被遺忘在抽屜裡的隱私政策，正是執法的起點

On March 30, 2026, the Federal Trade Commission announced a settlement with OkCupid and its affiliate Match Group Americas, closing an investigation that had been running for over a decade. The core allegation was straightforward: OkCupid told users it would not share their personal information with third parties except in clearly defined circumstances. Then it shared data with a party that fit none of those circumstances.

No monetary penalty was imposed. But OkCupid and Match are now permanently prohibited from misrepresenting their data practices — with civil penalties attached to any future violation — and subject to years of mandatory FTC reporting. For a company that spent twelve years insisting the incident never happened, that outcome carries long consequences.

The case raises a question that is more useful than it first appears: did the company know what it was doing?

The transfer was not made pursuant to any formal agreement. OkCupid received no payment. Clarifai operated under no contractual restrictions on how the data could be used. Users were not informed and were not given the opportunity to opt out. The connection between OkCupid and Clarifai was personal: OkCupid's founders had invested in Clarifai, and the data transfer was apparently arranged as a favor to the startup.

The nature of the data transferred compounds the severity considerably. Photos submitted to a facial recognition system are not merely images — they are the raw material from which biometric identifiers are extracted. Under GDPR Article 9, biometric data processed for the purpose of uniquely identifying individuals is a special category of personal data, subject to heightened protection and requiring explicit consent as a baseline. The 2014 transfer predates GDPR, which came into force in May 2018 — but had the regulation been in effect at the time, the exposure would have been of a different order entirely: unauthorized processing of special category data carries potential fines of up to 4% of global annual turnover, and the absence of any legal basis for the transfer would have been straightforward to establish. The United States has no equivalent federal statute. Several states have acted — most notably Illinois under the Biometric Information Privacy Act, with Texas and Washington following similar frameworks — but federal law leaves a significant gap. That gap is precisely what forced the FTC to rely on the deception theory: in the absence of a federal statute specifically governing biometric data, OkCupid's own privacy policy became the only enforceable standard available to regulators.

The FTC's enforcement authority flows from Section 5 of the FTC Act, which prohibits deceptive acts and practices. Deception under Section 5 does not require proof of intent. What it requires is a material representation — in this case, a privacy policy making specific promises about data sharing — and a practice that contradicts it. The gap between the two is sufficient.

This is not a novel theory. The FTC has applied it consistently: against Facebook in the 2012 and 2019 consent decrees, against Twitter in 2022, against Zoom in 2020. The pattern is uniform. A company's own written commitments to users become the legal standard against which its actual operations are measured. The statutory violation is the deviation itself, not the motive behind it.

Under GDPR, the analysis runs through the transparency and purpose limitation principles in Article 5 — processed fairly, for specified purposes, not in ways incompatible with what users were told. The legal regime differs across jurisdictions; the underlying logic does not. Across jurisdictions, what you tell users functions as a binding commitment about what you will do with their data.

Look at the 2014 transfer in isolation, and two very different narratives are available.

The first is deliberate circumvention. The founders of OkCupid knew what the privacy policy said — they ran the company that published it. When one of them transmitted user data from a personal email account to a company he had personally invested in, that is not the behavior of someone unaware that a policy existed. The absence of any formal agreement, any restrictions, any payment — these aren't evidence of ignorance. They may be evidence of a transaction structured to leave no internal trace.

The second is organizational compartmentalization. Privacy policies are typically drafted and maintained by legal or compliance functions. Business decisions — including informal data-sharing arrangements between founders and portfolio companies — often happen in a separate operational layer that has no active relationship with those documents. The people involved may have known the policy existed in the abstract. They may have simply never applied it to what they were doing.

The distinction matters, not because it changes the legal outcome, but because it points toward different organizational failures. Deliberate circumvention is a governance and accountability problem: a senior leader making a unilateral exception to a stated commitment, with no mechanism to surface or challenge that decision. Organizational compartmentalization is a policy operationalization problem: written commitments that exist in documents but not in processes, training, or decision-making.

Both are common. Neither is an excuse.

Whatever the original intent in 2014, the conduct that followed complicates any claim of innocent ignorance.

When a news outlet began investigating Clarifai's use of OkCupid data, company executives drafted communications designed to obscure the relationship. The FTC's complaint describes this as an extended pattern of concealment — not a single misstep, but a sustained, deliberate effort to deny what had occurred. That effort continued into the FTC's investigation itself, culminating in the agency filing a federal petition just to enforce its demand for records.

Active concealment is categorically different from a historical operational failure. It converts a past event — however it originated — into ongoing misconduct. A company that unknowingly violated its privacy policy and disclosed the error upon discovery occupies a fundamentally different regulatory position from a company that denied, obscured, and litigated to prevent disclosure. The decade-long gap between 2014 and the 2026 settlement is, in significant part, a product of that choice.

This is the dimension of the OkCupid case that general counsel should examine most carefully. The original incident was a 2014 data transfer. The enforcement action that followed is substantially a story about what happened next.

For organizations drawing practical lessons, the OkCupid case is usefully read as a composite: an initial failure that could reflect either deliberate circumvention or operational ignorance, compounded by a decade of concealment that was neither accidental nor ambiguous.

Where the original failure resembles operational ignorance — a privacy policy that was drafted by legal, approved by executives, and then never embedded into the business decisions of the people who actually handle data — the response is structural. Data handling commitments must be translated from document language into operational criteria: what categories of sharing are permitted, what triggers a review, who has authority to authorize exceptions, and what happens when someone does something that falls outside the stated framework. A privacy policy that no one in the business can operationalize is a liability, not a compliance asset.

Where the original failure resembles deliberate circumvention — a senior decision-maker making an exception they knew contradicted stated policy — the response is a governance question. Organizations need mechanisms that make unilateral senior exceptions visible: defined approval processes for data sharing arrangements, documentation requirements, and reporting lines that don't terminate at the person making the decision. The informal data transfer arranged between founders is a useful test case: would your current governance structure have caught it?

In either scenario, the cover-up response is a failure of a different kind — one that internal controls alone cannot prevent. What organizations can do is build a culture in which disclosure of an error, even a significant one, is treated as a better outcome than concealment. The OkCupid settlement, with its permanent injunction and multi-decade reporting requirements, illustrates what the alternative looks like.

The OkCupid settlement is a useful forcing function for a specific question: how well does your organization's privacy policy reflect what it actually does?

The FTC's enforcement theory requires no breach, no statutory violation, and no demonstrated harm. It requires only that what you promised diverges from what you did. That standard applies regardless of whether the divergence was intentional.

This makes the privacy policy audit a substantive legal exercise, not a documentation refresh. The relevant questions are operational: does the company share data with parties that don't fit the categories described in the policy? Are informal data-sharing arrangements — particularly those involving senior leaders' relationships outside the company — subject to any review? Is there a process by which an employee who observes a data practice inconsistent with the policy can escalate it?

For companies that handle photos, voice recordings, or other data capable of yielding biometric identifiers, an additional question applies: does the privacy policy address whether that data may be used — directly or by a third party — to train AI models or extract biometric information? Most policies written before the current generation of AI tools do not. The OkCupid transfer predated widespread awareness of facial recognition as a commercial technology. That is no longer a defensible position.

The remedies in the OkCupid settlement — permanent injunction, mandatory reporting, civil penalties for future misrepresentation — are not designed to punish a 2014 event. They are designed to change how an organization operates for the next two decades. For companies that want to avoid that kind of structural intervention, the time to address the gap between policy and practice is before the investigation begins.

The questions below map to the two failure modes described in this article. They are not a compliance audit — they are a prompt for the conversation your organization should be having internally.