The Spokeo Lawsuit and the Perils of the New People Finder Companies

Spokeo bills itself as a people-finder service: You can look up people and find out where they live, where they have lived in the past, and who their relatives and spouses are, and ascertain information about their profession and their home’s value. All of this data can be purchased for the price of a subscription. Spokeo warns subscribers that it cannot use this information to make decisions about a person’s employment, to make a credit determination, or to put the information to uses that would be covered by a federal law known as the Fair Credit Reporting Act (FCRA).

Spokeo attempts to immunize itself from FCRA violations by stating that it is not providing data for use in credit reporting. But as a recent lawsuit illustrates, Spokeo’s data is being used for such purposes, because the company may not have sufficient safety precautions. One Virginia resident has sued Spokeo, alleging that the company’s aggregation of erroneous personal information has been harmful to him in his attempt to find a job. The plaintiff, Thomas Robins, said that a decision issued this week by a U.S Court of Appeals, which allows his 2011 lawsuit to proceed, represents a broader shift in the legal landscape, in which courts are putting greater emphasis on a consumer’s ability to control their own information and their own digital identities.

Robins claims that inaccurate information in his Spokeo profile, “caused actual harm” to his employment prospects, according to his complaint, filed in 2011. He alleges that the site acts as a consumer-reporting agency, despite Spokeo’s denial that that is what it is. Robins thus accuses Spokeo of violating the FCRA by failing to provide the proper notices that credit-reporting agencies such as Experian are required to provide, and that give consumers notice when their data has been used for some major credit-related event (applying for a job, seeking insurance, etc.).

In this column, I will analyze Spokeo’s business model and the recent legal action against the company. I believe that Spokeo cannot have its cake and eat it too: Since it profits from the sale of data that can easily be used for credit-reporting purposes, it needs to be subject to some regulatory scrutiny. At a minimum, consumers should have the ability to see their data, to correct it if needed, and to understand who might be buying their data for commercial purposes.

Spokeo’s Business Model

Spokeo, which calls itself a “people search service,” was founded in 2006, by a group of Stanford graduates, according to its website. The company is located in Pasadena, California.

Spokeo’s site allows you to search by five methods :(1) first and last name, (2) phone number, (3) email, (4) street address, and (5) username. It makes its money by offering subscriptions. If someone visits Spokeo’s site, he can find out if the company has a profile for a particular individual by inputting their name and state. After that, customers will see a person’s name, age and city of residence, but not a full profile. To see more, you have to pay. Spokeo offers paid subscriptions costing $3.95 a month for six months, or $4.95 for three months. The Terms of Use indicate that users will be billed $23.70 every six months until a subscription is canceled.

The company obtains information from dozens of sources including public records, marketing surveys, online maps, and social networks, the company says on its website. What is unclear from the company’s site is how it merges and melds data together to create a unique profile—so that data that may not be yours, or data that has an error in it, will not get wrongly compiled into your unique individual profile. In one of its blog posts, the company tells the public that “Spokeo is not a private investigator, but an information aggregator. This means that our machines do not have the human intelligence to decide which information is right, and which is wrong. Spokeo does not claim or warrant the accuracy of the information gathered.” This may be its assertion, but many people rely on Spokeo to serve as a sort of online detective and make decisions based on what they find in its records. Spokeo says in its Terms of Use that using the site to determine eligibility for employment, credit or other use under the FCRA is “explicitly prohibited.”

According to Robins’s lawsuit, Spokeo’s profile of him contained inaccurate information that included: that he is in his 50s, married with children, and was employed in a professional and technical field. His profile also inaccurately indicated that he had a graduate degree, that his economic health is “very strong” and that his wealth level was in the “top 10 %.”

Spokeo and the Fair Credit Reporting Act

Robins’s lawsuit is not the first time that Spokeo has gotten into hot water. While it claims to be a site selling personal data for other uses (e.g., cultivating new clients, finding old friends, and evaluating prospects for business deals) it is skating on thin ice, as its data is also useful to landlords, employers, and even lenders, who may subscribe to the service as a way of doing additional background checks on people.

These new types of data brokers are either unregulated, or claim that certain laws do not apply to them. If Spokeo were subject to the FCRA, as major data brokers such as Experian, Transunion, or Equifax are, then Spokeo would have to ensure that customers had notice if data that they furnished was used to make an adverse determination against a consumer in an employment or credit transaction. In addition, consumers have certain statutory rights to see their data, and to correct that data if it is in error. Consumers get their credit report for free annually; Spokeo does not offer such a service. You have to pay to see your own data.

In June 2012, Spokeo paid $800,000 to settle a Federal Trade Commission (FTC) lawsuit that alleged that the Pasadena company illegally sold personal information. I discussed this enforcement action in a prior column.

