Membership Reward Service Aimed at College Savers Settles FTC Charges That Its 'TurboSaver Toolbar' Feature Deceptively Collected Consumers' Personal Information

A membership reward service aimed at consumers trying to save money for college has agreed to settle FTC charges and will be barred from its allegedly deceptive practice of using a web-browser toolbar to collect consumers' personal information without adequately disclosing the extent of the information it is collecting.

The settlement with Upromise Inc. is part of the FTC's ongoing efforts to make sure that companies live up to the promises they make about privacy and data security. The settlement order will require Upromise to clearly disclose its data collection practices and obtain consumers' consent before installing or re-enabling any such toolbar products, and to notify consumers how to uninstall the toolbars already on their computers. The settlement also will bar misrepresentations about the extent to which the company maintains the privacy and security of consumers' personal information, and require the company to establish a comprehensive information security program and to obtain biennial independent security assessments for the next 20 years.

Upromise offers consumers a membership service that allows them to save money for college. When consumers buy goods or services from Upromise partner merchants, they receive rebates that are placed into consumers' college saving accounts. In its complaint against Upromise, the FTC alleged that to allow consumers to identify and select merchants that would provide rebates, Upromise's website offered a "TurboSaver Toolbar" download that would highlight partner merchants in consumers' search results. When downloading the toolbar, consumers saw a message that encouraged them to enable the "Personalized Offers" feature of the Toolbar, which Upromise allegedly claimed would collect information about the websites they visited "to provide college savings opportunities tailored to you."

The FTC alleges the Toolbar with the "Personalized Offers" feature enabled collected and transmitted, in clear text, the names of all websites consumers visited and which links they clicked on, as well as information they entered into some webpages, such as search terms, user names, and passwords. In some cases, the information collected included credit card and financial account numbers, user names and passwords used to access secured websites, security codes and expiration dates, and any Social Security numbers consumers entered into the webpages. The Toolbar transmitted consumers' information without encryption.

According to the FTC, while Upromise's toolbar was collecting and transmitting the data, its privacy statement claimed, "We understand the need for our customers' personal information to remain secure and private and have implemented policies and procedures designed to safeguard your information." Upromise also said it was "proud of the innovations we have made to protect your data and personal identity," and that "Upromise automatically encrypts your sensitive information in transit from your computer to ours."

The Upromise TurboSaver Privacy Statement allegedly stated that the Toolbar would collect and transmit information about websites consumers visited, and that "infrequently" the collection might "inadvertently" collect a "name, address, email address or similar information," but that any personally identifying information would be removed before the data was transmitted.

According to the FTC complaint, Upromise's failure to disclose the extent of information collected by the Toolbar, and its claims that it encrypted consumer data and took reasonable measures to protect data from unauthorized access, were deceptive and violated federal law. The FTC also charged that Upromise's failure to take reasonable and appropriate measures to protect consumers' data was an unfair practice.

The proposed settlement order requires Upromise to destroy the data collected through the Personalized Offers feature of the Toolbar, and to provide clear and prominent disclosures to consumers and receive their affirmative consent before installing any similar product. The disclosures must be made prior to installation and be separate from any user license agreement. The company also must notify consumers who had the Personalized Offer feature enabled, informing them as to the type of information collected, and how to disable the feature and uninstall the Toolbar.

The settlement order also prohibits Upromise from misrepresenting privacy and security practices and requires the company to establish and maintain a comprehensive information security program and to obtain biennial, independent, third-party audits for 20 years.

The Commission vote to issue the administrative complaint and accept the consent agreement package containing the proposed consent order for public comment was 4-0. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through February 6, 2012, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit written comments electronically or in paper form by following the instructions in the "Invitation To Comment" part of the "Supplementary Information" section. Comments in electronic form should be submitted using the following Web link: https://ftcpublic.commentworks.com/ftc/upromiseconsent and following the instructions on the web-based form. Comments in paper form should be mailed or delivered to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. The FTC is requesting that any comment filed in paper form near the end of the public comment period be sent by courier or overnight service, if possible, because U.S. postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions.

NOTE: The Commission issues an administrative complaint when it has "reason to believe" that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the respondent has actually violated the law. A consent agreement is for settlement purposes only and does not constitute an admission by the respondent that the law has been violated. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $16,000.

The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC's online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC's website provides free information on a variety of consumer topics. Like the FTC on Facebook and follow us on Twitter.

(Upromise)
(FTC File No. 1023116)