The FTC announced a settlement with Sears Holdings Management Company relating to tracking software available on the sears.com and kmart.com web sites. The FTC alleged that Sears failed to adequately disclose the scope of the tracking software which was described in a lengthy user agreement that was accessed only after a multi-step registration process.
According to the FTC's complaint, Sears invited certain consumers visiting the sears.com and kmart.com web sites to become members of the "My SHC Community." Sears invited these consumers to "participate in exciting, engaging, and on-going interactions" and paid consumers $10 to participate. As part of this process, Sears asked consumers to download "research" software that it said would confidentially track their "online browsing." However, the FTC alleged that the software also monitored consumers' online secure sessions - including sessions on third parties' web sites - and collected information transmitted in those sessions, such as the contents of shopping carts, online bank statements, drug prescription records, video rental records, library borrowing histories, and the sender, recipient, subject, and size of web-based e-mails.
According to the complaint, Sears disclosed the full extent of the information the software tracked in a lengthy user license agreement, available to consumers at the end of a multi-step registration process. The FTC charged that Sears' failure to adequately disclose the scope of the tracking software's data collection was deceptive and violates the FTC Act. The proposed settlement calls for Sears to stop collecting data from the consumers who downloaded the software and to destroy all data it had previously collected. In addition, if Sears advertises or disseminates any tracking software in the future, it must clearly and prominently disclose the types of data the software will monitor, record, or transmit. This disclosure must be made prior to installation and separate from any user license agreement. Sears must also disclose whether any of the data will be used by a third party.