Marketing And Data Security Practices: The FTC v. LifeLock Settlement

• The LifeLock settlement reinforces the FTC's emergence as a leading cybersecurity regulator.
• The FTC is committed to enforcing its orders, including those involving data security.
• The consequences of violating an FTC order can be severe.
• Compliance with industry data security standards, although important, may not insulate companies from liability.
• Companies should assess carefully their data security practices and their representations about such practices.

On December 17, 2015, the Federal Trade Commission (FTC or the Commission) announced that LifeLock, Inc. (LifeLock) had agreed to settle contempt charges that the company violated the terms of a 2010 federal court order. That order requires LifeLock to establish and maintain a comprehensive information security program and prohibits the company from misrepresenting its identity-theft protection services. The settlement, which is the largest monetary award obtained by the FTC in an order enforcement