Everalbum, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF EVERALBUM, INC.

D/B/A EVER AND PARAVISION CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4743; File No. 192 3172 Complaint, May 6, 2021 – Decision, May 6, 2021 This consent order addresses Everalbum, Inc.’s use of the Ever mobile app, called “Friends” to develop facial recognition technology. The complaint alleges that Everalbum violated Section 5(a) of the Federal Trade Commission Act by misrepresenting the company’s practices with respect to Ever users’ content and that, in four instances, Everalbum used images it extracted from Ever users’ photos in the development of face recognition technology. The consent order requires Respondent to delete (A) photos and videos of Ever app Users who requested deactivation of their accounts, (B) face recognition data that it created without obtaining Users’ affirmative express consent, and (C) models and algorithms it developed in whole or in part using images from Users’ photos. The consent order also prohibits Respondent from making misrepresentations related to the collection, use, disclosure, maintenance, or deletion of Covered Information (as defined in the order); consumers’ ability to control any of these actions; the extent to which Everalbum accesses or permits access to Covered Information; the extent, purpose, and duration of Everalbum’s retention of Covered Information after consumers deactivate their accounts; or the extent to which Everalbum otherwise protects the privacy, security, availability, confidentiality, or integrity of any Covered Information. Participants For the Commission: James Trilling and Robin Wetherill.

For the Respondents: Michelle Kisloff, Lance Murashige, and Harriet Pearson, of Hogan Lovells US LLP.

COMPLAINT The Federal Trade Commission, having reason to believe that Everalbum, Inc., a corporation (“Respondent”), has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Everalbum, Inc. (“Everalbum”), also doing business as Ever and Paravision, is a Delaware corporation with its principal office or place of business at 1160 Gorgas Ave., San Francisco, California 94129.

2. The acts and practices of Respondent alleged in this Complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act.

VOLUME 171 Complaint EVERALBUM’S BUSINESS PRACTICES 3. Since 2015, Everalbum has provided Ever, a photo storage and organization application, to consumers. Ever is available as both an ios and Android mobile application (“app”), as well as in a web and desktop format. Globally, approximately 12 million consumers have installed Ever.

4. Ever allows consumers to upload photos and videos to Ever’s cloud servers from sources such as the user’s mobile device, computer, or accounts with social media services, such as Facebook or Instagram, or cloud-based storage services, such as Dropbox or One Drive. By storing photos and videos on Ever’s servers, consumers can free up storage space on their devices. Ever uses automated features to organize users’ photos and videos into albums by location and date.

The Ever App’s Face Recognition Feature 5. In February 2017, Everalbum launched its “Friends” feature, which operates on both the ios and Android versions of the Ever app. The Friends feature uses face recognition to group users’ photos by faces of the people who appear in the photos. The user can choose to apply “tags” to identify by name (e.g., “Jane”) or alias (e.g., “Mom”) the individuals who appear in their photos. These tags are not available to other Ever users. When Everalbum launched the Friends feature, it enabled face recognition by default for all users of the Ever mobile app. At that time, Everalbum did not provide users of the Ever mobile app an option to turn off or disable the feature.

6. Starting in May 2018, Everalbum rolled out a process through which Ever presented Ever mobile app users located in Texas, Illinois, Washington, or the European Union with a pop-up message that, as shown below, requests that those users choose whether they would like the Ever application to use face recognition. In so doing, Everalbum disabled the Friends feature and face recognition for those users unless and until they clicked “Yes” to turn on the Friends feature and face recognition. At the same time, Everalbum also introduced into the Ever mobile app a setting that allowed users located in Texas, Illinois, Washington, or the European Union to turn on or off the face recognition feature. EVERALBUM, INC. 725 Complaint 7. In April 2019, Everalbum rolled out to Ever mobile app users located outside of Texas, Illinois, Washington, and the European Union the pop-up message requesting that users choose whether they would like the Ever application to use face recognition. This functioned identically to the pop-up message previously provided to users located in Texas, Illinois, Washington, and the European Union. That is, Everalbum disabled the Friends feature and face recognition unless and until the users clicked “Yes” to turn on the Friends feature and face recognition. At this time, Everalbum also rolled out to all Ever mobile app users the setting that allows users to turn on or off face recognition.

