InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
CFPB Reports on Underserved Consumers' Use of Mobile Financial Services
On November 5, the CFPB published a report titled "Mobile Financial Services" to summarize the results of its June 2014 Request for Information on the opportunities and challenges associated with the use of mobile financial services (MFS) by traditionally underserved consumers. With 44% of unbanked individuals owning a smartphone, the report notes that MFS has the potential to be a promising tool for underbanked and unbanked consumers to manage their finances. According to the report, consumers using MFS save time and money because they can check their balances any time and have access to certain tools that help them manage their money. The report highlights mobile Remote Deposit Capture as particularly attractive to unbanked consumers because it allows them to take a picture of and deposit checks remotely, reducing the limitations of branch hours and locations. Additional key takeaways from the report include: (i) MFS would likely be most effective for underserved consumers if paired with consultative or assistance services; (ii) privacy and security concerns remain a significant risk; and (iii) digital access and digital financial literacy need improvement, such as enhancing affordable access to technology and educating consumers and intermediaries about safe and effective use of the technology.
Mobile App Developer Settles with FTC and New Jersey AG Over Virtual Currency Mining
On June 29, a mobile app developer entered into an agreement with the FTC and the New Jersey AG to settle allegations that the developer engaged in deceptive and unfair practices by marketing its rewards app, called “Prized,” as being free of malicious software, also known as “malware.” However, according to the FTC, the true purpose of the mobile app was to uploaded malware onto consumers’ mobile devices capable of mining virtual currencies for the software developer. This process allegedly reduced the battery life of consumers’ devices and caused consumers to burn through their monthly data plans. Under terms of settlement, the developer and accompanying mobile app are (i) prohibited from creating and distributing malicious software, and (ii) required to pay $50,000 to the state of New Jersey, with $5,200 due immediately, and the remaining $44,800 payable if the developer fails to comply with the terms of the consent order or the New Jersey Consumer Fraud Act within three years of the order.
FTC Finalizes Mobile Application Privacy Settlements
On August 19, the FTC approved final orders resolving allegations that two companies: (i) misrepresented the level of security of their mobile applications; and (ii) failed to secure the transmission of millions of consumers’ sensitive personal information. The FTC alleged that one company’s application assured consumers that their credit card information was stored and transmitted securely even though the company disabled a higher level of security validation, which allowed such credit card information to be intercepted. In addition, the company allegedly failed to have an adequate process for receiving vulnerability reports from security researchers and other third parties. The FTC alleged that the second company also disabled enhanced security validation despite claiming that it followed industry-leading security precautions, which also left consumers’ information vulnerable to interception. The final settlement orders require both companies to establish comprehensive programs designed to address security risks during the development of their applications and to undergo independent security assessments every other year for the next 20 years. The settlements also prohibit the companies from misrepresenting the level of privacy or security of their products and services.
FTC Reports Mobile Shopping App Consumer Disclosures Are Insufficient
On August 1, the FTC released a staff report on the agency’s review of shopping apps—those used for comparison shopping, to collect and redeem deals and discounts, and to complete in-store purchases. The FTC staff examined information available to consumers before they download the software onto their mobile devices—specifically, information describing how apps that enable consumers to make purchases dealt with fraudulent or unauthorized transactions, billing errors, or other payment-related disputes. The staff also assessed information on how the apps handled consumer data. The FTC staff determined that the apps studied “often failed to provide pre-download information on issues that are important to consumers.” For example, according to the report, few of the in-store purchase apps provided any information prior to download explaining consumers’ liability or describing the app’s process for handling payment-related disputes. In addition, according to the FTC, most linked privacy policies “used vague language that reserved broad rights to collect, use, and share consumer data, making it difficult for readers to understand how the apps actually used consumer data or to compare the apps’ data practices.” The FTC staff recommends that companies that provide mobile shopping apps to consumers: (i) disclose consumers’ rights and liability limits for unauthorized, fraudulent, or erroneous transactions; (ii) clearly describe how they collect, use, and share consumer data; and (iii) ensure that their strong data security promises translate into strong data security practices. The report also includes recommended practices for consumers.
CFPB Begins Collecting Input On Mobile Financial Services
On June 11, the CFPB released a request for information (RFI) about how consumers are using mobile financial services (MFS) to access products and services, manage finances, and achieve financial goals, with a focus on “economically vulnerable” consumers. The request does not cover point of sale payments, except with respect to mobile payment products targeted to underserved consumers. The request states that the information will be used to inform the CFPB’s “consumer education and empowerment strategies.” On June 12, the CFPB hosted a field hearing on MFS, which included presentations from consumer advocates and emerging mobile services providers regarding the future potential of MFS to reach the underserved.
