Compete Inc., a Boston-based web analytics company, settled charges with the FTC regarding alleged violations of the Federal Trade Commission Act for false and deceptive privacy practices. The FTC accused Compete of using its web tracking software without properly disclosing the extent of personal information it collected and failing to honor promises to protect the personal data collected. According to the FTC's complaint, Compete collects consumer data through two products: (1) the Compete Toolbar, which consumers install to receive access to information about websites they visit, such as a site's popularity; and (2) the Consumer Input Panel, which allows consumers to obtain rewards for giving their opinions to companies about products and services. As of the end of 2011, Compete had collected data from these two products on more than four million consumers. The crux of the FTC's complaint stems from Compete's allegedly unfair and deceptive practices. First, Compete did not disclose to consumers that it would collect sensitive information, including credit card data, financial account information, and social security numbers. Rather, Compete disclosed that it would track "the web pages you visit." Second, the FTC claims that Compete made false and deceptive assurances that consumers' personal information would be removed from data collected before being transmitted to third parties. Instead, Compete neglected to remove personal data prior to transmission and transmitted the information from secure websites in readable text. Under the terms of the settlement, Compete must fully disclose the information they collect, receive consumers' express consent prior to collecting information, implement a comprehensive information security program, and receive independent third-party audits of this program every two years for the next 20 years.
TIP: This case is a reminder that the FTC takes online tracking seriously. Companies that engage in this practice should ensure that they disclose their practices, live up to those disclosures, and take appropriate steps to safeguard sensitive information. Failure to take these steps could lead to FTC investigation and enforcement action.