The settlement will bar use of the personal data the company has already collected, as well as future misrepresentations about the collection, use, or disclosure of personally identifiable information
According to the FTC, Vision I Properties, LLC, doing business as CartManager International, provides its shopping cart software and related services to thousands of on-line merchants.
When consumers are ready to make a purchase, they enter information on "shopping cart" and "check out" pages that ask for their name, address, phone number, e-mail address, credit card number, and merchandise.
The pages are designed to look like the other pages on the merchants' sites, and typically display the merchants' names and logos, but are actually located on the CartManager site.
According to the regulator, some of the merchants who used CartManager's shopping cart and check out software made privacy pledges to their customers such as "PRIVACY POLICY: It's simple. We don't sell, trade, or lend any information on our customers or visitors to anyone."
But CartManager collected and rented the personal information of nearly one million consumers who shopped at merchant sites.
The FTC alleges that CartManager did not adequately inform consumers or merchants that it would collect and rent this information and that it acted knowing that renting the information was contrary to many merchants' privacy policies. The agency charged that CartManager was unfair and violated federal law.
"Companies and service providers must make sure that their privacy policies are in sync," said Lydia Parnes, Acting Director of the FTC's Bureau of Consumer Protection. "A service provider cannot secretly collect and rent consumers' personal information, contrary to a merchant's privacy policy. At the same time, merchants have an obligation to know what their service providers are doing with consumers' personal information."
The settlement bars disclosure of previously collected personal information and bars misrepresentations about the collection, use, or disclosure of personally identifiable information.
It requires that CartManager and merchants' privacy practices be consistent, or, if not, that CartManager post a clear and conspicuous disclosure to consumers on each of its pages stating that consumers are on a CartManager site and that personal information collected on the site will be used, sold, rented, or disclosed to third parties.
The settlement also requires that CartManager give up the $9,101.63 in fees it made by selling the information.
Finally, the settlement contains certain record-keeping provisions to allow the Commission to monitor compliance with its order.