Commission Issues Staff Report, Protecting Consumers in the Next Tech-ade.

Commission issues staff report: The Commission has issued a staff report highlighting the challenges of consumer protection in the face of emerging and evolving technologies in the next ten years. The report summarizes the proceedings of the FTC’s three-day public hearings, “Protecting Consumers in the Next Tech-ade,” and which will inform its consumer protection efforts in the next decade.

The report explains the FTC will work to prevent Internet fraud by using its new powers under the U.S. SAFE WEB Act to coordinate and cooperate more closely with foreign consumer protection officials, ensure that consumer-producers who engage in activities to market and advertise products for consideration do so within the confines of laws prohibiting unfair or deceptive acts or practices in trade, and develop new strategies and to harness the power of technology to deliver timely and effective consumer education messages.

It states that consumers increasingly want to access content, including commercial messages; create and share content and information about themselves; and pay for goods and services how, when, and where they want. The FTC will work to prevent unfair or deceptive acts and practices that adversely affect the ability of consumers to make these types of choices.

It also notes that products in the marketplace are changing constantly and rapidly as a result of obsolescence, convergence, interoperability, digital rights management and a host of other considerations. The FTC will work to prevent consumer harm arising from these changes by monitoring and prosecuting those who engage in unfairness or deception to exploit consumers’ lack of familiarity with new products, and using consumer education programs to edify consumers.

The report states that the FTC will work to protect the privacy and security of consumer information in this new information environment by aggressively enforcing its special statutes related to privacy as well as Section 5 of the FTC Act, by encouraging the development and implementation of self-regulatory standards related to new technologies that raise privacy and security concerns, such as in the area of behavioral marketing, and by engaging in substantial business education efforts to encourage the adoption of reasonable security procedures to decrease the risk of data breaches.

Finally, the report states that technology and business practices will continue to evolve rapidly, creating the potential for benefits and harms to consumers. The FTC will seek to prevent injury to consumers in this dynamic marketplace by continuing to engage in substantial consumer education efforts and by serving as a “convener,” regularly bringing together interested parties to discuss new technologies and their consumer protection implications. For example, a two day public event, “Spam Summit: the Next Generation of Threats and Solutions,” was held July 11-12, 2007, a town hall titled “Ehavioral Advertising: Tracking, Targeting, and Technology” was held November 1-2, 2007, and “Beyond Voice: Mapping the Mobile Marketplace” will be held May 6 and 7.

The Commission vote to approve issuing the report was 5-0.

Copies of the report are available from the FTC’s Web site at http://www.ftc.gov and from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue N.W., Washington, DC 20580. Call toll-free: 1-877-FTC-HELP.

Agency Announces Settlement of Separate Actions Against Retailer TJX, and Data Brokers Reed Elsevier and Seisint for Failing to Provide Adequate Security for Consumers Data

In two unrelated Federal Trade Commission actions, discount retailer TJX and data brokers Reed Elsevier and Seisint have agreed to settle charges that each engaged in practices that, taken together, failed to provide reasonable and appropriate security for sensitive consumer information. The settlements will require that the companies implement comprehensive information security programs and obtain audits by independent third-party security professionals every other year for 20 years.

“By now, the message should be clear: companies that collect sensitive consumer information have a responsibility to keep it secure,” said FTC Chairman Deborah Platt Majoras. “These cases bring to 20 the number of complaints in which the FTC has charged companies with security deficiencies in protecting sensitive consumer information. Information security is a priority for the FTC, as it should be for every business in America.”

According to the FTC complaint, TJX, with over 2,500 stores worldwide, failed to use reasonable and appropriate security measures to prevent unauthorized access to personal information on its computer networks. An intruder exploited these failures and obtained tens of millions of credit and debit payment cards that consumers used at TJX’s stores, as well as the personal information of approximately 455,000 consumers who returned merchandise to the stores. Banks have claimed that tens of millions of dollars in fraudulent charges have been made on the cards and millions of cards have been cancelled and reissued.

Specifically, the agency charged that TJX:

  • Created an unnecessary risk to personal information by storing it on, and transmitting it between and within, its various computer networks in clear text;
  • Did not use readily available security measures to limit wireless access to its networks, thereby allowing an intruder to connect wirelessly to its networks without authorization;
  • Did not require network administrators and others to use strong passwords or to use different passwords to access different programs, computers, and networks;
  • Failed to use readily available security measures, such as firewalls, to limit access among its computers and the Internet; and
  • Failed to employ sufficient measures to detect and prevent unauthorized access to computer networks or to conduct security investigations, such as patching or updating anti-virus software.

