[Federal Register Volume 86, Number 14 (Monday, January 25, 2021)]
[Notices]
[Pages 6888-6891]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2021-01430]


=======================================================================
-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

[File No. 192 3172]


Everalbum, Inc.; Analysis of Proposed Consent Order To Aid Public 
Comment

AGENCY: Federal Trade Commission.

ACTION: Proposed consent agreement; request for comment.

-----------------------------------------------------------------------

SUMMARY: The consent agreement in this matter settles alleged 
violations of federal law prohibiting unfair or deceptive acts or 
practices. The attached Analysis of Proposed Consent Order to Aid 
Public Comment describes both the allegations in the draft complaint 
and the terms of the consent order--embodied in the consent agreement--
that would settle these allegations.

DATES: Comments must be received on or before February 24, 2021.

ADDRESSES: Interested parties may file comments online or on paper by 
following the instructions in the Request for Comment part of the 
SUPPLEMENTARY INFORMATION section below. Please write ``Everalbum, 
Inc.; File No. 192 3172'' on your comment, and file your comment online 
at https://www.regulations.gov by following the instructions on the 
web-based form. If you prefer to file your comment on paper, mail your 
comment to the following address: Federal Trade Commission, Office of 
the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), 
Washington, DC 20580, or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW, 5th Floor, Suite 5610 (Annex D), Washington, DC 
20024.

FOR FURTHER INFORMATION CONTACT: James Trilling (202-326-3497), Bureau 
of Consumer Protection, Federal Trade Commission, 600 Pennsylvania 
Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: Pursuant to Section 6(f) of the Federal 
Trade Commission Act, 15 U.S.C. 46(f), and FTC Rule 2.34, 16 CFR 2.34, 
notice is hereby given that the above-captioned consent agreement 
containing a consent order to cease and desist, having been filed with 
and accepted, subject to final approval, by the Commission, has been 
placed on the public record for a period of thirty (30) days. The 
following Analysis to Aid Public Comment describes the terms of the 
consent agreement and the allegations in the complaint. An electronic 
copy of the full text of the consent agreement package can be obtained 
at https://www.ftc.gov/news-events/commission-actions.
    You can file a comment online or on paper. For the Commission to 
consider your comment, we must receive it on or before February 24, 
2021. Write ``Everalbum, Inc.; File No. 192 3172'' on your comment. 
Your comment--including your name and your state--

[[Page 6889]]

will be placed on the public record of this proceeding, including, to 
the extent practicable, on the https://www.regulations.gov website.
    Due to the COVID-19 pandemic and the agency's heightened security 
screening, postal mail addressed to the Commission will be subject to 
delay. We strongly encourage you to submit your comments online through 
the https://www.regulations.gov website.
    If you prefer to file your comment on paper, write ``Everalbum, 
Inc.; File No. 192 3172'' on your comment and on the envelope, and mail 
your comment to the following address: Federal Trade Commission, Office 
of the Secretary, 600 Pennsylvania Avenue NW, Suite CC-5610 (Annex D), 
Washington, DC 20580; or deliver your comment to the following address: 
Federal Trade Commission, Office of the Secretary, Constitution Center, 
400 7th Street SW, 5th Floor, Suite 5610 (Annex D), Washington, DC 
20024. If possible, submit your paper comment to the Commission by 
courier or overnight service.
    Because your comment will be placed on the publicly accessible 
website at https://www.regulations.gov, you are solely responsible for 
making sure your comment does not include any sensitive or confidential 
information. In particular, your comment should not include sensitive 
personal information, such as your or anyone else's Social Security 
number; date of birth; driver's license number or other state 
identification number, or foreign country equivalent; passport number; 
financial account number; or credit or debit card number. You are also 
solely responsible for making sure your comment does not include 
sensitive health information, such as medical records or other 
individually identifiable health information. In addition, your comment 
should not include any ``trade secret or any commercial or financial 
information which . . . is privileged or confidential''--as provided by 
Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 
16 CFR 4.10(a)(2)--including in particular competitively sensitive 
information such as costs, sales statistics, inventories, formulas, 
patterns, devices, manufacturing processes, or customer names.
    Comments containing material for which confidential treatment is 
requested must be filed in paper form, must be clearly labeled 
``Confidential,'' and must comply with FTC Rule 4.9(c). In particular, 
the written request for confidential treatment that accompanies the 
comment must include the factual and legal basis for the request, and 
must identify the specific portions of the comment to be withheld from 
the public record. See FTC Rule 4.9(c). Your comment will be kept 
confidential only if the General Counsel grants your request in 
accordance with the law and the public interest. Once your comment has 
been posted on the https://www.regulations.gov website--as legally 
required by FTC Rule 4.9(b)--we cannot redact or remove your comment 
from that website, unless you submit a confidentiality request that 
meets the requirements for such treatment under FTC Rule 4.9(c), and 
the General Counsel grants that request.
    Visit the FTC website at http://www.ftc.gov to read this Notice and 
the news release describing the proposed settlement. The FTC Act and 
other laws that the Commission administers permit the collection of 
public comments to consider and use in this proceeding, as appropriate. 
The Commission will consider all timely and responsive public comments 
that it receives on or before February 24, 2021. For information on the 
Commission's privacy policy, including routine uses permitted by the 
Privacy Act, see https://www.ftc.gov/site-information/privacy-policy.

