OfferUp is a Delaware-incorporated, privately held local marketplace app (OfferUp Inc., which absorbed letgo in 2020) headquartered in Bellevue, WA. Its own privacy policy discloses collecting government-issued ID documents for its optional 'TruYou' identity-verification badge (processed by third party Onfido), consent-based precise location with an IP-address fallback when location is declined, and explicit disclosure of personal information to 'data marketplaces, data brokers, and advertising companies' including Microsoft and Google for ad-serving and analytics, which OfferUp's own policy says may constitute a 'sale' or 'sharing' under applicable state privacy laws. Apple's App Store privacy label confirms Location, Contact Info, Search History, Identifiers, and Usage Data are used to track users across apps and websites owned by other companies. Corporate ownership is traceable only through a mandatory SEC Form D exempt-offering filing rather than any public ownership chain. A 2021 Seventh Circuit opinion in Sosa v. Onfido, Inc. documents an Illinois Biometric Information Privacy Act class action alleging Onfido -- the third-party vendor behind OfferUp's TruYou identity-verification feature -- extracted and compared biometric identifiers from TruYou users' photos without consent; that case concluded in a class-action settlement under which Onfido, not OfferUp, agreed to create settlement funds totaling $28.5 million, with a final judgment of dismissal with prejudice entered and Onfido continuing to deny that it broke the law. No FTC action, settlement, or confirmed data breach involving OfferUp itself was found.
TRACK RECORD
1 ENFORCEMENT ACTION
[2021-08-11]
A 2021 Seventh Circuit Court of Appeals opinion in Sosa v. Onfido, Inc. describes an Illinois Biometric Information Privacy Act class action alleging that Onfido, the vendor behind OfferUp's TruYou identity-verification feature, used biometric identification technology to extract and compare a user's biometric identifiers from driver's-license and selfie photos without consent.
OfferUp's privacy policy discloses that to receive the optional 'TruYou' verification badge, users must provide a government-issued personal identification document such as a driver's license, processed via third-party vendor Onfido; the same policy discloses that even when a user declines to share precise device location, OfferUp may still use the user's IP address to infer an approximate location for certain features.
A SEC Form D exempt-offering filing names 'OFFERUP INC.' as the issuer, incorporated in Delaware, with a Bellevue, Washington principal place of business -- the mandatory federal filing through which OfferUp's corporate identity is traceable, since it has no public ownership chain.
OfferUp's privacy policy discloses that it shares limited personal information with select business partners including data marketplaces, data brokers, and advertising companies, for the partners' own and their clients' use, and self-declares that these activities may constitute a 'sale' or 'sharing' of personal information, or use of personal information for 'targeted advertising,' under applicable state privacy laws.
The court-authorized settlement website for Sosa v. Onfido, Inc. (N.D. Ill., No. 20-cv-04247) states that class payments come from 'a $12,785,595.90 fund that Onfido agreed to create for Financial Institution Class Members' and 'a $15,714,404.10 fund that Onfido agreed to create for Non-Financial Institution Class Members' -- funds totaling $28.5 million created by Onfido, OfferUp's TruYou identity-verification vendor, not by OfferUp -- and records that 'Onfido denies these allegations and denies that it was subject to or violated BIPA,' so the settlement carries no admission of liability.
A 2021 Seventh Circuit Court of Appeals opinion in Sosa v. Onfido, Inc. describes an Illinois Biometric Information Privacy Act class action alleging that Onfido, the vendor behind OfferUp's TruYou identity-verification feature, used biometric identification technology to extract and compare a user's biometric identifiers from driver's-license and selfie photos without consent.
The Final Judgment and Order of Dismissal with Prejudice entered December 4, 2023 by Judge Marvin E. Aspen in Sosa v. Onfido, Inc., No. 1:20-cv-04247 (N.D. Ill.) -- the Illinois Biometric Information Privacy Act class action over identity-verification photos, including those uploaded by OfferUp TruYou users -- approved the class settlement as 'fair, reasonable, and adequate' and 'dismisses the Action on the merits and with prejudice.' The defendant that settled is Onfido, Inc., OfferUp's third-party identity-verification vendor; OfferUp was not a defendant and the order makes no finding against it, and the court made no finding of liability against Onfido either.
Apple's App Store privacy label for the OfferUp app discloses that Location, Contact Info, Search History, Identifiers, and Usage Data may be used to track users across apps and websites owned by other companies.
OfferUp's privacy policy discloses allowing business partners including Microsoft and Google to serve advertisements on the OfferUp service and to provide analytics services on OfferUp's behalf across the internet.