Ring LLC, $5,800,000
Ring let employees and contractors access customer video footage and failed to implement basic security controls, allowing attackers to hijack thousands of customer cameras.
Case identifiers
- Respondent
- Ring LLC (and Amazon.com, Inc.)
- Agency
- Federal Trade Commission
- Announced
- 2023-05-31
- Monetary relief
- $5,800,000
- Case number
- FTC File No. 192-3153
- Statutes cited
- FTC Act § 5
Key facts
- 1
Every Ring employee and hundreds of third-party contractors could access every customer’s video feed.
- 2
One employee viewed thousands of recordings of at least 81 female users in their bedrooms and bathrooms for months.
- 3
Weak authentication and no credential-stuffing protections allowed attackers to access 55,000+ customer accounts.
- 4
$5.8 million consumer refund fund plus implementation of a comprehensive privacy and data-security program.
What the order requires
Injunctive terms imposed by the Federal Trade Commission. These bind Ring LLC's data practices going forward.
- Deletion of all customer videos, face data, and derived data collected before September 1, 2018.
- Prohibition on using biometric information collected without consent for machine-learning.
- Required multi-factor authentication and biennial external assessments.
Primary sources
Read the original government documents. These are the authoritative records, everything on this page is derived from them.
Exercise your rights now
Generate a deletion request for $5
The FTC order binds Ring LLC's future practices, but doesn't automatically delete your existing data. State privacy law (CCPA, CPA, TDPSA, VCDPA) gives you that right. OfflistMe generates a compliant deletion email pre-addressed to Ring LLC's registered privacy contact.
Start for $5 →FAQ
What did the FTC charge Ring LLC with?+
Ring let employees and contractors access customer video footage and failed to implement basic security controls, allowing attackers to hijack thousands of customer cameras. The Federal Trade Commission cited FTC Act § 5.
How much did Ring LLC pay?+
Ring LLC paid $5,800,000 in monetary relief, announced on 2023-05-31. The settlement also imposed injunctive terms (see below).
Does the Ring LLC settlement mean my data has been deleted?+
The order requires Ring LLC to delete certain categories of consumer data (see injunctive terms). Individual consumers should still exercise state-law deletion rights (CCPA, CPA, TDPSA) to confirm deletion from any remaining successor databases.
How can I read the original FTC order?+
The Federal Trade Commission press release is available at https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users. The case / matter number is FTC File No. 192-3153.