Analysis of Proposed Consent Order To Aid Public Comment

    The Federal Trade Commission (``Commission'' or ``FTC'') has 
accepted, subject to final approval, an agreement containing a consent 
order from Everalbum, Inc., also doing business as Ever and Paravision 
(``Everalbum'' or ``Respondent''). The proposed consent order 
(``proposed order'') has been placed on the public record for thirty 
(30) days for receipt of comments from interested persons. Comments 
received during this period will become part of the public record. 
After thirty (30) days, the Commission again will review the agreement 
and the comments received, and will decide whether it should withdraw 
from the agreement or make final the agreement's proposed order.
    Since 2015, Everalbum has operated ``Ever,'' a photo storage and 
organization application available as an iOS or Android mobile 
application (``app'') and in web and desktop formats. Ever allows 
consumers to upload photos and videos (collectively, ``content'') from 
mobile devices, computers, or social media or cloud-based storage 
service accounts to Ever's cloud servers. In February 2017, Everalbum 
launched a new feature of the Ever mobile app, called ``Friends.'' The 
Friends feature uses face recognition to organize users' photos by 
faces of the people who appear in them. When Everalbum launched the 
Friends feature, it enabled face recognition by default for all users 
of the Ever mobile app.
    Everalbum's application of face recognition to Ever app users' 
content has not been limited to providing the Friends feature. The 
Commission's proposed complaint alleges that, in four instances, 
Everalbum used images it extracted from Ever users' photos in the 
development of face recognition technology. In one such instance, 
Everalbum used the resulting face recognition technology both in the 
Ever app and to build the face recognition services offered by its 
enterprise brand, Paravision (formerly Ever AI).
    The proposed two-count complaint alleges that Everalbum violated 
Section 5(a) of the FTC Act by misrepresenting the company's practices 
with respect to Ever users' content.
    Proposed complaint Count I alleges that Everalbum misrepresented 
the circumstances under which the company would apply face recognition 
to Ever users' content. According to the proposed complaint, Everalbum 
published a help article entitled ``What is Face Recognition?'' on its 
website in July 2018. The proposed complaint alleges that the help 
article represented that the Ever app's ``Friends'' feature was not 
active--and, therefore, that Everalbum would not apply face recognition 
technology to users' content--unless users affirmatively enabled the 
feature. The proposed complaint further alleges that the help article 
was false or misleading, because, until April 2019, for users in most 
geographic locations, Everalbum applied face recognition to users' 
content by default and users could not use an app setting to turn off 
face recognition.
    Proposed complaint Count II alleges that Everalbum misrepresented 
that the company would delete the content of Ever users who chose to 
deactivate their Ever accounts. According to the proposed complaint, 
when Ever users sought to deactivate their accounts, Everalbum 
presented them with pop-up messages that represented that account 
deactivation would result in Everalbum deleting their content. The 
proposed complaint alleges that Everalbum also made a similar 
representation in response to consumer inquiries and in its privacy 
policy. Despite its representations, Everalbum allegedly did not delete 
any users' content upon account deactivation and instead stored the 
content indefinitely.
    The proposed order contains provisions to address Respondent's 
conduct and prevent it from engaging in the same or similar acts or 
practices in

