"While LifeLock promised consumers complete protection against all types of identity theft, in truth, the protection it actually provided left enough holes that you could drive a truck through it," FTC Chairman Jon Leibowitz said in a written statement.
To settle the charges, the company agreed to stop making claims about how its service could prevent identity theft, monitor all activity of all its customers and to render their personal information useless to identity thieves. And, ironically, the company also had to agree to protect its customers' information, something the FTC said it had been lax about.
Here are some of the claims made by LifeLock the FTC and attorneys general said were not accurate:
- "By now you've heard about individuals whose identities have been stolen by identity thieves . . . LifeLock protects against this ever happening to you. Guaranteed."
- "Please know that we are the first company to prevent identity theft from occurring."
- "Do you ever worry about identity theft? If so, it's time you got to know LifeLock. We work to stop identity theft before it happens."
- "Only authorized employees of LifeLock will have access to the data that you provide to us, and that access is granted only on a 'need to know' basis."
- "All stored personal data is electronically encrypted."
- "LifeLock uses highly secure physical, electronic, and managerial procedures to safeguard the confidentiality and security of the data you provide to us."
LifeLock was essentially providing fraud alerts for $10 a month -- something consumers can do on their own -- with boasts of its blanket protection. The FTC said in reality the work being done by LifeLock was only relevant to a type of identity theft that accounts for a small percentage of the overall cases.
The settlement allots $11 million to the FTC -- to be used for refunds for LifeLock customers -- and the other $1 million to Madigan's office to be split among the 35 states party to the settlement.
In its own statement, LifeLock put a positive spin on the settlement.
"LifeLock is pleased with this agreement, which, for the very first time, works to set advertising guidelines for the entire industry. We welcome federal and state efforts to regulate our industry, because doing so helps to protect consumers from the risks of identity theft," said LifeLock Chairman and CEO Todd Davis.
The following states are party to the settlement: Alaska, Arizona, California, Delaware, Florida, Hawaii, Idaho, Illinois, Indiana, Iowa, Kentucky, Maine, Maryland, Massachusetts, Michigan, Missouri, Mississippi, Montana, Nebraska, Nevada, New Mexico, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Vermont, Virginia, Washington, and West Virginia.
Consumers who might be eligible for refunds need not contact the FTC. For more information, call 202-326-3757 or visit this site set up by the FTC.