8. Since Everalbum has presented Ever mobile app users with the pop-up message requesting that users choose whether they would like the Ever application to use face recognition, approximately 25% of the approximately 300,000 users who made a selection when presented with the pop-up message chose to turn face recognition off. 9. Since July 2018, Everalbum has posted in the “Help” section of its website, everalbum.com, an article entitled What is Face Recognition? That article includes the following statements:

When face recognition is enabled, the technology analyzes the photos and videos that you upload to create a string of numbers that we call a “face embedding” (emphasis added).

When face recognition is turned on, you are letting us know that it’s ok for us to use the face embeddings of the people in your photos and videos, including you, and that you have the approval of everyone featured in your photos and videos (emphasis added).

10. However, prior to April 2019, Ever mobile app users who were located anywhere other than Texas, Illinois, Washington, and the European Union did not need to, and indeed could not, take any affirmative action to “let[ Everalbum] know” that it should apply face recognition to the users’ photos. In fact, for those users, face recognition was enabled by default and the users lacked the ability to disable it. Thus, the article was misleading for Ever mobile app users located outside of Texas, Illinois, Washington, and the European Union. Everalbum’s Use of Ever Users’ Photos to Train Its Face Recognition Technology 11. Everalbum’s application of face recognition to photos uploaded by Ever mobile app users, in some cases without affirmative express consent, was not limited to providing the Friends feature. When Everalbum initially launched the Ever app’s Friends feature in February 2017, the company used publicly available face recognition technology to power the feature. However, the company quickly began developing its own face recognition technology, including, in four instances, by using images it extracted from Ever users’ photos to attempt to improve the technology.

VOLUME 171 Complaint 12. Between September 2017 and August 2019, Everalbum combined millions of facial images that it extracted from Ever users’ photos with facial images that Everalbum obtained from publicly available datasets in order to create four new datasets to be used in the development of its face recognition technology. In each instance, Everalbum used computer scripts to identify and compile from Ever users’ photos images of faces that met certain criteria (i.e., not associated with a deactivated Ever account, not blurry, not too small, not a duplicate of another image, associated with a specified minimum number of images of the same tagged identity, and, in three of the four instances, not identified by Everalbum’s machines as being an image of someone under the age of thirteen).

13. When compiling the second dataset in April 2018, in addition to applying the criteria described in paragraph 12, Everalbum did not include any facial images extracted from the photos of Ever users Everalbum believed to be residents of either the United States or European Union based on the users’ IP addresses.

14. After testing it, Everalbum discarded the face recognition technology that it developed in the Fall of 2017 and April 2018 using the first two datasets it had compiled by combining facial images it had extracted from Ever user’ photos with facial images obtained from publicly available datasets.

15. When compiling the third dataset in June 2018, in addition to applying the criteria described in paragraph 12, Everalbum excluded facial images extracted from the photos of Ever users Everalbum believed to be residents of Illinois, Texas, Washington, or the European Union based on the users’ IP addresses. In this instance, Everalbum submitted the resulting face recognition technology to the National Institute of Science and Technology for accuracy testing and comparison to competing face recognition technologies. 16. When compiling the fourth dataset in August 2019, in addition to applying the criteria described in paragraph 12, Everalbum excluded facial images extracted from the photos of Ever users who had not either turned on the setting, or clicked “Yes” on the pop-up message, described in paragraphs 6-7 above. Everalbum used the resulting face recognition technology both in the Ever app and to build the face recognition services offered by its enterprise brand, Paravision (formerly Ever AI). Paravision offers its face recognition technology to enterprise customers for purposes such as security, access control, and facilitating payments. Everalbum has not shared images from Ever users’ photos or Ever users’ photos, videos, or personal information with Paravision’s customers.

