Online retailers may have to make additional disclosures when they ask customers to download online behavioral tracking software, the Federal Trade Commission (FTC) recently announced.  In a recent decision, the FTC announced that companies may be engaging in deceptive trade practices if their online data collection practices conflict with the overall impression the companies make to consumers.1   Full disclosure in end user license agreements may not be enough disclosure when companies use online behavioral tracking.

In 2007, Sears Holdings Management Corporation instituted the “My SHC Community” market research program.  Visitors to www.sears.com and www.kmart.com were invited through a pop-up window to become members of the My SHC Community.  By registering with My SHC Community, consumers were required to install online tracking software on their computers.  Customers received $10.00 for their participation.  A message that appeared during registration informed users that the software would confidentially track online browsing.  The downloaded tracking application, however, tracked substantially more than consumers’ web-surfing habits.  Among other things, it gathered information on data transmitted during secured business transactions, the status of consumers’ online accounts, and the headings of some e-mails consumers received.  The tracking application submitted all of this information to Sears. 

The FTC found that the My SHC Community disclosures constituted deceptive trade practices because the company represented that the application would track only consumers’ “online browsing,” and did not adequately describe the more extensive tracking that actually took place.  Full disclosure of the tracking application within the end user licensing agreement was inadequate, the FTC found, because the amount of information actually tracked conflicted with the representations made to consumers.  Under the settlement, Sears is prohibited from distributing any tracking software without clearly and conspicuously disclosing the types of data that will be collected, how the data will be used, and whether it will be given to third parties.  These disclosures must on its own page, separate from the privacy policy, terms of use, or end user agreement. 

The FTC announced that it will pursue a case-by-case approach when determining whether disclosures located in end user licensing agreements constitute sufficient disclosure on the part of online retailers.  To conduct this analysis, the FTC will weigh two things: (1) what information is material to consumers; and (2) the overall impression a consumer has from a given transaction. 

The regulatory landscape surrounding online privacy issues is shifting.  Companies that have an Internet presence should seek legal counsel before implementing data collection and online tracking programs.  To find out more about Arent Fox’s work in this field, please contact:

1 Sears Holdings Mgmt. Corp., FTC No. 082-3099 (Aug. 31, 2009) (final approval of consent agreement).

Anthony V. Lupo
lupo.anthony@arentfox.com
202.857.6353

Matthew R. Mills
mills.matthew@arentfox.com
202.715.8582

Grace L. Applefeld
applefeld.grace@arentfox.com
202.857.6498