customers, stay tuned. And if you are considering becoming a LifeLock customer, be sure to understand what you are paying for, who you are paying, and what coverage you might already have.