A technology company that allegedly replaced a Web browser game with a program that installed apps on mobile devices without permission has settled charges that it violated the Federal Trade Commission Act.

Vulcun purchased Running Fred, a Google Chrome browser extension game used by more than 200,000 consumers. According to the FTC's complaint, the technology company then replaced the game with its own extension, Weekly Android Apps, without notifying consumers. The Vulcun app claimed to offer unbiased recommendations of Android applications, but actually installed apps directly without consumer permission—or as Jessica Rich, the agency's Director of Consumer Protection said in a statement, "commandeer[ed] people's computers and bombard[ed] them with ads."

Google received "a number" of consumer complaints about the Vulcun app, the FTC alleged, not just about the installation of apps without permission, but also that the extension opened multiple tabs and windows on the browser that advertised various other applications and reset users' browser homepages. Consumers also griped that even when they deleted the unwanted apps, Vulcun reinstalled them.

These actions violated the Section 5 prohibition on unfair practices in the FTC Act, the agency alleged in its complaint. "By bypassing the permissions process in the Android operating system, the apps placed on consumers' mobile devices also could have easily accessed users' address books, photos, location, and device identifiers," the agency said. "Indeed, once installed, the apps could have gained further access to even more sensitive data by using their own malicious code."

Vulcun further misled consumers by claiming its extensions provided "independent and impartial" reviews of apps and also it misrepresented the extent of third-party endorsements and media coverage, the FTC added. The company claimed that its app had 200,000 users and a 4.5 rating—a claim that was true for Running Fred, but not for the Weekly Android Apps, according to the agency.

Under the terms of the settlement, the company and two individual defendants must inform consumers about how the information accessed by a product or service will be used, and must also obtain express affirmative consent for the installation or material change of a product or service. Any built-in permissions notices associated with the product must be displayed prior to consent.

Several types of misrepresentations are banned by the proposed consent order. Vulcan cannot mislead consumers as to how personal information is collected and used or how much control they can exercise over the collection, use, and sharing of their data. It cannot misrepresent that a product has been endorsed by a third party or the efforts Vulcan has made to maintain privacy and security of the information collected from consumers.

To read the complaint and proposed consent order in In the Matter of General Workings, Inc., click here.

Why it matters: The case offers several lessons for advertisers, the FTC noted in a blog post. It reminds marketers to clearly disclose material information before consumers download a product and to obtain express consent prior to download. In addition, even after a product or service is on a consumer device, companies must stay within the confines of the activities that were disclosed to consumers. Finally, the agency emphasized the importance of disclosures to consumers, particularly where a material connection exists between a product and an endorser. The proposed consent order is currently open for public comment.