Everalbum’s Account Deactivation Process 17. Everalbum offers users who no longer wish to use Ever the ability to deactivate their Ever accounts. Since January 2017, approximately 36,000 Ever users have deactivated their accounts.

18. As shown below, when a user chooses to deactivate their Ever account, Everalbum displays a message that tells the user: “We’re sorry to see you go! If you choose to deactivate your account, you will permanently lose access to [##] photos and [##] albums.” (The EVERALBUM, INC. 727 Complaint message specifies the numbers of photos and albums stored in the user’s Ever account.) The message includes a button for the user to click to deactivate their account. 19. If the user clicks the “Deactivate My Account” button, as shown below, Everalbum then displays a second message stating: “Are you sure? You will lose access to your account and we can’t undo this.” That message includes buttons that present the user with the choice to “CANCEL” or “DELETE.”

20. In response to customer inquiries about deleting an Ever account, in multiple instances, Everalbum has stated: “[Y]ou can deactivate your account at any time by signing into our app, going to ‘Settings’ > ‘General Settings’ > ‘Deactivate’. Please note that this will permanently delete all photos and videos stored on your account as well” (emphasis added). VOLUME 171 Complaint 21. Everalbum’s Privacy Policy also states:

If you wish to deactivate your account or request that we no longer use your information to provide you any services or certain services, such as our Friends feature or our face recognition services, you can do that via your account settings, or you can email us at [email protected]. Please understand that we may need to retain and use your information for a certain period of time to comply with our legal obligations, resolve disputes, and enforce our agreements. Consistent with these requirements, we will try to delete your information as soon as possible upon request. Please note, however, that there might be latency in deleting information from our servers and backed-up versions might exist after deletion (emphasis added).

22. Contrary to the statements Everalbum has made that account deactivation will result in Everalbum deleting the user’s photos and videos, until at least October 2019, Everalbum did not, in fact, delete the photos or videos of any users who had deactivated their accounts and instead retained them indefinitely. Everalbum began implementing in October 2019 a practice of deleting all the photos and videos associated with Ever accounts that have been deactivated for more than three months.

Count I Misrepresentation Regarding Ever Users’ Ability to Control the Ever App’s Face Recognition Feature 23. As described in Paragraph 9, Respondent represented, directly or indirectly, expressly or by implication, that Everalbum was not using face recognition unless the user enabled it or turned it on.

24. In fact, as set forth in Paragraphs 5-8 and 10, until April 2019, Everalbum was using face recognition by default for all Ever mobile app users who were located anywhere other than Texas, Illinois, Washington, and the European Union and did not provide those users with a setting to use the app and turn off face recognition. Therefore, the representation set forth in Paragraph 9 is false or misleading.

Count II Misrepresentation Regarding Deletion of Ever Users’ Photos Upon Account Deactivation 25. As described in Paragraphs 18-21, Respondent has represented, directly or indirectly, expressly or by implication, that Everalbum would delete Ever users’ photos and videos upon users’ deactivation of their accounts.

EVERALBUM, INC. 729 Decision and Order 26. In fact, as set forth in Paragraph 22, until October 2019, Everalbum did not delete any Ever users’ photos and videos upon account deactivation and instead stored them indefinitely. Therefore, the representation set forth in Paragraphs 18-21 is false or misleading. Violations of Section 5 27. The acts and practices of Respondent as alleged in this Complaint constitute unfair or deceptive acts or practices, in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this 6th day of May, 2021, has issued this Complaint against Respondent.

By the Commission.

DECISION The Federal Trade Commission (“Commission”) initiated an investigation of certain acts and practices of the Respondent named in the caption. The Commission’s Bureau of Consumer Protection (“BCP”) prepared and furnished to Respondent a draft Complaint. BCP proposed to present the draft Complaint to the Commission for its consideration. If issued by the Commission, the draft Complaint would charge the Respondent with violations of the Federal Trade Commission Act.

Respondent and BCP thereafter executed an Agreement Containing Consent Order (“Consent Agreement”). The Consent Agreement includes: 1) statements by Respondent that it neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Decision and Order, and that only for purposes of this action, it admits the facts necessary to establish jurisdiction; and 2) waivers and other provisions as required by the Commission’s Rules.

