US Privacy Associates  

For years, consumer advocates have accused LifeLock Inc. of overstepping its boundaries in guaranteeing the effectiveness of its identity-theft protection services.

Now, the country's top consumer watchdog has weighed in, saying the Tempe-based company preyed on consumers' identity-theft fears to sell products that didn't fully deliver on LifeLock's promise.

The Federal Trade Commission on Tuesday said LifeLock will pay $12 million to settle a complaint alleging the company falsely advertised its $10-per-month service to consumers.

LifeLock CEO Todd Davis, who has generated controversy by giving out his Social Security number in advertisements, said the settlement likely won't have much of an impact on the business because it already altered much of its advertising and practices in the past year.

He also rejected the claim that the company misled its customers.

"We've always said that no one can stop identity theft," Davis said.

The issue highlights the anxiety that ID theft has created among consumers, Illinois Attorney General Lisa Madigan said during a news conference in Chicago.

"Unfortunately, there is nothing that you can do or purchase that will provide you with a 100 percent guarantee against being a victim of identity theft," said Madigan, who helped the FTC with its investigation of LifeLock. "Don't be scared into spending your hard-earned money." Identity theft is the top type of complaint received by the FTC annually, agency Chairman Jon Leibowitz said. In 2009, 21 percent, or 278,078, of consumer complaints the agency received were related to ID theft.

LifeLock's settlement consists of an $11 million payment to the FTC and a $1 million payment to the attorneys general of 35 states, including Arizona.

It is the largest joint FTC-multistate settlement concerning privacy and identity theft in history, Madigan said.

The company already paid the money into an escrow account, said Clarissa Cerda, LifeLock's general counsel.

The FTC will use the $11 million to provide refunds to consumers. It will send letters to current and former LifeLock customers who are eligible for the settlement. The $1 million will be used to cover states' investigation costs. The size of the individual refunds has not been determined.

The settlement prohibits the company and its principals from making deceptive claims and requires them to take more stringent measures to safeguard customers' personal data.

In a complaint filed Tuesday in U.S. District Court in Phoenix, the FTC alleged that LifeLock's advertising misled consumers by indicating it prevented all types of ID theft.

The FTC's investigation into the company's practices began several years ago, Davis said. He said that the company cooperated with the agency and the states included in the settlement and that it has worked to change its advertising to ensure its accuracy.

The Washington, D.C., agency's investigation of the company focused on advertising and practices from 2005 through part of 2009, the complaint says.

The settlement does not mean LifeLock has admitted breaking the law, the FTC said.

Critics have accused Davis of being cavalier about the company's ability to thwart ID theft and fraud, zeroing in on the ads in which he lists his Social Security number on the side of a truck to show his confidence in LifeLock's services.

"We challenged LifeLock's practices because they promised protection they didn't deliver," Leibowitz said during the news conference Tuesday, adding that the company's service cannot prevent the misuse of existing credit cards and bank accounts or the ability to obtain medical care using another person's identity.

He also blasted LifeLock for having lax controls for protecting personal data it collected from customers. "Its data security suffered from severe vulnerabilities that are unacceptable for any company that collects personal information from consumers," he said.

The data was not encrypted, which would help prevent outsiders from accessing it, and the information was not shared only on a "need to know" basis, according to an FTC announcement.

LifeLock is one of Arizona's fastest-growing startups, garnering more than 1.5 million customers since it formed in 2005, according to Davis.

Its financial backers include Goldman Sachs & Co. and security-software giant Symantec Corp., which contributed financing toward $40 million in new investment LifeLock landed in May.

Some analysts speculate the private company will go public this year.

The FTC settlement is the second major settlement for LifeLock in the past year.

In October, it settled a lawsuit by credit bureau Experian in U.S. District Court in California.

Experian claimed LifeLock engaged in unfair business practices by constantly signing up customers for fraud alerts with the credit bureaus. Typically, consumers file a fraud alert with a credit bureau when they believe someone has misused their personal data, such as stealing their credit-card information.

A fraud alert, which can be renewed every 90 days, requires a company to verify a person's identity before extending credit to the individual.

Experian argued federal law allows only individual consumers, not third parties such as LifeLock, to set fraud alerts for themselves.

Under the settlement, the amount of which has never been disclosed, LifeLock agreed to stop setting fraud alerts, which was key to its $10-per-month service.

Davis said the company has changed much of its practices and advertising since the FTC initiated its investigation.

"We've been working with them literally for years, and they were concerned about some of our early practices," he said. "We are glad to get it behind us so we can stay focused" on the business.