The Federal Trade Commission (“FTC”) on Dec. 5, 2012, announced that it settled claims against Epic Marketplace, Inc., an online advertising network, and its wholly owned subsidiary, Epic Media LLC (collectively, “Epic”) that will stop Epic from tracking consumer’s browser history (a process called “history sniffing”) without their knowledge and without disclosing the practice in Epic’s privacy policy. The FTC alleged that and Epic collected information about consumers' online searches by using technology that allows them to “sniff” or access a browser to see what sites consumers have visited in the past. They found searches about “sensitive medical and financial issues ranging from fertility and incontinence to debt relief and personal bankruptcy,” which was used by Epic to target advertisements.

When consumers visit any of the websites within the Epic Marketplace Network, which includes over 45,000 publishers, they receive a cookie, which stores information about their online practices—including sites they visited and the ads they viewed. The FTC alleged that Epic’s privacy policy represented that it would collect information only about consumers' visits to sites within its network, but instead Epic tracked consumers’ visits to other web sites through its use of history sniffing. In addition, the FTC charged in its complaint that failure to disclose the history sniffing practices was, in and of itself, deceptive because it is a material fact that may influence a consumer’s decision whether or not to take advantage of Epic’s opt-out mechanism.

In the proposed consent order, the FTC requires Epic to: (1) change its privacy policy to reflect its actual data use and collection practices; (2) immediately cease using “history sniffing” as a way to collect information about users; (3) permanently delete and destroy all data collected using the history sniffing technology; and (4) record all consumer complaints and any other documentation relating to Epic’s data use and collection practices for a period of 3 years.

This action is one more example of the FTC’s interest in online behavioral tracking and advertising, as well as a reminder that all organizations should ensure their privacy policies are fully accurate and include all material disclosures. Failure to disclose a key material fact can create liability equal to providing inaccurate disclosures to consumers. 

The following can all be viewed on the FTC's website:

The draft complaint

Proposed consent order

The analysis of the proposed settlement

All companies should take heed and audit their, and their vendors’ and partners’, data practices and ensure that accurate privacy policies are posted. They should also ensure that they take reasonable precautions to protect the security of the data and are prepared to respond to a breach.