The Federal Communications Commission’s Enforcement Bureau has reached a $7.4 million settlement with Verizon to resolve an investigation into the company’s use of personal consumer information for marketing purposes.
The Enforcement Bureau’s investigation uncovered that Verizon failed to notify about two million new customers, on their first invoices or in welcome letters, of their privacy rights, including how to opt out from having their personal information used in marketing campaigns, before the company accessed their personal information to market services to them.
In addition to the $7.4 million payment, Verizon has agreed to notify customers of their opt-out rights on every bill for the next three years.
“In today’s increasingly connected world, it is critical that every phone company honor its duty to inform customers of their privacy choices and then to respect those choices,” said Travis LeBlanc, acting chief of the FCC’s Enforcement Bureau.
“It is plainly unacceptable for any phone company to use its customers’ personal information for thousands of marketing campaigns without even giving them the choice to opt out,” LeBlanc said.
Phone companies collect sensitive personal information about their customers, such as billing and location data, and the Communications Act requires them to protect the privacy of that information.
A phone company is prohibited from accessing or using personal information except in limited circumstances such as marketing, but only after getting the customer’s approval. It can obtain approval through either an “opt-in” or “opt-out” process.
When the process isn’t working correctly, the company must report the problem to the FCC within five business days.
For many customers, Verizon used an opt-out process, sending opt-out notices to customers either as a message in their first bill or in a welcome letter.
During its investigation, the Enforcement Bureau learned that, beginning in 2006 and continuing for several years, Verizon failed to generate the required opt-out notices to about two million customers, depriving them of their right to deny Verizon permission to access or use their personal information for marketing purposes.
In addition, the Enforcement Bureau learned that Verizon personnel failed to discover these problems until September 2012, and the company failed to notify the FCC of these problems until January 18, 2013, 126 days later.
Under the terms of the settlement announced Wednesday, Verizon is required to take steps to improve how it protects the privacy rights of its customers.
For example, Verizon will now include opt-out notices on every bill, not just the first bill, and it will put systems in place to monitor and test its billing systems and opt-out notice process to ensure that customers are receiving proper notices of their privacy rights.
Any problems detected need to be reported to the FCC within five business days, and any noncompliance must be reported as well.
