Everalbum, Inc.; Analysis of Proposed Consent Order To Aid Public Comment
The consent agreement in this matter settles alleged violations of federal law prohibiting unfair or deceptive acts or practices. The attached Analysis of Proposed Consent Order to Aid Public Comment describes both the allegations in the draft complaint and the terms of the consent order--embodied in the consent agreement-- that would settle these allegations.
What this rule actually says
The FTC can take action against AI companies that deceive users about what happens to their data—especially photos, videos, and personal information. This case involved a photo storage app that told users their data would stay private, then secretly changed those settings and sold access to third parties. The rule is straightforward: don't lie about data practices, and don't change privacy terms without real consent.
Who it applies to
- If you collect photos, videos, or biometric data (face recognition for hiring tools, medical imaging analysis, etc.)—this applies to you.
- If you collect any personal data and make promises about privacy or how it will be used—this applies to you.
- If you're in the US—the FTC has jurisdiction. If you serve US users at all, this matters.
- If you later want to use collected data for a different purpose than originally stated—you need explicit permission first.
- Out of scope: anonymized, truly aggregated data used exactly as promised doesn't trigger this.
What founders need to do
- Audit your privacy policy (1-2 days). Write down exactly what you tell users about their data: where it goes, who sees it, how long you keep it. Make sure this matches reality. If it doesn't, fix it immediately.
- Document your actual data practices (2-3 days). Map where user data actually flows—to third-party vendors, analytics tools, training sets, whatever. If this differs from your privacy policy, you have a problem.
- Set up a consent process for any future use changes (1 week). If you ever want to use collected data for something new (e.g., training your model on old medical transcripts), you need affirmative user consent first. Not pre-checked boxes. Actual opt-in.
- Be honest about third-party access (ongoing). If you sell data, share it with contractors, or use it for training, tell users exactly that in plain language. Don't bury it in 50 pages of terms.
- Keep records of what you promised (ongoing). Save screenshots of your privacy policy, consent flows, and terms. The FTC will ask for these if they investigate.
Bottom line
If you're transparent about data collection and don't change how you use data without asking permission, ignore this—you're fine. If you're uncertain whether your privacy policy matches what you actually do, act now: audit and fix gaps before the FTC notices.