The FTC announced today that Frostwire LLC and its managing member, Angel Leon, have agreed to settle charges that its peer-to-peer file sharing software caused “consumers to unwittingly expose sensitive personal files stored on their mobile devices, and that it misled consumers about which downloaded files from their desktop and laptop computers would be shared with a file-sharing network.”
According to the complaint, in its Android App, Frostwire imposed the decidedly risky default sharing setting that all content would be shared, with no explanation that the sharing applied to pre-existing content, as well as future downloaded and user-generated content. In addition, even if a user realized the scope of the sharing and wanted to change the settings later, they were “extremely difficult to change,” Jon Leibowitz, the FTC’s chairman, claimed during a privacy conference Tuesday. Thus, if a user later wanted to change or limit the sharing, according to the complaint, they had to go through a laborious manual process. “Thus, for example, a consumer with 200 photos on her mobile device who installed the application with the intent of sharing only ten of those photos first had to designate all 200 photos in the ‘Picture’ category as shared, and then affirmatively unshare each of the 190 photos that she wished to keep private. She also needed to remember, when next running the application, to unshare the category or individually unshare any new photos she might have taken in the meantime in order to keep the new photos private.”
With respect to the desktop software, the FTC also alleged that the installation process for the desktop version of the software did not adequately describe what files would be shared, causing it to be deceptive. The FTC claimed that a typical consumer would have believed that the default setting in the installation process would allow for sharing in only certain of the folders in the application, whereas in actuality, the default setting was to share all content in all folders.
In the settlement, which is subject to court approval, Frostwire agrees to make the default setting that content is not automatically shared; to make affirmative selection of files, with confirmation after clear and prominent disclosure, necessary before sharing; to simplify the process for changing the sharing settings; and to upgrade legacy versions of the software to be consistent with these changes. No monetary penalty was imposed.
Frostwire’s App took the most aggressive position in three important areas: 1) it made the default an opt-out; 2) it provided almost no information about the scope and nature of the sharing; and 3) it made changes to the settings arduous. A different stance in any one area may have been enough to prevent the FTC from bringing this case – and two certainly would have done the trick.