In the FTC’s action against data brokers Reed Elsevier (REI) and Seisint, the complaint alleges that REI – through its LexisNexis data broker business – and Seisint collect and store in databases information about millions of consumers, including names, current and prior addresses, dates of birth, drivers license numbers and Social Security numbers. They obtain information about consumers from credit reporting agencies and other sources, and sell products customers use online to find and retrieve the information from their databases. The companies relied on user IDs and passwords (or “user credentials”) to control customer access to consumer information in their databases.

The complaint alleges that, among other security failures, they allowed customers to use easy-to-guess passwords to access Seisint’s “Accurint” databases. The databases contained sensitive consumer information, including drivers license numbers and Social Security numbers. Identity thieves exploited these security failures, and through multiple breaches obtained access to sensitive information about at least 316,000 consumers from Accurint databases. The identity thieves used the information to activate credit cards and open new accounts, and made fraudulent purchases on the cards and new accounts. REI acquired Seisint in late 2004, and the breaches continued for at least nine months afterward, during which time REI controlled Seisint’s practices.

The agency charged that Seisint and REI:

  • Failed to make Seisint user credentials hard to guess;
  • Failed to require periodic changes of Seisint user credentials;
  • Failed to suspend credentials after a certain number unsuccessful log-in attempts;
  • Allowed Seisint customers to store their credentials in a vulnerable format in cookies on their computers;
  • Failed to require Seisint customers to encrypt or protect credentials, search queries or search results in transit between customer computers and Seisint Web sites;
  • Allowed customers to create new user credentials without confirming that the new credentials were created by customers rather than identity thieves;
  • Permitted users to share credentials;
  • Did not adequately assess the vulnerability of Seisint’s Web applications and computer network to commonly known attacks; and
  • Did not implement simple, low-cost, and readily available defenses to such attacks.

The settlement with TJX requires it to establish and maintain a comprehensive security program reasonably designed to protect the security, confidentiality, and integrity of personal information it collects from or about consumers. The settlement with REI and Seisint requires them to establish and maintain comprehensive security programs to protect personal information that is in whole or part nonpublic information. The settlements require the programs to contain administrative, technical, and physical safeguards appropriate to each company’s size, the nature of its activities, and the sensitivity of the personal information it collects. Specifically, the companies must:

  • Designate an employee or employees to coordinate the information security program;
  • Identify internal and external risks to the security and confidentiality of personal information and assess the safeguards already in place;
  • Design and implement safeguards to control the risks identified in the risk assessment and monitor their effectiveness;
  • Develop reasonable steps to select and oversee service providers that handle the personal information they receive from the companies; and
  • Evaluate and adjust their information security programs to reflect the results of monitoring, any material changes to their operations, or other circumstances that may impact the effectiveness of their security programs;

The settlements require the companies to retain independent, third-party security auditors to assess their security programs on a biennial basis for the next 20 years. The auditors will be required to certify that the companies’ security programs meet or exceed the requirements of the FTC’s orders and are operating with sufficient effectiveness to provide reasonable assurance that the security of consumers’ personal information is being protected.

The settlements also contain bookkeeping and record keeping provisions to allow the agency to monitor compliance with its orders.

The FTC coordinated its investigation of TJX with 39 state Attorneys General, lead by the office of the Massachusetts Attorney General, and acknowledges the invaluable assistance of the states in the agency’s investigation.

The FTC acknowledges the invaluable assistance of the Hayward, California Police Department and the REACT (Rapid Enforcement Allied Computer Team) Task Force in the agency’s investigation of Seisint and REI.

The Commission votes to accept the proposed consent agreements were 5-0. The FTC will publish an announcement regarding the agreements in the Federal Register shortly. The agreements will be subject to public comment for 30 days, beginning today and continuing through April 28, after which the Commission will decide whether to make them final. Comments should be addressed to the FTC, Office of the Secretary, Room H-135, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The FTC is requesting that any comment filed in paper form near the end of the public comment period be sent by courier or overnight service, if possible, because U.S. postal mail in the Washington area and at the Commission is subject to delay due to heightened security precautions.

Copies of the complaints, proposed consent agreements, and analyses of the agreements to aid in public comment are available from the FTC’s Web site at http://www.ftc.gov and also from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580.

The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, click http://www.ftc.gov/ftc/complaint.shtm or call 1-877-382-4357. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad. For free information on a variety of consumer topics, click http://ftc.gov/bcp/consumer.shtm.

Statement of Federal Trade Commission Chairman Deborah Platt Majoras

As previously announced, I will resign as Chairman of the Federal Trade Commission, effective March 30.

