What happens on the Internet, stays on the Internet.
That truth was laid bare Thursday, when Snapchat, the popular mobile messaging service, agreed to settle charges by the Federal Trade Commission that messages sent through the company’s app did not disappear as easily as promised.
Snapchat has built its service on a pitch that has always seemed almost too good to be true: that people can send any photo or video to friends and have it vanish without a trace. That promise has appealed to millions of people, particularly younger Internet users seeking refuge from nosy parents, school administrators, and potential employers.
But the commission charged that there were several easy ways to save messages from the service, and in settling the accusations, the company agreed not to misrepresent the disappearing nature of its messages.
The company’s early popularity and hype led to a multibillion-dollar buyout offer last year from Facebook, which Snapchat’s leaders spurned in the hope of something better. But the settlement announced Thursday set a different tone, one that could extend to the many other startups that promise security, privacy, and anonymity as an antidote to the public nature of Facebook and Twitter.
“The Internet is forever, and people don’t realize that,” said Nico Sell, a security expert and one of the founders of a rival mobile app called Wickr that also lets people send self-destructing messages. “You think you can delete a tweet or a Facebook post, but it doesn’t go away. Most people don’t know how hard it is to make a message disappear.”
The settlement is the latest revelation that much of what is shared on the Web and through mobile devices is at risk for interception or eventual retrieval, even if the hardware and software companies that transmit them promise otherwise. Security vulnerabilities have been exposed at major banks, corporations, and retailers around the globe.
The settlement between the FTC and Snapchat also raised another notion: that some technology companies may be misleading users about how their information is stored and shared, even if unintentionally.
Under the terms of the settlement, Snapchat will be prohibited from misrepresenting how it maintains the confidentiality of user information. The company will also be required to start a wide-ranging privacy program, a sort of probation, and will be independently monitored for 20 years. Fines could ensue if the company violates the agreement.
In its complaint against Snapchat, the commission said the app’s messages, often called snaps, could be saved in several ways, contrary to what the company has said. Users can save a message by using a third-party app, the agency said, or employ simple workarounds that allow users to take a screen shot of messages without alerting another user.
The complaint also said Snapchat transmitted users’ location information and collected sensitive data like address book contacts, despite its saying that it did not collect such information. The commission said the lax policies did not secure a feature called “Find Friends” that allowed security researchers to compile a database of 4.6 million user names and phone numbers during a recent security breach.
“One thing we want to make clear,” said Chris Olsen, the assistant director of the FTC’s division of privacy and identity protection. “If you make promises about privacy, you must honor those promises or otherwise risk FTC enforcement.”
Snapchat declined an interview request, but posted a statement on its blog. “While we were focused on building, some things didn’t get the attention they could have,” the company wrote.
Olsen of the FTC said several organizations, including the Electronic Privacy Information Center, an independent, nonprofit research center, had raised concerns about the messaging service.
He said the case and resulting settlement were part of a larger continuing investigative effort by the commission to hold companies accountable to their marketing claims and privacy assurances to consumers.
Snapchat’s rise is part of a sea change in social media, one that is defined by companies promising more anonymous interactions than existing popular services.
Danah Boyd, who researches technology adoption and use among teenagers, said that younger Internet users tended to be “far more concerned about people in their immediate world getting access to their content than the company itself” as long as it did not disrupt their personal lives.