Internet Service Provider Settles FTC Privacy Charges

An Internet company that provides shopping cart software to online merchants has agreed to settle Federal Trade Commission charges that it rented personal information about merchants’ customers to marketers, knowing that such disclosure contradicted merchant privacy policies. The settlement will bar use of the personal data the company has already collected, as well as future misrepresentations about the collection, use, or disclosure of personally identifiable information. The settlement also requires the company to ensure that consumers receive a clear and conspicuous notice before their personal information is disclosed to other companies for marketing purposes. Finally, the settlement requires that the company give up the fees it made renting the consumer information.

Vision I Properties, LLC, doing business as CartManager International, provides shopping cart software and related services to thousands of online merchants. When consumers are ready to make a purchase, they enter information on “shopping cart” and “check out” pages that ask for their name, address, phone number, e-mail address, credit card number, and merchandise. The pages are designed to look like the other pages on the merchants’ sites, and typically display the merchants’ names and logos, but are actually located on the CartManager site.

According to the FTC, some of the merchants who used CartManager’s shopping cart and check out software made privacy pledges to their customers such as “PRIVACY POLICY: It’s simple. We don’t sell, trade, or lend any information on our customers or visitors to anyone.” But CartManager collected and rented the personal information of nearly one million consumers who shopped at merchant sites. The FTC alleges that CartManager did not adequately inform consumers or merchants that it would collect and rent this information and that it acted knowing that renting the information was contrary to many merchants’ privacy policies. The agency charged that CartManager was unfair and violated federal law.

“Companies and service providers must make sure that their privacy policies are in sync,” said Lydia Parnes, Acting Director of the FTC’s Bureau of Consumer Protection. “A service provider cannot secretly collect and rent consumers’ personal information, contrary to a merchant’s privacy policy. At the same time, merchants have an obligation to know what their service providers are doing with consumers’ personal information.”

The settlement bars disclosure of previously collected personal information and bars misrepresentations about the collection, use, or disclosure of personally identifiable information. It requires that CartManager and merchants’ privacy practices be consistent, or, if not, that CartManager post a clear and conspicuous disclosure to consumers on each of its pages stating that consumers are on a CartManager site and that personal information collected on the site will be used, sold, rented, or disclosed to third parties. The settlement also requires that CartManager give up $9,101.63 it made by selling the information. Finally, the settlement contains certain record-keeping provisions to allow the Commission to monitor compliance with its order.

NOTE: Consent agreements are for settlement purposes only and do not constitute an admission of guilt.

The Commission vote to accept the proposed consent agreement was 5-0. The FTC will publish an announcement regarding the agreement in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through April 11, after which the Commission will decide whether to make it final. Comments should be addressed to the FTC, Office of the Secretary, Room H-159, 600 Pennsylvania Avenue, NW, Washington, DC 20580. The FTC is requesting that any comment filed in paper form near the end of the public comment period be sent by courier or overnight service, if possible, because U.S. postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions.

Copies of the complaint and consent agreement and an analysis of the agreement to aid public comment are available from the FTC’s Web site at http://www.ftc.gov and also from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, NW, Washington, D.C. 20580. The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices in the marketplace and to provide information to help consumers spot, stop, and avoid them. To file a complaint in English or Spanish (bilingual counselors are available to take complaints), or to get free information on any of 150 consumer topics, call toll-free, 1-877-FTC-HELP (1-877-382-4357), or use the complaint form at http://www.ftc.gov. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.

(FTC File No. 042 3068)