The Electronic Privacy Information Center (EPIC) has filed a complaint with the Federal Trade Commission (FTC) alleging that Airbnb is violating the FTC Act and the Fair Credit Reporting Act (FCRA) by assigning “secret ratings to prospective renters, based on behavior traits using an opaque, proprietary algorithm.” EPIC is a non-profit that seeks to advance consumer privacy rights and has successfully filed complaints resulting in FTC enforcement actions related to a number of major companies and their privacy practices, including Facebook, Snapchat, Google, and WhatsApp.

The complaint filed last week targets Airbnb’s “risk assessment score,” which EPIC alleges is based off an algorithm that uses personal information obtained from third parties, including “personal data collected from web pages, information from databases, posts on the person’s social network account, posts on a blog or a microblog account of the person, a comment made by the person on a website, or a directory listing for a company or association.” To support its allegations, EPIC cites a patent obtained by the company Trooly, which purports to “determin[e] trustworthiness and compatibility of a person.” Airbnb acquired Trooly in 2017.

According to the patent, the algorithm uses information collected from third parties to try to identify “negative traits” and assign “trustworthiness” scores based on personality and behavior traits that “predict the likelihood of the person being a positive actor in an online or offline person to-person interaction.” EPIC alleges that the system is “biased, unprovable, and not replicable” because an algorithm cannot assess a particular individual’s relative “goodness” or “badness.” Because these algorithms are likely to cause substantial injury to consumers (i.e., prospective renters who are denied short-term rental properties as a result of a negative score) that is not reasonably avoidable and not outweighed by countervailing benefits, EPIC alleges that Airbnb has committed unfair practices in violation of the FTC Act. EPIC further alleges that Airbnb violated FCRA because the “trustworthiness scores” are consumer reports under FCRA that bear on the individuals’ “character,” “general reputation,” and “personal characteristics,” but that lack reasonable procedures to ensure accuracy.

The FTC does not generally respond publicly to complaints from third parties like EPIC. The complaint is an important reminder for companies that use, aggregate, or disclose data to consider the legal and regulatory implications under the host of relevant federal and state laws. The FTC’s 2016 Big Data Report provides a helpful overview of what the agency views as the benefits and risks of data aggregation, along with legal considerations for companies using big data.

Trust in Trustworthiness Ratings? Privacy Group EPIC Lodges Complaint with FTC Regarding Airbnb Ratings