Path, designed as a more private social network than the behemoth Facebook, has been busted for violating user privacy.
The U.S. Federal Trade Commission found that Path had violated the commission's data collection rules. The company has agreed to pay $800,000 to the government to settle charges that it collected personal data from children using the service.
Path limits a user's network to 150 people. The company says on its site that the app was designed for sharing "in a trusted, intimate environment like the dinner table at home." But the FTC decided Path wasn't as trustworthy as it claimed.
Any site or app that allows users under age 13 must comply with the Children's Online Privacy Protection Act (COPPA), a federal law that requires parental permission before data can be collected from children. Most social networks simply don't allow kids to join, in order to avoid a long list of extra legal requirements.
COPPA also says that a company has to know it is collecting data from kids. Path asks for user birthdays, and that's one way it got in trouble with the FTC.
The company also collected information from users' address books in their phones once the app had received permission. Path automatically collected names, phone numbers and other details, regardless of whether the Path user later shared posts with those people, a practice that the FTC said was deceptive.
Path said in a blog post that there was a period of time when its system did not automatically reject people who indicated they were under 13. It did not address the other FTC issues.
"Before the FTC reached out to us, we discovered and fixed this sign-up process qualification, and took further action by suspending any under age accounts that had mistakenly been allowed to be created," Path said.
Path has already deleted the information that it collected during the time period when its intrusive practices were in place, amounting to about 3,000 accounts, the FTC said in a statement.
The FTC has also required Path to revamp its privacy policy and submit its policies to annual assessment for the next 20 years.
But the company's terms of service remain vague — symptomatic of a problem affecting all social networks. Path, like Twitter, requires users to be of legal age to enter into a contract, which would mean 18 in most states. But in reply to a question from TechNewsDaily, the company said that the age requirement is simply to be 13 or older, the same age that Facebook, Instagram, Pinterest and Tumblr adhere to.
In response to our request for clarification, a Path spokeswoman said, "Legal age for social networks is 13. We have no plans to allow users under the age of 13 to use the Path service."