FTC Final Orders With Fandango And Credit Karma Provide Guidance On Mobile App Security

In August 2014, the Federal Trade Commission ("FTC") approved final orders resolving its actions against Fandango, LLC ("Fandango") and Credit Karma, Inc. ("Credit Karma") for allegedly misrepresenting the security of their mobile apps to customers because of alleged security flaws in both mobile applications. Companies can look to the complaints and settlement orders for guidance in implementing security measures for their own mobile apps.

The FTC's complaints alleged that the companies' mobile apps left customers' sensitive personal information, including credit card information and Social Security numbers, vulnerable to interception by outside parties because the companies' allegedly disabled the Secure Socket Layer ("SSL") certificate verification process in their mobile apps. An SSL certificate is a protocol used to establish authentic encrypted connections. SSL protocol is considered by some to be an industry standard for mobile applications due to the