The FCCs' Enforcement Bureau said Wednesday (Sept. 3) that Verizon has agreed to pay $7.4 million to resolve allegations that it used the personal info (CPNI) of some two million new customers for marketing campaigns without providing the required notice or choice.
Verizon says that the information was not shared with third parties, was instead used by Verizon to market to those customers, that remedial steps were taken, and that the omission was inadvertent.
The full consent decrees is here.
The bureau alleged that Verizon had used their information to market services to them before informing those new customers, either on their first invoices or in "welcome" letters, of their privacy rights, including how to opt out of that information collection and use.
In addition to the payment, the FCC says Verizon has agreed to notify customers of their opt-out rights on every bill for three years.
Verizon had sent opt-out notices to many of its customers, but the FCC said that starting in 2006, and "continuing for several years thereafter," it had failed to generate those required notices for about two million customers, "depriving them of their right to deny Verizon permission to access or use their personal information for certain marketing purposes."
The FCC also said Verizon did not discover the omission until September 2012, and then did not inform the FCC until January 2013.
Verizon says that by March of 2013, it had sent opt out notices to all the affected subs. The company also said it halted all marketing to the affected customers until it could correct the billing system and has "implemented a new program to place the CPNI opt-out notice on every invoice each month for all consumer and small and medium business customers."
"In today's increasingly connected world, it is critical that every phone company honor its duty to inform customers of their privacy choices and then to respect those choices," said Acting Enforcement Bureau Chief Travis LeBlanc of the settlement. "It is plainly unacceptable for any phone company to use its customers' personal information for thousands of marketing campaigns without even giving them the choice to opt out."
"The issue here was that a notice required by FCC rules inadvertently was not provided to certain of Verizon's wireline customers before they received marketing materials from Verizon for other Verizon services that might be of interest to them," Verizon said in a statement. "It did not involve a data breach or an unauthorized disclosure of customer information to third parties. Verizon takes seriously its obligation to comply with all FCC rules, and once we discovered the issue with the notices we informed the FCC, fixed the problem and implemented a number of measures to ensure it does not recur."