Ok Cupid gave 3 million dating-app photos to facial recognition firm, FTC says - Ars Technica

Overview

Ok Cupid gave 3 million dating-app photos to facial recognition firm, FTC says

Ok Cupid and Match settle with Trump FTC, don’t have to pay any financial penalty.

Details

Ok Cupid and its owner Match Group reached a settlement with the Trump administration for not telling dating-app customers that nearly 3 million user photos, location information, and other details were shared with a company making a facial recognition system.

Ok Cupid and Match do not have to pay a financial penalty in a deal made with the Federal Trade Commission over an incident from 2014. Ok Cupid and Match did not admit or deny the allegations but agreed to a permanent prohibition barring them from misrepresenting how they use and share personal data, the FTC said yesterday.

The FTC has been run entirely by Republicans since President Trump fired both Democratic commissioners. The proposed settlement requires approval from a judge and was submitted in US District Court for the Northern District of Texas.

The dating-site company said it’s pleased to settle the matter without paying any fine. “While we do not admit any wrongdoing, we have settled this matter with the FTC with no monetary penalty to resolve an issue from 2014 and move forward,” an Ok Cupid spokesperson said in a statement provided to Ars today. “The alleged conduct at issue does not reflect how Ok Cupid operates today. Over the years, we have further strengthened our privacy practices and data governance to ensure we meet the expectations of our users.”

Although a recent court ruling imposes limits on the FTC’s enforcement powers, that ruling applied only to the FTC’s in-house administrative process. The FTC can still pursue deceptive advertising claims in courts and seek financial penalties through court orders or settlements.

FTC: Ok Cupid imposed no restrictions on data use

The FTC criticized Match and Ok Cupid for sharing Ok Cupid data with Clarifai, an AI company that offers facial recognition technology. Clarifai’s website says it offers AI services to “military, civilian, intelligence, and government” customers and to private-sector companies in various industries.

The FTC said that “Ok Cupid provided the third party with access to nearly three million Ok Cupid user photos as well as location and other information without placing any formal or contractual restrictions on how the information could be used.” Ok Cupid “did not inform consumers or give them the chance to opt out of such sharing,” the FTC said.

The FTC alleged that “since September 2014, Match and Ok Cupid took extensive steps to conceal—including through trying to obstruct the FTC’s investigation—and deny that Ok Cupid shared users’ personal information with the data recipient. For example, when a news story revealed that the third party had obtained large Ok Cupid datasets, Ok Cupid claimed to the media and Ok Cupid users that it was not involved with the third party.”

The data-sharing arrangement was described in a 2019 article by The New York Times.

Clarifai built face database with Ok Cupid images

Clarifai founder and CEO Matt Zeiler “said his company had built a face database with images from Ok Cupid,” and “used the images from Ok Cupid to build a service that could identify the age, sex and race of detected faces,” according to the Times’ 2019 article.

“An Ok Cupid spokeswoman said Clarifai contacted the company in 2014 ‘about collaborating to determine if they could build unbiased AI and facial recognition technology’ and that the dating site ‘did not enter into any commercial agreement then and ha[s] no relationship with them now.’ She did not address whether Clarifai had gained access to Ok Cupid’s photos without its consent,” the Times wrote.

But even if they had no “commercial agreement,” Zeiler told the Times that his company gained access to user photos because some of Ok Cupid’s founders invested in Clarifai, the 2019 article said. “Clarifai used the images from Ok Cupid to build a service that could identify the age, sex and race of detected faces, Mr. Zeiler said,” according to the article, which added that “Mr. Zeiler said Clarifai would sell its facial recognition technology to foreign governments, military operations and police departments provided the circumstances were right.”

The FTC said in a complaint yesterday that Ok Cupid, which was purchased by Match.com in 2011, made “false and misleading claims” about how it used customer data. The complaint makes references to Humor Rainbow, the name of the company that created Ok Cupid.