The Commission considered the matter and determined that it had reason to believe that Respondent has violated the Federal Trade Commission Act, and that a Complaint should issue stating its charges in that respect. The Commission accepted the executed Consent Agreement and placed it on the public record for a period of thirty (30) days for the receipt and consideration of public comments. The Commission duly considered any comments received from interested persons pursuant to Section 2.34 of its Rules, 16 C.F.R. § 2.34. Now, in further conformity with the procedure prescribed in Rule 2.34, the Commission issues its Complaint, makes the following Findings, and issues the following Order:

VOLUME 171 Decision and Order Findings 1. The Respondent is Everalbum, Inc., also d/b/a Ever and Paravision, a Delaware corporation with its principal office or place of business at 1160 Gorgas Ave., San Francisco, California 94129.

2. The Commission has jurisdiction over the subject matter of this proceeding and over the Respondent, and the proceeding is in the public interest. ORDER Definitions For purposes of this Order, the following definitions apply: A. “Affected Work Product” means any models or algorithms developed in whole or in part using Biometric Information Respondent collected from Users of the “Ever” mobile application.

B. “Biometric Information” means data that depicts or describes the physical or biological traits of an identified or identifiable person, including depictions (including images), descriptions, recordings, or copies of an individual’s facial or other physical features (e.g., iris/retina scans), finger or handprints, voice, genetics, or characteristic movements or gestures (e.g., gait or typing pattern). C. “Clearly and Conspicuously” means that a required disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by ordinary consumers, including in all of the following ways:

1. In any communication that is solely visual or solely audible, the disclosure must be made through the same means through which the communication is presented. In any communication made through both visual and audible means, such as a television advertisement, the disclosure must be presented simultaneously in both the visual and audible portions of the communication even if the representation requiring the disclosure (“triggering representation”) is made through only one means. 2. A visual disclosure, by its size, contrast, location, the length of time it appears, and other characteristics, must stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood.

3. An audible disclosure, including by telephone or streaming video, must be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it.

EVERALBUM, INC. 731 Decision and Order 4. In any communication using an interactive electronic medium, such as the Internet or software, the disclosure must be unavoidable. 5. The disclosure must use diction and syntax understandable to ordinary consumers and must appear in each language in which the triggering representation appears.

6. The disclosure must comply with these requirements in each medium through which it is received, including all electronic devices and face-to­ face communications.

7. The disclosure must not be contradicted or mitigated by, or inconsistent with, anything else in the communication.

8. When the representation or sales practice targets a specific audience, such as children, the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of that group.

D. “Covered Information” means information from or about an individual consumer, including: (1) a first and last name; (2) a physical address; (3) an email address or other online contact information, such as an instant messaging user identifier or a screen name; (4) a telephone number; (5) a Social Security number; (6) a driver’s license or other government-issued identification number; (7) a financial account number; (8) credit or debit card information; (9) photos and videos; (10) Biometric Information; (11) descriptive information derived from Biometric Information, including a Face Embedding; (12) a persistent identifier, such as a customer number held in a “cookie,” a static Internet Protocol (“IP”) address, a mobile device ID, processor serial number, user ID, or any other persistent identifier that can be used to recognize a user over time and/or across different devices, websites or online services; or (13) any information combined with any of (1) through (12) above.

E. “Face Embedding” means data, such as a numeric vector, derived in whole or in part from an image of an individual’s face.