The President has announced his intention of designating FTC Commissioner William E. Kovacic as the next Chairman of the Federal Trade Commission. Bill will be a terrific Chairman. Having served in several capacities at the agency – most recently Commissioner and, previously, General Counsel – he brings deep institutional knowledge, long-standing dedication to the mission, and great respect for staff. Bill is a free market champion and a highly regarded advisor to emerging competition authorities around the globe.

It has been my honor to serve U.S. citizens as Chairman of the Federal Trade Commission. I have been privileged to stand with my fellow Commissioners and the talented staff in our efforts to protect consumers and promote competition in our highly effective free market system.

FTC Authorizes Motion to Intervene and Object to Proposed Class Action Settlement in New Jersey State Court

Commission approval of motion to intervene and object to proposed class action settlement: The Commission has approved a motion to intervene in and object to a proposed class action settlement agreement currently being considered by the Superior Court of New Jersey, Law Division: Monmouth County. The FTC is also requesting leave to participate in the fairness hearing, scheduled for April 18, regarding the proposed settlement. The motion to intervene and the objection, filed by the FTC’s staff on March 26, 2008, can be found on the FTC’s Web site and as a link to this press release. It concerns the case of Exquisite Caterers, LLC vs. Popular Leasing USA, Inc. (Docket No. Mon-L-3686-04).

According to the motion, the proposed settlement would resolve private claims against IFC Credit Corporation (IFC), which the FTC sued in June 2007, alleging that it had engaged in unfair and deceptive trade practices involving the collection on rental agreements IFC had bought from Norvergence. The FTC had previously brought a separate action against Norvergence as well, alleging it had used deceptive tactics to induce small businesses and non-profits to enter into telecom equipment rental agreements. Under the proposed IFC class action settlement, the FTC contends that IFC essentially would obtain an enforceable judgment against class members that may require them to pay money to the company, without a suit ever being filed against them.

Specifically, class members who do not opt out of the class may be required to pay IFC substantial sums on their existing rental agreements with the company, albeit a discounted amount on the total balance IFC claims they owe. If the class members who have not opted out then fail to pay the amount they owe IFC under the settlement, no reduction applies, and they would be required to pay IFC the full amount they allegedly owed under the original agreement. In addition, the settlement would allow IFC to enforce the terms of the agreement against defaulting customers in any court with jurisdiction in the case, and settling class members would have to release any claims they may have had against IFC related to their rental agreements. Because of the legal ramifications of the proposed settlement, the FTC argues that the delivery of the settlement notice must comport with constitutionally required standards of due process, providing class members with adequate notice about the proposed settlement terms.

As the FTC summarized in its motion, “If approved, the settlement will provide IFC with what is tantamount to a default judgment against class members who have not paid what IFC asserts they owe on the rental agreements. The FTC objects to vesting IFC with this authority when it is accomplished in a manner that denies class members due process. At a minimum, class members should be provided sufficient notice and the opportunity to be heard, so that they may make an informed decision about whether to opt out of the proposed settlement.”

The vote approving the staff’s filing of the motion to intervene and object was 5-0. It may be filed as an amicus curiae brief, based on the Court’s discretion. (FTC File No. X070033; the staff contact is Robert J. Schroeder, FTC Northwest Region, 206-220-4477.)

Copies of the documents mentioned in this release are available from the FTC’s Web site at http://www.ftc.gov and from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Call toll-free: 1-877-FTC-HELP.

FTC Asks Court to Halt Prepaid Calling Card Scam;Alleges Consumers Receive Fewer Calling Minutes Than Advertised and Pay Hidden Fees

The Federal Trade Commission has asked a U.S. district court judge to order a halt to the alleged illegal practices of CTA, a major distributor of prepaid calling cards across the country. In the last quarter of 2007 alone, CTA’s revenue from the sale of cards exceeded $28 million. The FTC charges that CTA misrepresents the number of calling minutes consumers get, fails to disclose that consumers’ cards will be charged whether or not the calls go through, and charges hidden fees.

According to the FTC, CTA is a key player in the prepaid phone card industry that sells approximately $4 billion worth of cards a year – primarily to immigrants looking for a cheap and easy way to call friends and family in other countries. CTA sells cards in denominations ranging from $2 to $20 under various brand names, and has cards for use in calling countries from Albania to Zimbabwe and hundreds of countries in between. They also sell cards for domestic calling.

