Spokeo: CDT's Privacy Complaint 'unwarranted'
A privacy and credit-reporting complaint filed by the Center for Democracy and Technology against people-search Web site Spokeo.com is based on flawed assumptions about the site's business model, a Spokeo executive said.
The CDT complaint, filed with the U.S. Federal Trade Commission Wednesday, alleges that Spokeo violates the U.S. Fair Credit Reporting Act by publishing financial information on millions of U.S. residents without allowing them to see who has accessed their data or informing them of potential adverse determinations made from the data. Spokeo's profiles also contain "significant inaccuracies," even though it has pitched itself to human resources professionals and job recruiters, the CDT complaint said.
But Spokeo is not subject to the Fair Credit Reporting Act, or FCRA, because it does not issue credit reports, and because it uses only publicly available information to build its profiles and make credit and wealth estimates, said Sharon Dvoretzky, the site's vice president of communications. Spokeo does not access Social Security numbers, driver's license numbers, or bank accounts used by credit reporting agencies, she said.
"We feel very strongly it's an unwarranted and unsupported claim," Dvoretzky said of the CDT complaint. "It totally misrepresents our business practices."
A Spokeo search lists the address, phone number, marital status, approximate age, occupation, approximate house value, hobbies and other information of a person. For a subscription, the site also offers information on a person's religion, political leanings, e-mail address, economic health and wealth level. The site appears to have renamed a "credit estimate" indicator to an "economic health" indicator since the CDT complaint was filed.
Spokeo profiles are based in part on marketing data that advertisers have been using for years, and the site started as a way for people to track their friends, she said. "We are a search engine that's very efficient about consolidating information in the people-search realm," Dvoretzky said. "What we tap into are public sources that have been available, some for decades."
Information collected from public sources is "very clearly" included in the consumer protections in the FCRA, said Justin Brookman, senior fellow at CDT.
The FCRA's consumer protections cover any communications that have a "bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit or insurance [or] employment purposes," the law says.
Despite the CDT complaint, Spokeo rolled out a new version of its people-search product in March and no longer advertises itself to HR professionals and recruiters, Dvoretzky said. "The fundamental problem about their complaint is that it's relying on a different version of our product that is long since gone," she said.
Employment reports are covered by the FCRA, which requires businesses that collect consumer information to tell those consumers what information they hold and to take steps to verify the accuracy of the data when disputed by a consumer.
In the past, Spokeo has targeted HR professionals and recruiters as customers, the CDT complaint said. Earlier this week, a Spokeo blog post listed, among the site's top uses, searches on prospective or current business associates or research on prospective employees. That blog post, apparently written by a Spokeo employee, has been changed, with the suggestions to search for information on business associates or prospective employees eliminated.
Spokeo's blog still contains a post listing a customer's top uses of the site, including doing research on potential employers and employees. Spokeo "in no way endorses" those uses of its site, Dvoretzky said.
Spokeo has changed its home page to focus less on job recruiters, but the site still has that suggestion on its blog, Brookman said. The site also has information about an HR edition of its service, although the HR edition home page gives a "page not found" message.
Spokeo also continues to provide wealth estimates and other financial information, Bookman said. "I'm not entirely sure how that helps 'friends find each other,'" he said in an e-mail. "They have changed their home page, but they still market their product for employment purposes."
As for complaints about inaccuracies in the profiles, Spokeo tries to warn users that the data is only as good as the public sources it's based on, Dvoretzky said. "We are a reference -- we cannot be a definitive source for every bit of information," she said. "Our product is constantly evolving and getting refined. We can aggregate only so many sources."
Spokeo allows people to delete their information, and a "tiny" percentage do so, Dvoretzky said. "We're very unique in that we offer an opt-out process," she said. "How many search engines do that? Google doesn't let you opt out."
Brookman called Spokeo's opt-out process a "good feature," but there are multiple complaints that it doesn't work very well, he said. In some cases, a profile is deleted, then Spokeo creates a new profile of the same person later. Spokeo appears to have multiple profiles on some people, he added. "Erasing one would have no effect on any other," he added.
If Spokeo doesn't comply with the FCRA by notifying people of adverse decisions based on its data, people may not realize the site has information about them, Brookman added. "People wouldn't know to go to Spokeo to delete their profile in the first place," he said. "There are lots of other Spokeos out there; creditors, employers, or other decision-makers may be using those sites to evaluate me, and I wouldn't know to go to those sites to see if my data was accurate unless they told me."
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantusG. Grant's e-mail address is firstname.lastname@example.org.