Chegg, Inc.
Online education company Chegg suffered four data breaches affecting ~40 million consumers and employees due to repeatedly inadequate security practices.
Case identifiers
- Respondent
- Chegg, Inc.
- Agency
- Federal Trade Commission
- Announced
- 2022-10-31
- Monetary relief
- Injunctive only
- Case number
- FTC File No. 202-3151
- Statutes cited
- FTC Act § 5
Key facts
- 1
Four separate security incidents from 2017 through 2020 exposed consumer Social Security numbers, medical information, religious affiliations, sexual orientations, and disabilities.
- 2
Chegg failed to implement basic protections including multi-factor authentication, secure password storage, and employee security training.
- 3
The 2018 breach alone exposed 40 million consumer accounts.
- 4
Consent order without monetary relief; FTC focused on injunctive data-minimization requirements.
What the order requires
Injunctive terms imposed by the Federal Trade Commission. These bind Chegg, Inc.'s data practices going forward.
- Required data-minimization: collect and retain only data needed for specific purposes.
- Required multi-factor authentication for employees, contractors, and affiliates accessing covered-information assets, and required offering multi-factor authentication to users.
- Biennial third-party assessments of the comprehensive information security program.
- Consumer access rights: view, delete, or request deletion of personal information.
Primary sources
Read the original government documents. These are the authoritative records, everything on this page is derived from them.
Generate requests in under 60 seconds
Generate a deletion request for $9
Where this action sits in the tracker
- It is one of 19 FTC actions among the 26 cases in this tracker.
- It is an injunctive-only order with no monetary relief; 7 of the 26 tracked actions are structured this way.
- 5 tracked actions were announced in 2022.
- It is one of 7 tracked breach actions.
FAQ
What did the FTC charge Chegg, Inc. with?+
Online education company Chegg suffered four data breaches affecting ~40 million consumers and employees due to repeatedly inadequate security practices. The Federal Trade Commission cited FTC Act § 5.
How much did Chegg, Inc. pay?+
The 2022-10-31 order did not include monetary penalties against Chegg, Inc.; the agency focused on injunctive relief (prohibiting certain practices going forward).
Does the Chegg, Inc. settlement mean my data has been deleted?+
The order requires Chegg, Inc. to delete certain categories of consumer data (see injunctive terms). Individual consumers should still exercise state-law deletion rights (CCPA, CPA, TDPSA) to confirm deletion from any remaining successor databases.
How can I read the original FTC order?+
The Federal Trade Commission press release is available at https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-ed-tech-provider-chegg-careless-security-exposed-personal-data-millions. The case / matter number is FTC File No. 202-3151.