“When Ok Cupid users inquired about Ok Cupid and the Data Recipient, Humor Rainbow reiterated its lack of involvement with the Data Recipient. Humor Rainbow stated that ‘any implication that Ok Cupid released users’ information to [the Data Recipient] is false,’” the FTC complaint said.

The FTC complaint described how the data-sharing arrangement was made:

In September 2014, the CEO of Clarifai, Inc. e-mailed one of Ok Cupid’s founders requesting that Humor Rainbow give Clarifai, Inc. (i.e., the Data Recipient) access to large datasets of Ok Cupid photos. Despite not having any business relationship with Humor Rainbow, the Data Recipient sought Humor Rainbow’s assistance because each of Ok Cupid’s founders, including Humor Rainbow’s President and Match Group, LLC’s CEO, were financially invested in the Data Recipient. In response to this request, Humor Rainbow gave the Data Recipient access to nearly three million Ok Cupid user photos. Humor Rainbow’s President and Chief Technology Officer were directly involved in facilitating the data transfer. In addition to user photos, Humor Rainbow shared other personal data with the Data Recipient, including each user’s demographic and location information. Humor Rainbow never executed a formal agreement or set forth restrictions governing the Data Recipient’s access to, or use of, the Ok Cupid user data. The Data Recipient did not pay for the data and never provided any services to Humor Rainbow or on behalf of Ok Cupid.

In response to this request, Humor Rainbow gave the Data Recipient access to nearly three million Ok Cupid user photos. Humor Rainbow’s President and Chief Technology Officer were directly involved in facilitating the data transfer. In addition to user photos, Humor Rainbow shared other personal data with the Data Recipient, including each user’s demographic and location information.

Humor Rainbow never executed a formal agreement or set forth restrictions governing the Data Recipient’s access to, or use of, the Ok Cupid user data. The Data Recipient did not pay for the data and never provided any services to Humor Rainbow or on behalf of Ok Cupid.

Ok Cupid and Match are permanently prohibited from misrepresenting or assisting others in misrepresenting: The extent to which the companies collect, maintain, use, disclose, delete or protect any personal information such as photos and demographic and geolocation data; The purpose for which they collect, maintain, use or disclose such personal data; and the function of privacy controls they provide consumers through user interfaces, any consumer choices afforded to consumers under applicable state privacy laws, or any other mechanisms the companies offer consumers to limit or manage the processing of personal data.

The FTC said its investigation involved the “successful enforcement in federal court” of a civil investigative demand that “required Ok Cupid to turn over information requested by the agency.” Although the FTC merely required Ok Cupid and Match to be honest with users about data practices and did not extract a financial penalty, the agency talked tough about the enforcement action in its press release.

“The FTC enforces the privacy promises that companies make,” said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection. “We will investigate, and where appropriate, take action against companies that promise to safeguard your data but fail to follow through—even if that means we have to enforce our Civil Investigative Demands in court.”

         After 16 years and $8 billion, the military's new GPS software still doesn't work

         Water utility announces it's ditching fluoride—then reveals it did so years ago

         F1 in Japan: Oh no, what have they done to all the fast corners?

         Judge halts Nexstar/Tegna merger after FCC let firms exceed TV ownership limit

         Trump convenes "God Squad" to override Endangered Species Act, up oil production

Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don’t need to know everything, only what’s important.

Key Takeaways

Ok Cupid gave 3 million dating-app photos to facial recognition firm, FTC says
Ok Cupid and Match settle with Trump FTC, don’t have to pay any financial penalty
Ok Cupid and its owner Match Group reached a settlement with the Trump administration for not telling dating-app customers that nearly 3 million user photos, location information, and other details were shared with a company making a facial recognition system
Ok Cupid and Match do not have to pay a financial penalty in a deal made with the Federal Trade Commission over an incident from 2014
The FTC has been run entirely by Republicans since President Trump fired both Democratic commissioners