[[Page 6890]]

the future. Provision I of the proposed order prohibits Respondent from 
making misrepresentations related to the collection, use, disclosure, 
maintenance, or deletion of Covered Information (as defined in the 
order); consumers' ability to control any of these actions; the extent 
to which Everalbum accesses or permits access to Covered Information; 
the extent, purpose, and duration of Everalbum's retention of Covered 
Information after consumers deactivate their accounts; or the extent to 
which Everalbum otherwise protects the privacy, security, availability, 
confidentiality, or integrity of any Covered Information.
    Part II of the proposed order requires Respondent to clearly and 
conspicuously disclose, and obtain consumers' affirmative express 
consent for, all purposes for which it will use or share User's 
Biometric Information before using the information to create data 
needed for face recognition analysis or to develop face recognition 
models or algorithms.
    Part III of the proposed order requires Respondent to delete (A) 
photos and videos of Ever app Users who requested deactivation of their 
accounts, (B) face recognition data that it created without obtaining 
Users' affirmative express consent, and (C) models and algorithms it 
developed in whole or in part using images from Users' photos.
    Parts IV through VII of the proposed order are reporting and 
compliance provisions, which include recordkeeping requirements and 
provisions requiring Respondent to provide information or documents 
necessary for the Commission to monitor compliance. Part VIII of the 
proposed order states that the order will remain in effect for 20 
years, with certain exceptions.
    The purpose of this analysis is to aid public comment on the 
proposed order. It is not intended to constitute an official 
interpretation of the complaint or proposed order, or to modify in any 
way the proposed order's terms.

    By direction of the Commission.
April J. Tabor,
Acting Secretary.

Statement of Commissioner Rohit Chopra in the Matter of Everalbum, Inc.

    Today's facial recognition technology is fundamentally flawed and 
reinforces harmful biases. I support efforts to enact moratoria or 
otherwise severely restrict its use. Until such time, it is critical 
that the FTC meaningfully enforce existing law to deprive wrongdoers of 
technologies they build through unlawful collection of Americans' 
facial images and likenesses.
    The case of Everalbum is a troubling illustration of just some of 
the problems with facial recognition. Everalbum operates a business 
line called Paravision, which developed and marketed facial recognition 
technology, including to clients in the security and air travel 
industries.\1\ The company enhanced their facial recognition technology 
by allegedly baiting consumers into using Ever, a ``free'' app that 
allowed users to store and modify photos.\2\
---------------------------------------------------------------------------

    \1\ Paravision, https://www.paravision.ai/ (last visited on Jan. 
4, 2020).
    \2\ Compl., In the Matter of Everalbum, Inc., Comm'n File No. 
1923172. This is not the only photo-sharing application that has 
drawn scrutiny for its ties to facial recognition and surveillance 
technology. Kashmir Hill & Aaron Krolik, How Photos of Your Kids Are 
Powering Surveillance Technology, N.Y. Times (Oct. 11, 2019), 
https://www.nytimes.com/interactive/2019/10/11/technology/flickr-facial-recognition.html.
---------------------------------------------------------------------------

    As outlined in the complaint, Everalbum made promises that users 
could choose not to have facial recognition technology applied to their 
images, and that users could delete the images and their account. In 
addition to those promises, Everalbum had clear evidence that many of 
the photo app's users did not want to be roped into facial recognition. 
The company broke its promises, which constitutes illegal deception 
according to the FTC's complaint. This matter and the FTC's proposed 
resolution are noteworthy for several reasons.
    First, the FTC's proposed order requires Everalbum to forfeit the 
fruits of its deception. Specifically, the company must delete the 
facial recognition technologies enhanced by any improperly obtained 
photos. Commissioners have previously voted to allow data protection 
law violators to retain algorithms and technologies that derive much of 
their value from ill-gotten data.\3\ This is an important course 
correction.
---------------------------------------------------------------------------

