Drizly, LLC
Online alcohol-delivery platform Drizly exposed the personal data of about 2.5 million consumers in a 2020 breach after ignoring known security flaws. Precedent-setting case imposing personal obligations on the CEO.
Case identifiers
- Respondent
- Drizly, LLC (and James Cory Rellas (CEO))
- Agency
- Federal Trade Commission
- Announced
- 2022-10-24
- Monetary relief
- Injunctive only
- Case number
- FTC File No. 202-3185
- Statutes cited
- FTC Act § 5
Key facts
- 1
Drizly exposed account information of 2.5 million consumers after a 2020 breach.
- 2
Company knew of security vulnerabilities since 2018 but failed to remediate or hire a senior security officer.
- 3
First high-profile FTC privacy case to name an individual executive personally in the order.
- 4
The order follows CEO Rellas to any future company handling significant consumer data.
What the order requires
Injunctive terms imposed by the Federal Trade Commission. These bind Drizly, LLC's data practices going forward.
- Order applies personally to CEO James Cory Rellas for 10 years for any relevant business where he is a majority owner or serves as CEO or another senior officer with direct or indirect responsibility for information security and that handles information from 25,000 or more consumers.
- Required data minimization: destroy information not necessary for an ongoing service.
- Implementation of multi-factor authentication and a written security program.
Primary sources
Read the original government documents. These are the authoritative records, everything on this page is derived from them.
Generate requests in under 60 seconds
Generate a deletion request for $9
Where this action sits in the tracker
- It is one of 19 FTC actions among the 26 cases in this tracker.
- It is an injunctive-only order with no monetary relief; 7 of the 26 tracked actions are structured this way.
- 5 tracked actions were announced in 2022.
- It is one of 7 tracked breach actions.
FAQ
What did the FTC charge Drizly, LLC with?+
Online alcohol-delivery platform Drizly exposed the personal data of about 2.5 million consumers in a 2020 breach after ignoring known security flaws. Precedent-setting case imposing personal obligations on the CEO. The Federal Trade Commission cited FTC Act § 5.
How much did Drizly, LLC pay?+
The 2022-10-24 order did not include monetary penalties against Drizly, LLC; the agency focused on injunctive relief (prohibiting certain practices going forward).
Does the Drizly, LLC settlement mean my data has been deleted?+
No, the order does not automatically delete your data. You retain any rights available under applicable state privacy law (CCPA, CPA, TDPSA, VCDPA, and others) to submit your own deletion request. OfflistMe can generate a user-reviewed request draft pre-addressed to the respondent’s privacy contact.
How can I read the original FTC order?+
The Federal Trade Commission press release is available at https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million. The case / matter number is FTC File No. 202-3185.