The Federal Trade Commission (FTC) is taking steps against OkCupid and its parent company, Match Group Inc., concerning OkCupid’s purported sharing of user data. Nevertheless, the agency is not imposing a fine on the well-known dating application.

The FTC asserted that OkCupid revealed personal details of approximately 3 million users, comprising photos and locations, to an unauthorized third party, the AI firm Clarifai.

As per the FTC’s complaint, in September 2014, Clarifai sought extensive datasets of OkCupid images from Humor Rainbow, the prior owner of OkCupid and a current subsidiary of Match Group Inc. There was no commercial link between Clarifai and Humor Rainbow, although the founders of OkCupid had financial stakes in Clarifai.

Humor Rainbow then granted Clarifai access to images, along with users’ demographic and location data.

This action seemingly breached OkCupid’s Privacy Policy, which indicated that the app would not disclose personal information to entities not specified in the policy (service providers, business partners, or family affiliates), or it would notify users and enable them to opt out.

Moreover, the FTC asserted that OkCupid and Match concealed these activities since September 2014, including efforts to hinder the FTC investigation.

“The FTC enforces the privacy commitments that companies make,” FTC Bureau of Consumer Protection Director Christopher Mufarrige remarked in a press release. “We will investigate, and when necessary, pursue action against companies that claim to protect your data but do not deliver — even if that entails enforcing our Civil Investigative Demands in court.”

According to the FTC’s press release, the agency has executed its Civil Investigative Demand in federal court, and OkCupid was required to supply the information requested by the FTC.

The proposed settlement, submitted yesterday, indicates that OkCupid, Match Group Inc., and Humor Rainbow will be indefinitely barred from misrepresenting how they manage (collect, maintain, utilize, disclose, erase, or secure) user information, the reasons for doing so, and the nature and functions of their privacy measures. The order will be effective for 20 years.

No financial settlement is referenced in the press release.