Uber has reached a deal with the Federal Trade Commission to be subject to regular privacy audits, settling a complaint (PDF) in which the FTC accused Uber of violating its own privacy policy.

The FTC investigation began following news reports in November 2014 about Uber employees using a mode called "God view" to track journalists. In December 2014, Uber created a system for monitoring employee access to consumer information—but stopped using it less than a year after it was put in place, according to the FTC.

For more than nine months, Uber "rarely monitored internal access to personal information about users and drivers," today's FTC statement reads.

Separately, the FTC alleges that Uber did a poor job of securing its data. That allowed an intruder to get personal information about Uber drivers in May 2014, including more than 100,000 driver names and license numbers.

"Uber failed consumers in two key ways: First by misrepresenting the extent to which it monitored its employees’ access to personal information about users and drivers, and second by misrepresenting that it took reasonable steps to secure that data," FTC Acting Chairman Maureen Ohlhausen said in a statement. "This case shows that, even if you’re a fast-growing company, you can’t leave consumers behind: you must honor your privacy and security promises."

There is no financial penalty attached to the settlement, because the FTC Act only provides the commission the authority to get money back when it can document a loss to consumers. However, if Uber violates the order that's now in place, it could be subject to civil penalties in the future.

The privacy audits will be performed by a third-party firm, which will report to the FTC, every two years for the next 20 years.

There is no general federal privacy law for Internet companies. Generally speaking, that limits FTC enforcement to situations where companies violate their own stated privacy policies.

"We’ve significantly strengthened our privacy and data security practices since [2014], and will continue to invest heavily in these programs," an Uber spokesperson told Ars via e-mail. "In 2015, we hired our first Chief Security Officer and now employ hundreds of trained professionals dedicated to protecting user information. This settlement provides an opportunity to work with the FTC to further verify that our programs protect user privacy and personal information.”

The FTC has been focusing on privacy practices at large tech companies for several years now. Facebook reached a settlement with the agency in 2011, as did Google the same year. In both of those settlements, the defendant companies agreed to 20 years of privacy audits.