Tapplock, a Canadian Internet of Things (IoT) company selling smart locks, agreed to settle a complaint by the Federal Trade Commission (FTC), alleging that it deceived consumers regarding its products.

The FTC alleged that Tapplock falsely claimed that its internet-connected and fingerprint-enabled smart locks are “unbreakable” and “secure.”

In its advertisements, Tapplock stated that its products were “strengthened with double-layered design” and it took “reasonable precautions and follow industry best practices” to ensure that consumers' data is “not inappropriately lost, misused, accessed, disclosed, altered or destroyed.

FTC says Tapplock smart locks are not secure

According to the FTC, Tapplock smart locks are not secure citing the fact that three separate security researchers found critical physical and electronic vulnerabilities with the products.

The security researchers found that the Canadian IoT company’s account authentication process was easy to bypass and gain full access to the accounts of Tapplock users.

One security researcher showed that he can unlock some of the company’s smart locks within seconds by simply unscrewing the back panel.

“Tapplock did not take reasonable measures to secure its locks or take reasonable precautions or follow industry best practices for protecting consumers’ information,” according to the FTC in its complaint.

According to the Commission, Tapplock’s deceitful or false advertisement is a violation of Section 5 (a) of the FTC Act.

In a statement, FTC Bureau of Consumer Protection Director Andrew Smith said, “We allege that Tapplock promised that its Internet-connected locks were secure, but in fact, the company failed to even test if that claim was true. Tech companies should remember the basics—when you promise security, you need to deliver security.”

Under the proposed settlement agreement, the Canadian IoT company is prohibited from misrepresenting its privacy and security practices. In addition, it is required to submit third-party assessment of its information security program every two years. The FTC will approve the assessor.