F. “Respondent” means Everalbum, Inc., also doing business as Ever and Paravision, and its successors and assigns.

G. “User” means a person who has downloaded, accessed, and/or used software, such as a mobile application, developed, operated, or offered by Respondent and marketed to consumers for personal use, including the “Ever” mobile application. VOLUME 171 Decision and Order Provisions I. Prohibition against Misrepresentations IT IS ORDERED that Respondent; and Respondent’s officers, agents, and employees; and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service must not misrepresent in any manner, expressly or by implication: A. The extent to which Respondent collects, uses, discloses, maintains, or deletes any Covered Information;

B. The extent to which consumers can control the collection, use, disclosure, maintenance, or deletion of Covered Information;

C. The extent to which Respondent accesses or permits access to Covered Information;

D. The extent to which, purposes for which, or duration of time during which Respondent retains any Covered Information following a consumer’s deletion or deactivation of a user account with Respondent; or E. The extent to which Respondent otherwise protects the privacy, security, availability, confidentiality, or integrity of any Covered Information. II. Notice and Affirmative Express Consent Provision IT IS FURTHER ORDERED that Respondent; and Respondent’s officers, agents, and employees; and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service, prior to using Biometric Information collected from a User to (1) create a Face Embedding or (2) train, develop, or alter any face recognition model or algorithm, must: A. Clearly and Conspicuously disclose to the User from whom Respondent has collected the Biometric Information, separate and apart from any “privacy policy,” “terms of use” page, or other similar document, all purposes for which Respondent will use, and to the extent applicable, share, the Biometric Information; and B. Obtain the affirmative express consent of the User from whom Respondent collected the Biometric Information.

Provided, however, Respondent need not comply with this provision in connection with any product or service that is only offered to Users outside the United States. EVERALBUM, INC. 733 Decision and Order III. Deletion IT IS FURTHER ORDERED that Respondent; and Respondent’s officers, agents, and employees; and all other persons in active concert or participation with any of them, who receive actual notice of this Order, must, unless prohibited by law: A. Within thirty (30) days after the issuance date of this Order, delete or destroy all photos and videos that Respondent collected from Users who requested deactivation of their Ever accounts on or before the issuance date of this Order, and provide a written statement to the Commission, sworn under penalty of perjury, confirming that all such information has been deleted or destroyed; B. Within ninety (90) days after the issuance of this Order, delete or destroy all Face Embeddings derived from Biometric Information Respondent collected from Users who have not, by that date, provided express affirmative consent for the creation of the Face Embeddings, and provide a written statement to the Commission, sworn under penalty of perjury, confirming that all such information has been deleted or destroyed; and C. Within ninety (90) days after the issuance of this Order, delete or destroy any Affected Work Product, and provide a written statement to the Commission, sworn under penalty of perjury, confirming such deletion or destruction. Provided, however, that any photos, videos, Face Embeddings, Affected Work Product, or other matter that Respondent is otherwise required to delete or destroy pursuant to this provision may be retained, and may be disclosed, as requested by a government agency or otherwise required by law, regulation, court order, or other legal obligation, including as required by rules applicable to the safeguarding of evidence in pending litigation. In each written statement to the Commission required by this provision, Respondent shall describe in detail any relevant information that Respondent retains on any of these bases and the specific government agency, law, regulation, court order, or other legal obligation that prohibits Respondent from deleting or destroying such information. Within thirty (30) days after the obligation to retain the information has ended, Respondent shall provide an additional written statement to the Commission, sworn under penalty of perjury, confirming that Respondent has deleted or destroyed such information.

IV. Acknowledgments of the Order IT IS FURTHER ORDERED that Respondent obtain acknowledgments of receipt of this Order:

A. Respondent, within ten (10) days after the issuance date of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.

VOLUME 171 Decision and Order B. For ten (10) years after the issuance date of this Order Respondent must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees, agents, and representatives having managerial responsibilities for conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Reports and Notices. Delivery must occur within ten (10) days after the effective date of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.

C. From each individual or entity to which Respondent delivered a copy of this Order, Respondent must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.

V. Compliance Reports and Notices IT IS FURTHER ORDERED that Respondent make timely submissions to the Commission:

A. One year after the issuance date of this Order, Respondent must submit a compliance report, sworn under penalty of perjury, in which Respondent must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission may use to communicate with Respondent; (b) identify all of the Respondent’s businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (c) describe the activities of each business, including the goods and services offered, what Covered Information is collected, and the means of advertising, marketing, and sales; (d) describe in detail whether and how Respondent is in compliance with each Provision of this Order, including a discussion of all of the changes the Respondent made to comply with the Order; and (e) provide a copy of each Acknowledgment of the Order obtained pursuant to this Order, unless previously submitted to the Commission. B. Respondent must submit a compliance notice, sworn under penalty of perjury, within fourteen (14) days of any change in the following: (a) any designated point of contact or (b) the structure of Respondent or any entity that Respondent has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.

