FTC Settles with Match and OkCupid Over Clandestine 2014 Transfer of 3 Million User Photos to Facial Recognition Firm Clarifai
The Federal Trade Commission's March 30 consent order would permanently prohibit OkCupid and Match Group from misrepresenting their data practices after sharing nearly 3 million user photos with facial recognition firm Clarifai in 2014, but levies no civil penalty and no privacy program obligations.
Overview
The U.S. Federal Trade Commission announced on March 30 a proposed consent order with Match Group Americas and Humor Rainbow, Inc., the Dallas-based operator of OkCupid, resolving allegations that the dating app transferred nearly three million user photos and associated location and demographic data to the facial recognition company Clarifai in 2014 without user consent and in violation of its own privacy policy. The settlement would permanently prohibit the companies from misrepresenting their data practices but contains no civil penalty and no mandatory comprehensive privacy program, a structure that has drawn attention from privacy practitioners as a notable departure from recent FTC orders.
What We Know
According to the FTC’s press release, OkCupid provided an unauthorized third party with access to the personal data of millions of users in violation of the app’s stated privacy policies. The FTC stated that OkCupid gave the recipient access to nearly three million user photos along with location and other information without placing any formal or contractual restrictions on how the information could be used, and did not inform consumers or give them the chance to opt out.
The third party was Clarifai, an AI company that markets facial recognition and content moderation software, as reported by Engadget. OkCupid’s privacy policy at the time stated the company would not share personal information except with “service providers, business partners, other entities within its family of businesses” — categories that the FTC argued did not include Clarifai.
The proposed settlement was filed in the U.S. District Court for the Northern District of Texas, according to Reuters coverage carried on Yahoo Finance, which reported that Match Group is prohibited from misrepresenting user information privacy, must certify compliance with its privacy obligations, and faces potential civil fines for any future violations. Neither party admitted nor denied wrongdoing, and the settlement requires court approval.
The FTC press release characterized the transfer as a violation of Section 5 of the FTC Act, alleging that OkCupid shared users’ personal data with a party that was not a service provider, business partner, or affiliate and without offering opt-out rights. The proposed consent order would permanently prohibit OkCupid and Match from misrepresenting their information practices and the function of privacy controls or choices presented to consumers.
An OkCupid spokesperson told Engadget the company had settled the matter “with no monetary penalty to resolve an issue from 2014 and move forward,” adding: “While we do not admit any wrongdoing … over the years, we have further strengthened our privacy practices and data governance to ensure we meet the expectations of our users,” according to Engadget. In a separate statement, OkCupid said the behavior “does not reflect how OkCupid operates today,” as Reuters reported via Yahoo Finance.
What We Don’t Know
The public filings summarized in the available coverage do not specify whether the roughly three million photos transferred to Clarifai remained in the company’s possession, whether they were used to train any production facial recognition model, or whether derivative model weights were ever deleted. The FTC press release describes the transfer and the privacy-policy deception but does not announce a data-deletion or model-deletion remedy as part of the proposed order.
It is also unclear how the FTC weighed the absence of a civil penalty against the scale of the data transfer and the alleged duration of the conduct. Unlike several recent FTC privacy orders, the proposed consent order does not appear to impose a mandatory comprehensive information security or privacy program, an independent third-party assessment requirement, or affirmative consumer-notice obligations — relief that has featured prominently in prior Section 5 settlements. Whether that structure reflects a deliberate shift in enforcement posture or the specific facts of this case is a question the settlement record does not directly answer.
Analysis
The OkCupid matter arrives as the FTC is navigating a redefined federal AI posture under the Trump administration’s AI Action Plan, which tasked the agency with clarifying how consumer-protection law applies to AI. The OkCupid order suggests one answer: pursue the conduct under a traditional Section 5 deception theory, centered on the gap between a privacy policy and actual practice, rather than a novel unfairness or AI-specific theory.
For AI developers and data brokers, the order underscores a narrower but still operative rule: whatever a company’s privacy policy promises about third-party sharing must match what actually happens with AI vendors. The absence of a monetary penalty does not dilute that rule; the proposed permanent injunction attaches future civil-fine exposure to any misrepresentation going forward, according to Reuters coverage carried on Yahoo Finance. For users, the remedy is less reassuring. Three million photos transferred in 2014 cannot be recalled by an injunction, and the proposed order’s focus on forward-looking representations rather than retrospective data or model deletion highlights a structural limit of Section 5 as a tool for policing historical data flows into machine-learning systems.