For going back on its promise to abide by the terms of a Federal Trade Commission order, Upromise will pay a $500,000 civil penalty to the agency.
The membership reward service lets consumers earn cash-back rewards on certain purchases to help save for college or pay down student loans. In 2012, the company reached a deal with the FTC after the agency alleged that Upromise's "TurboSaver" toolbar collected information about users (such as search terms, usernames, passwords, and credit card information) without disclosing what data was being collected.
To settle the charges, Upromise agreed to an order with two key terms: Upromise was required to make clear and prominent disclosures about its toolbar data collection and use. In addition, the company promised to obtain third-party assessments of its data collection toolbar.
Instead Upromise encouraged consumers to download a toolbar dubbed "RewardU," the agency alleged, and failed to make the required clear and prominent disclosures about the toolbar's data collection and use. Only if a consumer clicked a link or scrolled down two full screens of text "to the second paragraph of a footnote-style statement," could a user find the relevant disclosures. Nor did the company obtain the necessary third-party assessments agreed upon in the order. Instead it provided assessments that evaluated operations not implicated under the 2012 order.
In response, the Department of Justice filed a civil penalty complaint in Massachusetts federal court on the FTC's behalf alleging that Upromise failed to comply with two of the provisions found in the order for the period of 2013 through 2016.
Pursuant to a stipulated order, Upromise must pay a $500,000 civil penalty for violating the 2012 order. The company must also abide by the terms of the order going forward. Specifically, before launching a toolbar in the future, it must have a third party professional specializing in Web site design and user experience certify that Upromise has followed the order's disclosure and that "express, affirmative" consumer consent will be obtained.
Taking no chances, the FTC also mandated that Upromise obtain advance, written approval from the agency of any required assessment's scope and design. As for RewardU, the new order instructs the company to permanently expire RewardU-related cookies from consumers' computers and notify consumers how to uninstall the toolbar and any related cookies.
To read the complaint and stipulated order in U.S. v. Upromise, click here.
Why it matters: "Upromise once again didn't disclose to consumers the extent of its data collection, and failed to comply with the FTC's order to get required privacy assessments," Tom Pahl, Acting Director of the Federal Trade Commission's Bureau of Consumer Protection, said in a statement. "Companies must keep their privacy promises."