    \3\ The Commission voted 3-2 on a settlement with Google and 
YouTube that allowed the companies to retain algorithms and other 
technologies enhanced by illegally obtained data on children. Based 
on my analysis, the Commission also allowed Google and YouTube to 
profit from their conduct, even after paying a civil penalty. See 
Dissenting Statement of Commissioner Rohit Chopra In the Matter of 
Google LLC and YouTube, LLC, Comm'n File No. 1723083 (Sep. 4, 2019), 
https://www.ftc.gov/public-statements/2019/09/statement-commissioner-rohit-chopra-regarding-youtube. The Commission voted 3-
2 on a settlement with Facebook to address unlawful facial 
recognition practices that violated a 2012 Commission order. Like 
the Google/YouTube settlement, Facebook was not required to forfeit 
any facial recognition or other related technologies. The settlement 
also provided an unusual immunity clause for senior executives, 
including Mark Zuckerberg and Sheryl Sandberg. See also Dissenting 
Statement of Commissioner Rohit Chopra In re Facebook, Inc., Comm'n 
File No. 1823109 (Jul. 24, 2019), https://www.ftc.gov/public-statements/2019/07/dissenting-statement-commissioner-rohit-chopra-regarding-matter-facebook.
---------------------------------------------------------------------------

    Second, the settlement does not require the defendant to pay any 
penalty. This is unfortunate. To avoid this in the future, the FTC 
needs to take further steps to trigger penalties, damages, and other 
relief for facial recognition and data protection abuses. Commissioners 
have voted to enter into scores of settlements that address deceptive 
practices regarding the collection, use, and sharing of personal data. 
There does not appear to be any meaningful dispute that these practices 
are illegal. However, since Commissioners have not restated this 
precedent into a rule under Section 18 of the FTC Act, we are unable to 
seek penalties and other relief for even the most egregious offenses 
when we first discover them.\4\
---------------------------------------------------------------------------

    \4\ Statement of Commissioner Rohit Chopra Regarding the Report 
to Congress on Protecting Older Adults, Comm'n File No. P144400 
(Oct. 19, 2020), https://www.ftc.gov/public-statements/2020/10/statement-commissioner-rohit-chopra-regarding-report-congress-protecting; Rohit Chopra & Samuel A.A. Levine, The Case for 
Resurrecting the FTC Act's Penalty Offense Authority (Oct. 29, 
2020), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3721256.
---------------------------------------------------------------------------

    Finally, the Everalbum matter makes it clear why it is important to 
maintain states' authority to protect personal data. Because the people 
of Illinois, Washington, and Texas passed laws related to facial 
recognition and biometric identifiers, Everalbum took greater care when 
it came to individuals in these states.\5\ The company's deception 
targeted Americans who live in states with no specific state law 
protections.
---------------------------------------------------------------------------

    \5\ Compl., supra note 2.
---------------------------------------------------------------------------

    With the tsunami of data being collected on individuals, we need 
all hands on deck to keep these companies in check. State and local 
governments have rightfully taken steps to enact bans, moratoria, and 
other restrictions on the use of these technologies. While special 
interests are actively lobbying for federal legislation to delete state 
data protection laws, it will be important for Congress to resist these 
efforts. Broad federal preemption would severely undercut this multi-
front approach and leave more consumers less protected.
    It will be critical for the Commission, the states, and regulators 
around the globe to pursue additional enforcement actions to hold 
accountable providers of facial recognition technology who make

[[Page 6891]]

false accuracy claims and engage in unfair, discriminatory conduct.\6\
---------------------------------------------------------------------------

    \6\ Prepared Remarks of Commissioner Rohit Chopra at Asia 
Pacific Privacy Authorities 54th APPA Forum (Dec. 7, 2020), https://www.ftc.gov/public-statements/2020/12/prepared-remarks-commissioner-rohit-chopra-asia-pacific-privacy.

[FR Doc. 2021-01430 Filed 1-22-21; 8:45 am]
BILLING CODE 6750-01-P