The FTC said that the company violated the FCRA, which, among other things, requires providers of consumer reports to ensure that the information in the reports is accurate and to inform job seekers if employers decide not to hire them based on the information.

The FTC’s public statement on the settlement said that the company sold data to companies “in the human resources, background screening, and recruiting industries” in violation of the law.

“This is the first Commission case to address the sale of Internet and social media data in the employment screening context,” the FTC also reported.

The FTC also alleged that Spokeo posted deceptive endorsements of the service, “portraying the endorsements as independent when in reality they were created by Spokeo’s own employees.”

Spokeo founder and President Harrison Tang wrote a response to the FTC’s action on its website. Tang noted that “It has never been our intention to act as a consumer reporting agency. We are a technology company organizing people-related data in innovative ways. We do not create our own content, we do not possess or have access to private financial information, and we do not offer consumer reports.”

He also stated that the company has made changes to its website and business to make sure it is not violating any laws “and to ensure an honest and transparent service that will continue to be easy for our customers to use.”

The FTC, however, thought otherwise. In its complaint, filed in federal District Court in Los Angeles, it alleged that from 2008 to 2010, Spokeo sold “coherent people profiles” that could include an individual’s address, phone number, marital status, approximate age, e-mail address, hobbies, ethnicity, religion, participation on social media sites, photos and other data.

Spokeo also reportedly offered advanced versions of its subscription service, providing customized searches or access to more individual searches. The additional services were marketed to human resources departments, background check/screening businesses and employment recruiters, and were promoted as tools to help subscribers decide whether to interview or hire job candidates. In 2010, Spokeo modified its “Terms of Service” to state that it was not a consumer reporting agency, and that consumers could not use its profiles for purposes that were covered by the FCRA. But the FTC said that the company failed to revoke or restrict access by subscribers who had already been using the site for those purposes.

The FTC voted, 4-to-0, with one commissioner not participating, to refer the complaint to the U.S. Department of Justice.

The FTC Settlement, which is quite recent, illustrates the gray zone in which Spokeo has been operating. It is collecting data that is not traditionally the type of data that has been used for credit-reporting purposes. Employers, banks, insurers, and landlords have typically relied on financial history: how much debt a person has, whether he or she has paid their bills on time, whether he or she has a criminal record, etc. But Spokeo and other companies are compiling even more robust data sets, with new types of profiles that creditors and others will also find useful when making decisions, so Spokeo has a product that creditors want, and at present, it is unclear how actively they stop such companies from using this information. And the underlying issue is this: when the information is used for a major life decision, such as whether someone might be hired or not, the person affected has no recourse, or ability to correct the errors.

Robins’s Lawsuit Further Highlights Spokeo’s Dilemma

In his lawsuit, Robins said that the alleged inaccuracies introduced by Spokeo damaged his job-hunting prospects and caused him anxiety and stress. His lawsuit claimed that the profile amounted to a consumer report, and that it violated a series of requirements under the FCRA, including a mandate to use reasonable procedures to ensure that information about a person is accurate.

In 2011, Judge Otis Wright II of the U.S. District Court in Los Angeles dismissed Robins’s lawsuit for “lack of standing” due to lack of real harm or injury. Robins appealed to the U.S. Court of Appeals for the Ninth Circuit. On Tuesday, the Ninth Circuit ruled that Robins could move forward with his lawsuit.

While Judge Wright found that Robins failed to show that he had suffered actual harm, the three-judge appellate panel wrote that a plaintiff “can suffer a violation of the statutory right without suffering actual damages.” The case will next return to the District Court on remand.

The Ninth Circuit held that the FCRA is written so that that a violation of its procedures is in itself sufficient harm. “The statutory cause of action does not require a showing of actual harm when a plaintiff sues for willful violations. A plaintiff can suffer a violation of the statutory right without suffering actual damages,” wrote Judge Diarmuid O’Scannlain.

Spokeo maintains, in a statement on its website, that it is not a credit-reporting agency.

Robins’s lawyer, Steven Woodrow, reported to the press, “This is a tremendous victory for consumers.” He also noted that Robins would seek to have the lawsuit certified as a class action on behalf of all people whose profiles have been posted online on Spokeo since 2006.

As we watch Robins’s lawsuit unfold, it will allow us to have a greater look at Spokeo’s business model and to better ascertain whether it has put in place any enhanced safeguards in order to prevent the illegal use of its information for credit-reporting purposes. But even if the safeguards are there, the issue of the errors in such data will still remain a thorn in consumers’ sides. As more and more brokers sell our personal profiles, do we have any rights in our new digital “me”? Can we see what people have compiled, and do we have a right to correct such data? I think the answer should be “yes” and I hope that the FTC and the Consumer Finance Protection Bureau are paying attention.