Tapplock Inc., a Canadian company that makes a fingerprint-enabled padlock that can connect to smartphones, settled claims with the Federal Trade Commission on Monday that it allegedly made misrepresentations on how secure its locks are and failed to properly secure consumers' personal information.

Experts say the FTC will likely continue to ramp up enforcement on companies that make the Internet of Things products if they do not include information security in the initial design of their products and work to more carefully market those products.

"IoT cases are important because they bridge the divide between the online and physical world. Security vulnerabilities in IoT devices affect not only data security but also physical safety and property," Jared Ho, a senior attorney in the FTC's Bureau of Consumer Protection, said in a statement to Corporate Counsel.

Tapplock said its smart lock has an "unbreakable design" and that it is "bold," "sturdy" and "secure."

The FTC alleged the lock could be bypassed by simply unscrewing the back panel in "a matter of seconds." The agency further alleged that researchers were able to bypass the account authentication process to gain access to consumers' personal information.

Tapplock agreed to implement a security program and the FTC banned the company from making deceptive statements about the security of its devices. It has also agreed to a third-party review of its security program. There is no monetary fine. However, the company faces a fine of $43,280 for each instance that it violates the settlement agreement. A representative for Tapplock did not respond to a request for comment on Tuesday.

Scott Pink, formerly the general counsel of Prima Games and currently of counsel at O'Melveny & Myers in Silicon Valley, said companies need to consider exactly how their products are advertised to avoid FTC investigations.

"You need to be increasingly careful about whether words that could be viewed as puffery could, in context, be viewed as a statement of the level of security being provided," Pink said.

He said especially in instances such as this where companies are proclaiming to secure personal belongings, companies need to test their claims and document that testing.

False or misleading statements on the security of products are what allows the FTC to investigate a company under the Federal Trade Commission Act, Michelle Hon Donovan, a partner at Duane Morris in San Diego, said.

"I think these companies historically have not been known to have substantial information security protections in place for these devices," Donovan said. "We're seeing a paradigm shift in how legislatures and regulators view and enforce security requirements."

Donovan said that companies making these kinds of devices must implement a "security by design" process to mitigate the risk of an investigation.

"Someone who is an information security expert needs to be on the design team for anything that is going to be connected to the internet," Donovan said.

It is likely that the FTC will file more complaints against companies who fail to take consumer data seriously. In July, the FTC ordered Facebook to pay $5 billion over how it collected user data.

"That order that came out last year was unprecedented in its depth and breadth," Donovan said. "The FTC has said to expect to see more of this."