While sell-side 'analysts' cheered Lifelock's (NYSE:LOCK) recent set of results, the company's 10-K notes that whistleblowers had approached the FTC regarding Lifelock's marketing practices. Surprisingly, this was not included in the company's earnings press release or mentioned on the earnings call. Lifelock met with the FTC on January 17, 2014 and admitted that it expects to be the subject of an FTC investigation. But don't take my word for it. From page 10 of LOCK's 2013 10-K:
With the growing public concern regarding privacy and the collection, distribution, and use of consumer personal information, we believe we are in an environment in which there is an increased regulatory scrutiny concerning data collection and use practices and the provision and marketing of services, like ours, that seek to protect that information. We expect that kind of scrutiny to continue as the marketplace for services like ours continues to develop. In addition, we believe there has been a recent increase in whistleblower claims made to regulatory agencies, including whistleblower claims made by former employees, which we believe will likely continue, in part because of the provisions enacted by the Dodd-Frank Wall Street Reform and Consumer Protection Act, or the Dodd-Frank Act, that may entitle persons who report alleged wrongdoing to the SEC to cash rewards. Often, the allegations underlying such claims to regulatory agencies result in federal and state inquiries and investigations. On January 17, 2014, we met with FTC Staff, at our request, to discuss issues regarding allegations that have been asserted in a whistleblower claim against us relating to our compliance with the FTC Order. Following this meeting, we expect to receive either a formal or informal investigatory request from the FTC for documents and information regarding our policies, procedures, and practices for our services and business activities. Given the heightened public awareness of data breaches and well as attention to identity theft protection services like ours, it is also possible that the FTC, at any time, may commence an unrelated inquiry or investigation of our business practices and our compliance with the FTC Order. We endeavor to comply with all applicable laws and believe we are in compliance with the requirements of the FTC Order. We believe the increased regulatory scrutiny will continue in our industry for the foreseeable future and could lead to additional meetings or inquiries or investigations by the agencies that regulate our business, including the FTC.
Perhaps Lifelock is waiting for the formal request from the FTC before issuing an 8-K alerting investors. Note that this is a new development. While some of the language in the preceding paragraph seems to indicate that former employees acting as whistleblowers is part of the normal course of business for Lifelock, the 2012 10-K made no such disclosure. Recall that Lifelock settled with the FTC in 2010 after an FTC investigation into LOCK making what the FTC believed to be misleading marketing claims:
In March 2010, we and Todd Davis, our Chairman and Chief Executive Officer, entered into the FTC Order. The FTC Order was the result of a settlement of the allegations by the FTC that certain of our advertising and marketing practices constituted deceptive acts or practices in violation of the FTC Act, which settlement made no admission as to the allegations related to such practices. The FTC Order imposes on us and Mr. Davis certain injunctive provisions relating to our advertising and marketing of our identity theft protection services, such as enjoining us from making any misrepresentation of "the means, methods, procedures, effects, effectiveness, coverage, or scope of" our identity theft protection services.
Whistleblowers may be alleging that LOCK is again making misleading claims regarding it's ability to prevent identity theft. Similarly, LOCK leads potential customers to believe that it will alert them in the event that a credit check is done on them (if a person applied for a loan or credit card). However, given that LOCK does not own a credit bureau (unlike competitor ProtectMyID which is owned by Experian), it is unclear how LOCK would be able to provide such a service. Talking to some customers of Lifelock, I learned that while they expected to be notified of a credit check by Lifelock, many purchased cars on credit or applied for credit cards without receiving such notifications (can see this complain appearing frequently on Lifelock's Facebook page which reads somewhat like a complaint board).
Thus, while Lifelock touts the virtues of it's Lifelock ecosystem, without a credit bureau, it's ability to make good on promises appears limited. This is important because, in it's 10-K, Lifelock notes that the restrictions imposed on Lifelock in it's 2010 FTC settlement are not relevant because of it's new capabilities. From the 10-K:
However, the bulk of the more specific injunctive provisions have no direct impact on the advertising and marketing of our current services because we have made significant changes in the nature of the services we offer to consumers since the investigation by the FTC in 2007 and 2008, including our adoption of new technology that permits us to provide proactive protection against identity theft and identity fraud. The FTC investigation of our advertising and marketing activities occurred during the time that we relied significantly on the receipt of fraud alerts from the credit reporting agencies for our members. The FTC believed that such alerts had inherent limitations in terms of coverage, scope, and timeliness. Many of the allegations in the FTC complaint, which accompanied the FTC Order, related to the inherent limitations of using credit report fraud alerts as the foundation for identity theft protection. Because the injunctive provisions in the FTC Order are tied to these complaint allegations, these injunctive provisions similarly relate significantly to our previous reliance on credit report fraud alerts as reflected in our advertising and marketing claims. The FTC Order also imposes on us and Mr. Davis certain injunctive provisions relating to our data security for members' personally identifiable information. At the same time, we also entered into companion orders with 35 states' attorneys general that impose on us similar injunctive provisions as the FTC Order relating to our advertising and marketing of our identity theft protection services.
This appears to be an admission that Lifelock is not compliant with the spirit of the agreement (i.e. it is making similar marketing claims as it had prior to the 2010 settlement) based on the company's belief that it is providing a fundamentally different service than it was at the time it entered into the agreement. I interpret not being compliant as 1) insinuating that Lifelock can prevent identity theft (2) promising to alert customers that Lifelock will notify them if a credit check is done.
Given that Lifelock's key (only?) competitive advantage is it's marketing, this could be a major blow to the company. It could be argued that using celebrity endorsers (Rudy Giuliani, Montel Williams) to make claims which other companies like Protect My ID (owned by Experian) are unwilling to make, is the reason Lifelock has been able to grow to 3 million subscribers. Despite having greater capabilities (by having an in-house credit agency), why won't Experian make such claims? It is likely because Experian is concerned that even with an in-house credit agency, it would be unable to make good on such promises.
Is Lifelock a reputable company? Note that while Lifelock touts itself as the leader in identity protection, Lifelock's own CEO Todd Davis had his identity stolen 13 times!
Lifelock shares sell for 49x the company's 2014 earnings guidance (using the midpoint of the $0.42-$0.47). If adjusted to incorporate a normal tax rate (vs. the 5% rate Lifelock guided for), shares would actually be selling for over 60x EPS. At this valuation, the market is not incorporating any risk of something disrupting Lifelock's growth. This valuation implies strong growth and flawless execution for the next 5-7 years. Were the FTC to force Lifelock to alter it's marketing practices, it is very possible earnings could actually decline - possibly significantly. If Lifelock added fewer new users and at the same time saw a modest increase in its churn rate (departure of existing users), earnings could actually decline to ~$0.30. This would likely cause the stock market to take a less rosy view of Lifelock and put a considerably lower P/E multiple on the stock. If the market put Lifelock at 15x $0.30 EPS, Lifelock shares would sell for just $4.50/share.
While sell-side analysts are telling investors to hop in the Lifelock pool, I believe they are ignoring regulatory risks (not to mention that the company has a flimsy business model predicated upon potentially deceptive marketing). I urge potential investors to do their own independent research into the company prior to making an investment decision.