Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/31/2013
11:26 AM
50%
50%

U.K. Online Dating Sites Catch Heat On Privacy

Government and BBC investigations raise alarms about the industry's personal data handling practices, social media identity theft.

In the same week the BBC claims to have uncovered the way unscrupulous U.K. online dating agencies "are preying on those looking for love," the country's privacy watchdog has separately warned four of the biggest local players to better police the way they handle client data.

In "Tainted Love: Secrets of the Dating Game," the state broadcaster's flagship current affairs program, Panorama, claimed to have uncovered a wide range of questionable practices by the online dating industry.

These include deliberate use of millions of photos and private details taken from social media sites without consent and reused to set up fake profiles of imaginary potential partners to, in the program's words, "tempt the lovelorn."

[ Want to learn more about data security? Read Record-Setting Data Breach Highlights Corporate Security Risks. ]

The documentary featured interviews with former online dating agency staffers who admitted on camera how they'd used such data to create fake profiles and adopt multiple personas to reel in those looking for love -- and to boost profits.

The report also claimed the sources of this illegally obtained personal material ranged from British celebrities, politicians and even children. On camera, one former employee said that other European countries (notably Spain) were the main target, with easy pickings apparently coming from platforms such as MySpace.

As part of the investigation, reporters posing as prospective dating agency business openers were able to buy 10,000 people's details, including birthdates and sexual preferences. That dataset included a member of the House of Lords, academics and BBC staff, all of whom told the BBC they had never signed up for such services.

At the same time, British privacy czar the Information Commissioner's Office (ICO) carried out its own investigation of dating sites. The ICO wrote to the U.K. branches of OKCupid, eHarmony, Match.com and Global Personals, plus the industry trade body, the Association of British Introduction Agencies, to alert it to similar concerns.

Letters have been sent warning the bodies that they could be in breach of the Data Protection Act over poor handling of personal details.

Specifically, the ICO is worried about poor visibility of terms and conditions about the use of personal information on these sites. They expressed concern that users must provide personal details to the companies before those terms and conditions are disclosed, as well as the companies' claims to take no responsibility about the loss of personal data. In addition, the regulator is unhappy about the fact that once signed up, daters seemingly have to agree to the sites having "perpetual" or "irrevocable" license to use their data.

Simon Entwisle, ICO director of operations, said, "The evidence we’re being presented with by the media suggests quite concerning business practices by some dating websites, and there are particular questions around how people’s information is being used that need to be answered. It’s concerning to see that there appear to be sites which, as a matter of course, are falling far short of the legal standards for ensuring information is accurate and up to date."

However, "the number of complaints we’re getting from the public is not very high. That could be because this is only an issue with a small minority of websites, or it could be because people are reluctant to come forward," the ICO conceded.

In any case, the body says it will now probe further to try and determine the scale of the issue. It has asked anyone concerned about possible misuse of their personal information to contact its investigators.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Elite Dating
50%
50%
Elite Dating,
User Rank: Apprentice
8/4/2013 | 12:21:41 AM
re: U.K. Online Dating Sites Catch Heat On Privacy
Very glad that things will be tightened up regarding online dating. Too much underhand tactics when dealing with one of the most important aspects of a persons life. www.elanlondon.co.uk
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21392
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addre...
CVE-2021-21393
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-29429
PUBLISHED: 2021-04-12
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded in...
CVE-2021-21394
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.