C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against Respondent within fourteen (14) days of its filing.

EVERALBUM, INC. 735 Decision and Order D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if applicable), and signature.

E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to [email protected] or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: “In re Everalbum, Inc., FTC File No. 1923172.” VI. Recordkeeping IT IS FURTHER ORDERED that Respondent must create certain records for ten (10) years after the issuance date of the Order, and retain each such record for five (5) years, unless otherwise specified below. Specifically, Respondent must create and retain the following records:

A. Accounting records showing the revenues from all goods or services sold, the costs incurred in generating those revenues, and resulting net profit or loss; B. Personnel records showing, for each person providing services in relation to any aspect of the Order, whether as an employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;

C. Copies or records of all consumer complaints and refund requests, whether received directly or indirectly, such as through a third party, and any response; D. A copy of each widely disseminated representation by Respondent that describes the extent to which Respondent maintains or protects the privacy, security, availability, confidentiality, or integrity of any Covered Information, including any representation concerning a change in any website, mobile app, or other service controlled by Respondent that relates to privacy, security, availability, confidentiality, or integrity of Covered Information; and E. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission.

VII. Compliance Monitoring IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent’s compliance with this Order:

VOLUME 171 Decision and Order A. Within ten (10) days of receipt of a written request from a representative of the Commission, Respondent must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury, and produce records for inspection and copying.

B. For matters concerning this Order, representatives of the Commission are authorized to communicate directly with Respondent. Respondent must permit representatives of the Commission to interview anyone affiliated with Respondent who has agreed to such an interview. The interviewee may have counsel present. C. The Commission may use all other lawful means, including posing through its representatives as consumers, suppliers, or other individuals or entities, to Respondent or any individual or entity affiliated with Respondent, without the necessity of identification or prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.

VIII. Order Effective Dates IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate twenty (20) years from the date of its issuance (which date may be stated at the end of this Order, near the Commission’s seal), or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Provision in this Order that terminates in less than twenty (20) years; B. This Order if such complaint is filed after the Order has terminated pursuant to this Provision.

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent did not violate any provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

EVERALBUM, INC. 737 Dissenting Statement STATEMENT OF COMMISSIONER ROHIT CHOPRA Today’s facial recognition technology is fundamentally flawed and reinforces harmful biases. I support efforts to enact moratoria or otherwise severely restrict its use. Until such time, it is critical that the FTC meaningfully enforce existing law to deprive wrongdoers of technologies they build through unlawful collection of Americans’ facial images and likenesses. The case of Everalbum is a troubling illustration of just some of the problems with facial recognition. Everalbum operates a business line called Paravision, which developed and marketed facial recognition technology, including to clients in the security and air travel industries.1 The company enhanced their facial recognition technology by allegedly baiting consumers into using Ever, a “free” app that allowed users to store and modify photos.2 As outlined in the complaint, Everalbum made promises that users could choose not to have facial recognition technology applied to their images, and that users could delete the images and their account. In addition to those promises, Everalbum had clear evidence that many of the photo app’s users did not want to be roped into facial recognition. The company broke its promises, which constitutes illegal deception according to the FTC’s complaint. This matter and the FTC’s proposed resolution are noteworthy for several reasons. First, the FTC’s proposed order requires Everalbum to forfeit the fruits of its deception. Specifically, the company must delete the facial recognition technologies enhanced by any improperly obtained photos. Commissioners have previously voted to allow data protection law violators to retain algorithms and technologies that derive much of their value from ill-gotten data.3 This is an important course correction.

