## Facts

- Snapchat, Inc. operated a mobile application allowing users to send photo and video messages marketed as “disappearing” after viewing or after a user-selected time.
- The Federal Trade Commission (FTC) investigated Snapchat’s privacy and data-security practices and issued an administrative complaint under § 5(a) of the FTC Act.
- The FTC alleged Snapchat misrepresented that snaps would “disappear forever,” despite simple methods allowing recipients to save content (including screenshots and, on certain Android devices, file retrieval).
- The FTC alleged Snapchat’s privacy policy claimed it did not collect location-specific information, while the Android app used tracking/analytics code that collected and transmitted certain location-related information.
- The FTC alleged Snapchat’s “Find Friends” feature transmitted users’ full contact lists (including non-users’ data) and did so insecurely; the FTC also alleged inadequate phone-number verification.
- The FTC alleged Snapchat failed to implement reasonable security measures, enabling misuse and unauthorized disclosure, including an incident where attackers compiled usernames and phone numbers.
- Snapchat entered a consent agreement; the FTC finalized a Decision and Order on December 31, 2014. Snapchat did not admit or deny the substantive allegations (except jurisdiction).

## Issues

1. Whether Snapchat made material misrepresentations likely to mislead reasonable consumers about message deletion, data collection (including geolocation), and privacy/security practices, in violation of § 5(a) of the FTC Act.
2. Whether Snapchat’s alleged failures to implement reasonable data-security measures constituted an unfair practice under § 5(a).
3. What injunctive and compliance obligations were appropriate to prevent future deceptive or unfair privacy and data-security practices.

## Decision

- The FTC approved a final administrative consent order resolving the matter without litigation on the merits.
- The order prohibited Snapchat from misrepresenting the extent to which messages are deleted or temporary, the extent of data collection/use/disclosure (including geolocation), and the extent of its security protections.
- The order required Snapchat to implement and maintain a comprehensive written privacy program addressing privacy risks in product development and management.
- The order required independent, biennial privacy assessments by a qualified third party for 20 years, along with recordkeeping and compliance reporting.

## Legal Principles

- Under § 5(a) of the FTC Act, materially false or misleading representations or omissions about privacy-related product features and data practices can constitute deception.
- Claims about content ephemerality, data collection, and security are actionable when likely to mislead reasonable consumers, including where technical workarounds undermine absolute marketing claims.
- Privacy policy statements may be treated as enforceable representations; contradictions between policy disclosures and actual data practices can be deceptive.
- Inadequate security practices may be addressed as deception (where security is misrepresented) and as unfairness (where unreasonable practices create substantial, not reasonably avoidable injury).
- FTC privacy settlements commonly impose forward-looking compliance controls, including comprehensive privacy programs and long-term independent assessments.

## Conclusion

The FTC’s consent order required Snapchat to stop misleading claims about disappearing messages and privacy practices, and imposed a long-term privacy compliance regime—privacy program, independent biennial assessments, and reporting—grounded in § 5’s prohibition on deceptive and unfair acts or practices.


In re Snapchat, Inc., No. C-4501 (F.T.C. Dec. 31, 2014)