FTC Finalizes Lenovo Ad Software Security, Privacy Settlement

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Daniel R. Stoller

Chinese laptop maker Lenovo Group Ltd. settled charges of installing ad software that compromised user security and privacy under a pact that won final Federal Trade Commission approval Jan. 2.

The FTC enforcement action, coupled with a previous settlement with 32 state attorneys general, signals that companies installing user tracking software on their products may find their disclosure and consent practices coming under increased scrutiny.

Under the terms of the no-fault settlement, Lenovo can’t misrepresent features of installed software related to user internet browsing histories or software that transmits such data to third parties. Lenovo can only install such software with affirmative consumer consent, according to the FTC. The laptop maker must also implement a comprehensive software security program and submit to FTC oversight for 20 years, according to the settlement.

The settlement stems from FTC claims that Lenovo, starting in August 2014, sold computers with pop-up ad software that created security vulnerabilities. The software could access sensitive consumer data, including Social Security numbers, medical information, and financial and payment information, according to the administrative settlement order.

Acting FTC Chairman Maureen Ohlhausen (R) and Commissioner Terrell McSweeny (D) approved the settlement. As the commission’s only current members, they must agree in order for the agency to act.

At full strength, the FTC has five Senate-confirmed members appointed to seven-year terms, with no more than three members from the same political party. McSweeny, whose term expired Sept. 25, has agreed to stay on until a replacement is named.

President Donald Trump announced his intent to nominate Republican Joseph Simons to become the next FTC chairman, and consumer advocate Rohit Chopra to serve as a Democratic commissioner. Although the nominations haven’t been sent to the Senate, a White House official told Bloomberg Law Jan. 2 that Trump still intends “to fill enough positions to get a fully functioning FTC.”

The FTC can’t levy fines as part of its general consumer protection powers under the FTC Act. However, it could seek fines if Lenovo fails to follow the consent agreement.

Representatives of the FTC and Lenovo didn’t immediately respond to Bloomberg Law’s email requests for comment.

State Settlement

Beijing-based Lenovo’s ad-tracking software practices led to a separate $3.5 million settlement Sept. 5 with 32 states. Beyond the financial penalty, the settlement terms mirror the FTC pact.

That sum is unlikely to make a large dent in Lenovo’s revenue.

Lenovo, which bases its U.S. operations out of Morrisville, N.C., took in $43 billion in fiscal year 2017 revenue, according to Bloomberg data. About $13 billion, or 30.3 percent of that revenue total, came from Lenovo’s U.S. footprint.

To contact the reporter on this story: Daniel R. Stoller in Washington at dstoller@bloomberglaw.com

To contact the editor responsible for this story: Donald Aplin at daplin@bloomberglaw.com

For More Information

The FTC final settlement approval order is available at http://src.bna.com/vl7.

Copyright © 2018 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security