FTC’s Ring case: restrict and monitor staff access to customer video, and require MFA for staff and customers

The FTC charged Ring with letting any employee or contractor access customers’ private videos and with failing to stop credential-stuffing and brute-force attacks that reached about 55,000 customers. The proposed order required a privacy and security program with safeguards on human review of videos and MFA for employee and customer accounts.

Source facts

The FTC’s May 31, 2023 press release on its Ring complaint says the agency charged the home security camera company with compromising customer privacy by allowing any employee or contractor to access consumers’ private videos. According to the complaint, one employee viewed thousands of recordings of intimate spaces over several months and was stopped only when another employee discovered it, and Ring could not determine how many other employees had inappropriately accessed videos because it had not implemented basic measures to monitor and detect employee video access.

The complaint also says Ring failed to implement standard protections against credential stuffing and brute force attacks, adding multifactor authentication only in 2019 despite attacks in 2017 and 2018, and that hackers accessed stored videos, live streams and account profiles of about 55,000 customers and used two-way functionality to harass and threaten people, including children.

Under the proposed order, which required federal court approval to take effect, Ring must delete data, models and algorithms derived from videos it unlawfully reviewed, implement a privacy and security program with safeguards on human review of videos and multi-factor authentication for employee and customer accounts, pay $5.8 million for consumer refunds, and alert the FTC about incidents of unauthorized access to customer videos.

Applicability

Use this for any provider or in-house team with access to camera footage. The case concerns Ring’s practices and a stipulated order; it shows the FTC’s expectations rather than setting rules for every business.

DSE recommendation

DSE recommends limiting staff and contractor access to customer video to documented, approved tasks, logging and reviewing every access, and requiring MFA on all staff and customer accounts. Get customer consent before footage is used for analytics training or support review, alert on unusual viewing patterns, block credential stuffing with rate limits and breached-password checks, and include video access in offboarding.

Verification

Review video access logs monthly against support tickets, confirm MFA enforcement reports show no exempt accounts, and test that a departing employee’s access is removed on their last day.

Official reference

Federal Trade Commission — FTC Says Ring Employees Illegally Surveilled Customers, Failed to Stop Hackers from Taking Control of Users’ Cameras (May 31, 2023). Reviewed October 18, 2026.