Regulator action · 31 May 2023
FTC v Ring LLC (employee and contractor access to customer video)
FTC complaint and stipulated order, C.D. Cal. (2023) · United States Federal Trade Commission
What it means for your code
Internal access is a product surface. Scope it per role, log every view, alert on bulk access, and offer multi-factor authentication before you are told to.
What happened
Staff and contractors could view every customer's stored camera footage regardless of whether their job required it, and weak credential handling let outsiders take over accounts.
What was decided
Granting broad internal access to intimate customer data without need-to-know limits, logging or review is an unfair practice, as is failing to implement basic account-takeover protections.
⚖ USD 5.8 million
The legal test applied
- Unrestricted internal access to intimate customer data, without need-to-know limits or logging, is unfair
- Failure to implement basic account-takeover protections compounds the unfairness
- Representations about privacy set the standard the practice is measured against
What would have changed the outcome
- Role-scoped access with per-view justification and alerting is the control the order requires
Source: United States Federal Trade Commission, www.ftc.gov. Summary and analysis by Lawpatch. Risk analysis, not legal advice; the law may have moved on since this decision.