UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, D.C. 20580

Office of the Secretary

March 2, 2011

Alex Radocea

State of New York

Re: In the Matter of Twitter, Inc., File No. 092 3093, Docket No. C-4316

Thank you for your comment on the Federal Trade Commission’s consent agreement in

the above-entitled proceeding. The Commission has placed your comment on the public record

pursuant to Rule 4.9(b)(6)(ii) of the Commission’s Rules of Practice, 16 C.F.R. § 4.9(b)(6)(ii),

and has given it serious consideration. 

Your comment raises several concerns about the proposed agreement. First, your

comment questions the Commission’s allegation that Twitter engaged in deceptive acts or

practices in violation of the law, noting that Twitter “made no claims to be perfectly secure,” had

a security policy in place concerning administrative access at the time hackers gained

administrative control of its system, and publicly disclosed the breaches shortly after they

occurred. In response, the Commission notes that its complaint is based on Twitter’s

representation that it used reasonable and appropriate measures to prevent unauthorized access to

nonpublic user information and honor the privacy choices exercised by users. The Commission

does not allege that Twitter claimed perfect security for users’ information. Although Twitter

may have had a policy in place for securing administrative control of its system, the complaint

alleges that the policy as a whole failed to provide the reasonable and appropriate security

measures the company had promised to consumers. The Commission shares your view that a

company’s prompt disclosure of a breach is important. However, such disclosure does not

relieve the company of liability for false or misleading statements previously made concerning

its information security. 

Further, your comment states that the data security measures identified in the

Commission’s complaint would not have prevented the second breach of Twitter’s system. The

Commission believes that, in fact, the measures identified are directly related to the

vulnerabilities that led to the breach and would have made it far more difficult for the breach to

occur. Moreover, although these measures are important elements of a reasonable security

program, the Commission does not contend that they would prevent all breaches or create a

perfectly secure environment. Indeed, this is why the order is not limited to requiring these

measures; rather, it requires reasonable security throughout the company’s operations. 

Finally, your comment states that Twitter maintains “little private personal information”

concerning consumers and that, therefore, the Commission could better address consumer

privacy concerns raised by social networking platforms by focusing on companies other than

Twitter. In response, the Commission notes that Twitter has maintained a significant amount of
information that it designates as nonpublic. In addition to email addresses for each user,

nonpublic information maintained by Twitter includes users’ IP addresses, mobile telephone

numbers, and large amounts of user-generated content that users themselves have designated as

“private.” Significantly for purposes of this action, Twitter promised consumers that it would

take reasonable steps to protect their nonpublic information, but the Commission believes that it

failed to do so. Accordingly, the Commission’s action here is clearly warranted.

Although the portion of your comment concerning social networking platforms other

than Twitter are beyond the scope of the Commission’s complaint and order in this case, the

Commission notes that it will remain vigilant in pursuing enforcement against companies

engaged in deceptive or unfair conduct relating to consumer privacy.

In light of these considerations, the Commission has determined that the public interest

would best be served by issuing the Decision and Order in final form without any modifications. 

The final Decision and Order and other relevant materials are available from the Commission’s

website at http://www.ftc.gov. It helps the Commission’s analysis to hear from a variety of

sources in its work, and it thanks you again for your comment.

By direction of the Commission.

Donald S. Clark

Secretary