Verizon will pay a $7.4 million fine for violating the privacy rights of about 2 million new customers by using their personal information to market services to them without first informing them of their right to opt out.
The Federal Communications Commission (FCC) said it is the largest fine ever involving an investigation into privacy issues around the personal information of telephone users, though a relatively small hit for a company that generated $31.5 billion in the second quarter.
According to the FCC, Verizon did not tell new customers—either through their first invoices or in welcome letters sent to them—how they could opt out of having their personal information used in marketing efforts. Along with the fine, Verizon also agreed to let customers know about their opt-out options in every bill they send out over the next three years.
Giving customers such information is critical at a time when people are becoming more mobile, according to Travis LeBlanc, acting chief of the FCC’s Enforcement Bureau.
“In today’s increasingly connected world, it is critical that every phone company honor its duty to inform customers of their privacy choices and then to respect those choices,” LeBlanc said in a statement. “It is plainly unacceptable for any phone company to use its customers’ personal information for thousands of marketing campaigns without even giving them the choice to opt out.”
Officials for Verizon, which has been battling with the FCC over issues around net neutrality, said in a statement that the problem was the result of an oversight, and stressed that the customers’ information was kept safe.
“The issue here was that a notice required by FCC rules inadvertently was not provided to certain of Verizon’s wireline customers before they received marketing materials from Verizon for other Verizon services that might be of interest to them,” they said. “It did not involve a data breach or an unauthorized disclosure of customer information to third parties.”
According to the FCC, phone companies—which collect such customer data as billing and location—are prohibited under the Communications Act from accessing or using the personal information in most cases, though marketing is allowed after getting their customers’ approval. The companies can use an opt-in or opt-out method, and if the process isn’t working, they must contact the FCC within five business days.
In Verizon’s case, the company, starting in 2006 and continuing for several years, failed to put the opt-out information on the first invoices or welcome statements to about 2 million new customers, the regulatory agency said. Because of this, many of those customers were unaware of Verizon’s opt-out policy. In addition, Verizon officials didn’t discover the problem until September 2012, and then failed to notify the FCC about the issue until Jan. 18, 2013, about 126 days later.
Under the terms of the settlement with the FCC, Verizon has agreed to put monitoring and testing procedures in place in its billing systems and an opt-out notification process in place to make sure customers are getting the information they need, regulators said.