TRUSTe, a provider of privacy certifications for online businesses, has been given a $200,000 fine by the US Federal Trade Commission (FTC) after users were led to believe it was doing proper auditing of those given its stamp of approval.
Though it claimed every website, app and cloud service that gained the TRUSTe Certified Privacy Seal would have to be re-assessed every year, in at least 1,000 cases between 2006 and 2013 that didn’t happen.
Its icon, which is supposed to show the site in question is responsible when it comes to protecting users’ data, has been awarded to various big-name companies, including the the New York Times and Apple.
But security professionals have been scornful of such logos in the past, including the Norton Secured and PayPal Verified versions. The Australian security professional Troy Hunt, who previously lambasted icons in a blog post entitled Why I am the world’s greatest lover (and other worthless security claims) , told the Guardian the icons were “entirely useless and appeal to the lowest common denominator of technology professionals”.
“Their effectiveness in building confidence in consumers is questionable at best and deceitful at worst,” Hunt said over email.
“Users should ignore any assertions like this made on the site itself. You simply cannot distill the broad landscape that is information security down into a logo on a page.”
TRUSTe was also punished for failing to have its customers change their references to the accreditation provider as a non-profit organisation after it became for-profit in 2008.
Its settlement with the FTC will force it to be transparent around its processes, but it won’t be obliged to tighten up the accreditation process itself.
In a blog post, the TRUSTe CEO, Chris Babel, said the number of cases where it didn’t do proper re-auditing as promised represented “less than 10% of the total number of annual reviews”. He said the organisation had introduced annual reviews for all clients in January 2013.
“TRUSTe promised to hold companies accountable for protecting consumer privacy, but it fell short of that pledge,” added the FTC chair, Edith Ramirez. “Self-regulation plays an important role in helping to protect consumers. But when companies fail to live up to their promises to consumers, the FTC will not hesitate to take action.”
