There's no mention of a fine in the settlement, but that doesn't mean Uber is off the hook. In addition to being barred from misrepresenting privacy and security, it'll have to implement a "comprehensive privacy program" and undergo third-party privacy audits every 2 years for the next 20 years. That's par for the course as far as FTC settlements go, but it's a long time in Uber terms -- the company may have fulfilled its driverless car ambitions by the time the audits are over.
In a statement, Uber tells us that it welcomes the end of the investigation and sees this as an "opportunity" to prove that it has turned a corner. You can read the full statement below.
The settlement comes right as Uber is in the midst of trying to fix a toxic corporate culture that many blame for Uber's lax approach to privacy. Uber recently ousted CEO Travis Kalanick, who was frequently blamed for the company's tendency to test (and sometimes break) legal boundaries. Other executives accused of dodgy behavior have also left the company. The FTC-mandated reforms could still be helpful, but Uber may be better prepared to implement them than it was just months earlier.
"We are pleased to bring the FTC's investigation to a close. The complaint involved practices that date as far back as 2014. We've significantly strengthened our privacy and data security practices since then and will continue to invest heavily in these programs. In 2015, we hired our first Chief Security Officer and now employ hundreds of trained professionals dedicated to protecting user information. This settlement provides an opportunity to work with the FTC to further verify that our programs protect user privacy and personal information."