Second, the settlement does not require the defendant to pay any penalty. This is unfortunate. To avoid this in the future, the FTC needs to take further steps to trigger penalties, damages, and other relief for facial recognition and data protection abuses. Commissioners have 1 PARAVISION, https://www.paravision.ai/ (last visited on Jan. 4, 2020). 2 Compl., In the Matter of Everalbum, Inc. et al., Docket No. 1923172. This is not the only photo-sharing application that has drawn scrutiny for its ties to facial recognition and surveillance technology. Kashmir Hill & Aaron Krolik, How Photos of Your Kids Are Powering Surveillance Technology, N.Y. TIMES (Oct. 11, 2019), https://www.nytimes.com/interactive/2019/10/11/technology/flickr-facial-recognition html. 3 The Commission voted 3-2 on a settlement with Google and YouTube allowed the companies to retain algorithms and other technologies enhanced by illegally obtained data on children. Based on my analysis, the Commission also allowed Google and YouTube to profit from its conduct, even after paying a civil penalty. See Dissenting Statement of Commissioner Rohit Chopra In the Matter of Google LLC and Youtube, LLC, Commu File No. 1723083 (Sep. 4, 2019), https://www ftc.gov/public-statements/2019/09/statement-commissioner-rohit-chopra-regarding-youtube. The Commission voted 3-2 on a settlement with Facebook to address unlawful facial recognition practices that violated a 2012 Commission order. Like the Google/YouTube settlement, Facebook was not required to forfeit any facial recognition or other related technologies. The settlement also provided an unusual immunity clause for senior executives, including Mark Zuckerberg and Sheryl Sandberg. See also Dissenting Statement of Commissioner Rohit Chopra In re Facebook, Inc., Commu File No. 1823109 (Jul. 24, 2019), https://www.ftc.gov/public­ statements/2019/07/dissenting-statement-commissioner-rohit-chopra-regarding-matter-facebook. VOLUME 171 Decision and Order voted to enter into scores of settlements that address deceptive practices regarding the collection, use, and sharing of personal data. There does not appear to be any meaningful dispute that these practices are illegal. However, since Commissioners have not restated this precedent into a rule under Section 18 of the FTC Act, we are unable to seek penalties and other relief for even the most egregious offenses when we first discover them.4 Finally, the Everalbum matter makes it clear why it is important to maintain states’ authority to protect personal data. Because the people of Illinois, Washington, and Texas passed laws related to facial recognition and biometric identifiers, Everalbum took greater care when it came to these individuals in these states.5 The company's deception targeted Americans who live in states with no specific state law protections.

With the tsunami of data being collected on individuals, we need all hands on deck to keep these companies in check. State and local governments have rightfully taken steps to enact bans, moratoria, and other restrictions on the use of these technologies. While special interests are actively lobbying for federal legislation to delete state data protection laws, it will be important for Congress to resist these efforts. Broad federal preemption would severely undercut this multi- front approach and leave more consumers less protected. It will be critical for the Commission, the states, and regulators around the globe to pursue additional enforcement actions to hold accountable providers of facial recognition technology who make false accuracy claims and engage in unfair, discriminatory conduct.6 4 Statement of Commissioner Rohit Chopra Regarding the Report to Congress on Protecting Older Adults, Commu File No. P144400 (Oct. 19, 2020), https://www ftc.gov/public-statements/2020/10/statement-commissioner-rohit­ chopra-regarding-report-congress-protecting; Rohit Chopra & Samuel A.A. Levine, The Case for Resurrecting the FTC Act’s Penalty Offense Authority (Oct. 29, 2020), https://papers.ssrn.com/sole/papers.cfm?abstract id=3721256 5 Compl., supra note 2.

6 Prepared Remarks of Commissioner Rohit Chopra at Asia Pacific Privacy Authorities 54th APPA Forum (Dec. 7, 2020), https://www.ftc.gov/public-statements/2020/12/prepared-remarks-commissioner-rohit-chopra-asia-pacific­ privacy.

EVERALBUM, INC. 739 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (“Commission” or “FTC”) has accepted, subject to final approval, an agreement containing a consent order from Everalbum, Inc., also doing business as Ever and Paravision (“Everalbum” or “Respondent”).