To start the field hearing, Director Corday described the growth of technology in financial services and stressed the importance of understanding and encouraging the benefits of innovation without undermining the equally important goal of protecting consumers in the marketplace. He acknowledged that the FDIC and Federal Reserve have already done substantial work in the area of mobile banking services, and explained that the CFPB is now seeking to further those efforts through the RFI, which will help the CFPB: (i) explore how mobile services provide access to consumers that cannot easily access current financial services; and (ii) learn more about the real time money management opportunities mobile devices provide.
The CFPB’s inquiry also will review potential risks to consumers presented by MFS. For example, parts of the field hearing related to consumer data security, and panelists broadly described other potential risks related to online disclosures,along with the potential for mobile products or services to circumvent other existing consumer protections. In addition, the RFI seeks information that could serve regulatory and enforcement purposes. For example, the CFPB asks (i) whether there is a “risk that data will be used to direct underserved consumers to higher-cost products and services than they would otherwise be eligible to purchase and that may pose greater risk of financial harm;” and (ii) whether “low income consumers are less likely to detect hidden fees, and, if so, whether special attention needs to be provided to the design of mobile payments products targeted at low income consumers.”
Comments in response to the RFI are on or before September 10, 2014.
CFPB Announces Mobile Financial Services Field Hearing
On June 3, the CFPB announced that it will hold a field hearing on mobile financial services on June 12, 2014, in New Orleans, LA. The event is open to members of the public who RSVP and also will be streamed live on the CFPB’s website. Consistent with the CFPB’s past practice of providing limited advance information about field hearings, the announcement states only that the event will feature remarks from Director Richard Cordray, as well as testimony from consumer groups, industry representatives, and members of the public.
FTC Seeks Further Public Comment On Mobile Security
On April 17, the FTC announced it is seeking additional public comments on issues explored during a 2013 forum on mobile security. The announcement includes a series of specific questions within the following categories: (i) secure platform design; (ii) secure distribution channels; (iii) secure development practices; and (iv) security lifecycle and updates. The announcement indicates that the FTC is planning a report based on the forum and this subsequent information request. Comments are due by May 30, 2014.
FTC Announces Settlement Over In-App Purchases By Minors
On January 15, the FTC announced that a major mobile technology company agreed to resolve allegations that it violated Section 5 of the FTC Act by failing to inform account holders that entering their password on their mobile device would open a 15-minute window in which children could incur unlimited charges within certain mobile applications with no further action from the account holder (in-app purchases). The settlement is open to public comment through February 14, 2014. Once finalized, the proposed settlement will require the company to refund at least $32.5 million to consumers who allegedly were billed for accidental or unauthorized in-app purchases by minors. The company will manage the remuneration process, including by providing notice to consumers and providing refunds promptly upon consumer request. Any funds remaining after 12 months of the final agreement must be remitted to the FTC. The company also must alter its billing practices to ensure it obtains express, informed consent before charging accountholders for in-app purchases.
EU Working Group Advises Companies On Obtaining Consent For Cookies
On October 8, the EU’s Article 29 Data Protection Working Party, which represents all 28 data protection authorities of the EU countries, released a document to provide guidance to website operators for obtaining consent for use of cookies on their websites. The guidance notes that implementation of the e-Privacy Directive that requires such consent varies by member state, and that practices for obtaining user consent for storage of or access to cookies also vary. The Working Party therefore identifies the main elements of valid consent, implementation of which would ensure compliance with each member state’s implementation of the directive: (i) specific information, (ii) timing, (iii) active choice, and (iv) freely given. The document provides further detail on each of the elements.
California Enacts First Online Tracking Bill, Expands Breach Notice Requirements
On September 27, California became the first state to enact online tracking legislation, which requires website operators to disclose how they respond to “do not track” signals or other mechanisms that provide consumers a choice regarding the collection of personally identifiable information about an individual consumer’s online activities over time and across different sites or online services. The bill requires operators to disclose whether other parties have access to a consumer’s personally identifiable information when a consumer uses the operator’s site or service. The state also enacted SB 46, which expands the state’s data breach notice law (i) to apply to certain personal information that would permit access to an online account—user name or email address, in combination with a password or security question and answer, and (ii) to require that in such cases, security breach notification be made by sending notice using a method other than email. Both bills take effect on January 1, 2014.