Twitter reused 2FA phone numbers for ads — a $150M FTC penalty

From 2013, Twitter asked users to supply a phone number or email address to improve account security — to reset passwords, unlock flagged accounts and enable two-factor authentication. The company told users this information would help secure their accounts, and nothing more.

From 2014 to 2019, more than 140 million users handed over their details. Twitter, however, failed to mention that it would also use the numbers and emails for targeted advertising, letting advertisers match the data against their own lists or data-broker information to serve specific ads to specific people.

On 25 May 2022, the FTC and the Department of Justice announced a proposed order requiring Twitter to pay a $150 million civil penalty. The FTC alleged the practice was deceptive and violated the FTC Act, the EU-U.S. and Swiss-U.S. Privacy Shield agreements, and a 2011 FTC order that separately barred Twitter from misrepresenting its privacy and security practices.

Beyond the fine, the order barred Twitter from profiting from the deceptively collected data, required it to notify affected users that their security data had also been used to target ads, and forced it to offer other multi-factor authentication options that do not depend on a phone number.