The proposed consent order (“proposed order”) has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission again will review the agreement and the comments received, and will decide whether it should withdraw from the agreement or make final the agreement’s proposed order. Since 2015, Everalbum has operated “Ever,” a photo storage and organization application available as an ios or Android mobile application (“app”) and in web and desktop formats. Ever allows consumers to upload photos and videos (collectively, “content”) from mobile devices, computers, or social media or cloud-based storage service accounts to Ever’s cloud servers. In February 2017, Everalbum launched a new feature of the Ever mobile app, called “Friends.” The Friends feature uses face recognition to organize users’ photos by faces of the people who appear in them. When Everalbum launched the Friends feature, it enabled face recognition by default for all users of the Ever mobile app. Everalbum’s application of face recognition to Ever app users’ content has not been limited to providing the Friends feature. The Commission’s proposed complaint alleges that, in four instances, Everalbum used images it extracted from Ever users’ photos in the development of face recognition technology. In one such instance, Everalbum used the resulting face recognition technology both in the Ever app and to build the face recognition services offered by its enterprise brand, Paravision (formerly Ever AI).

The proposed two-count complaint alleges that Everalbum violated Section 5(a) of the FTC Act by misrepresenting the company’s practices with respect to Ever users’ content. Proposed complaint Count I alleges that Everalbum misrepresented the circumstances under which the company would apply face recognition to Ever users’ content. According to the proposed complaint, Everalbum published a help article entitled “What is Face Recognition?” on its website in July 2018. The proposed complaint alleges that the help article represented that the Ever app’s “Friends” feature was not active—and, therefore, that Everalbum would not apply face recognition technology to users’ content—unless users affirmatively enabled the feature. The proposed complaint further alleges that the help article was false or misleading, because, until April 2019, for users in most geographic locations, Everalbum applied face recognition to users’ content by default and users could not use an app setting to turn off face recognition. Proposed complaint Count II alleges that Everalbum misrepresented that the company would delete the content of Ever users who chose to deactivate their Ever accounts. According to the proposed complaint, when Ever users sought to deactivate their accounts, Everalbum presented them with pop-up messages that represented that account deactivation would result in VOLUME 171 Analysis to Aid Public Comment Everalbum deleting their content. The proposed complaint alleges that Everalbum also made a similar representation in response to consumer inquiries and in its privacy policy. Despite its representations, Everalbum allegedly did not delete any users’ content upon account deactivation and instead stored the content indefinitely.

The proposed order contains provisions to address Respondent’s conduct and prevent it from engaging in the same or similar acts or practices in the future. Provision I of the proposed order prohibits Respondent from making misrepresentations related to the collection, use, disclosure, maintenance, or deletion of Covered Information (as defined in the order); consumers’ ability to control any of these actions; the extent to which Everalbum accesses or permits access to Covered Information; the extent, purpose, and duration of Everalbum’s retention of Covered Information after consumers deactivate their accounts; or the extent to which Everalbum otherwise protects the privacy, security, availability, confidentiality, or integrity of any Covered Information. Part II of the proposed order requires Respondent to clearly and conspicuously disclose, and obtain consumers’ affirmative express consent for, all purposes for which it will use or share User’s Biometric Information before using the information to create data needed for face recognition analysis or to develop face recognition models or algorithms. Part III of the proposed order requires Respondent to delete (A) photos and videos of Ever app Users who requested deactivation of their accounts, (B) face recognition data that it created without obtaining Users’ affirmative express consent, and (C) models and algorithms it developed in whole or in part using images from Users’ photos. Parts IV through VII of the proposed order are reporting and compliance provisions, which include recordkeeping requirements and provisions requiring Respondent to provide information or documents necessary for the Commission to monitor compliance. Part VIII of the proposed order states that the order will remain in effect for 20 years, with certain exceptions. The purpose of this analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or proposed order, or to modify in any way the proposed order’s terms.

BASF SE 741 Complaint