FTC says Snapchat misled users about “disappearing” photos, failed to secure personal data

The Federal Trade Commission on Thursday announced that has it reached a settlement with Snapchat, a popular vanishing message service, over the company’s “false” promises.

The FTC points out that Snapchat marketing claimed that messages “disappear forever” even though message recipients could employ a variety of easy workarounds, including screenshots and third-party apps, to preserve a copy of the messages indefinitely.

The agency’s complaint includes photos of Snapchat’s own marketing material, which promises users that the photos or messages they send will quickly disappear. Here’s an image from the complaint, where a photo is set to vanish in 7 seconds (but that a recipient could have preserved anyways):

Snapchat screenshot

The FTC also claims that Snapchat collected information from iPhone(s aapl) users’ contact lists without their knowledge or permissions, and that it failed to secure its FindFriends feature, which led to a hacking breach that exposed data of 4.6 million users.

The FTC’s complaint is significant because Snapchat, which first gained buzz as a “sexting” app for teens, is one of the hottest companies in Silicon Valley, having reportedly rebuffed takeover offers by Facebook and Google. The company’s early success reflects a growing desire for “ephemeral” communications tools that allow people to share photos or feelings without leaving a permanent trail on internet.

Under the terms of the agreement, Snapchat will operate under a 20-year consent order that requires it to implement a privacy program that will be audited from time to time by an outside professional.

The settlement mirrors ones that the FTC has reached with a number of other high profile tech firms. It reflects the agency’s recent attention to corral a culture of “growth-hacking,” where companies take a cavalier attitude towards privacy under an implicit understanding that they will be able to settle any regulatory complaints once they grow big.

“If a company markets privacy and security as key selling points in pitching its service to consumers, it is critical that it keep those promises,” said FTC Chairwoman Edith Ramirez, in a statement.

In a blog post, Snapchat wrote: “Even before today’s consent decree was announced, we had resolved most of those concerns over the past year by improving the wording of our privacy policy, app description, and in-app just-in-time notifications. And we continue to invest heavily in security and countermeasures to prevent abuse.”