The FTC charged that CTA provides posters to the small retail outlets like gas stations, grocery stores and newstands that sell its cards. The posters advertise the number of calling minutes and brag it offers rates with “no connection fees.” But consumers who use the calling cards don’t receive the number of minutes advertised. For example, the FTC complaint says a card that advertised 40 minutes calling time to El Salvador cut off the call after only 27 minutes. A card that advertised 30 minutes calling time to Egypt cut off the call in a little over 10 minutes. In fact, the FTC purchased 46 CTA cards in retail stores and tested by them. None of the cards delivered the calling minutes advertised by posters displayed where the cards were purchased.
CTA posters and calling cards refer to charges in vague terms and tiny type. Posters that feature country names and call minutes in 32 point type identified fees and charges at the bottom of the poster in approximately five point type, using language such as:

“Call time is deducted in three minute increments to certain destinations. Service fees may apply. Calls placed to mobile telephones may be billed at a higher rate. When using a toll free number from a pay phone a $.65 per call surcharge will apply. Application of surcharges and fees may have an effect of reducing total minutes on a card. Maintenance fees may apply. This card has no cash value and is non-refundable. Prices and fees are subject to change without notice.”

The calling cards themselves carried approximately 27 lines of disclosures regarding fees and charges, which are nearly illegible because the disclosures are written in font sizes that range from two to four points, the complaint states. The disclosure states, in part,

“All rates and fees vary and are subject to change without notice. Rates are higher for international cellular . . . Calls are billed in three to six minute increments. A post call fee between 25 cents and two dollars and an additional surcharge of twenty percent may apply after each call depending on length and duration of a call. . . . Service fees may apply.”

Neither the advertising posters nor the calling cards disclose that if the calls do not go through, the cards are charged fees anyway.

The FTC has asked the court to halt the deceptive practices pending trial, and to appoint a monitor to oversee the business. The agency also will seek a court order to require the defendants to give up their ill-gotten gains.

The FTC complaint named Clifton Telecard Alliance One LLC, doing business as Clifton Telecard Alliance and CTA, Inc., and Mustafa Qattous, its principal.

The Commission vote to file the complaint was 5-0. It was filed in the U.S. District Court for the District of New Jersey.

This case was brought with the invaluable assistance of El Salvador’s Defensoría del Consumidor, Colombia’s Superintendencia de Industria y Comercio, the Egypt Consumer Protection Authority, Mexico’s Procuraduría Federal del Consumidor (PROFECO), Panama’s Autoridad de Protección al Consumidor y Defensa de la Competencia, and Peru’s Instituto Nacional de Defensa de la Competencia y de la Protección de la Propiedad Intelectual (INDECOPI).

NOTE: The Commission files a complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. The complaint is not a finding or ruling that the defendant has actually violated the law. The case will be decided by the court.

The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, click http://www.ftc.gov/ftc/complaint.shtm or call 1-877-382-4357. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad. For free information on a variety of consumer topics, click http://ftc.gov/bcp/consumer.shtm.

Commission Issues Advisory Opinion on FDCPA and Debt Collectors; FTC Extends Comment Period for Mobile Town Hall

Issuance of Commission advisory opinion: The Commission has issued an advisory opinion stating that the Fair Debt Collection Practices Act does not prohibit a debt collector in the foreclosure context from communicating with consumers regarding possible settlement options that may assist consumers to avoid foreclosure. USFN, formerly known as the U.S. Foreclosure Network, the nation’s largest not-for-profit association of foreclosure law firms and trustees, asked the Commission to address whether a debt collector violates Sections 807 or 809(a) of the Act if he or she communicates with a consumer regarding possible foreclosure settlement options in initial or subsequent contacts with consumers. The FTC’s advisory opinion concluded that providing truthful and non-misleading information to a consumer about settlement options would not be a per se violation of FDCPA Sections 807 or 809(a), but that specific communications could violate these sections of the Act if they contained a false or misleading representation or omission of material fact or overshadowed the disclosures regarding consumers’ rights to dispute their debts in writing.

The Commission vote approving issuance of the advisory opinion was 5-0. (FTC File No. P084801; the staff contact is Sara Gottovi, Bureau of Consumer Protection, 202-326-3224.)

Extension of public comment period: In preparation for the FTC’s “Beyond Voice” Town Hall scheduled for May 6 and 7, 2008, the Commission requested comments and original research from interested parties on the general topics noted in its February 4, 2008, press release. The Commission had requested that all interested parties submit comments by March 17, 2008. The comment period has been extended through May 5, 2008.

Comments should refer to “Beyond Voice – Comment, Project No. P074403.” To file electronically, use the form at https://secure.commentworks.com/ftc-beyondvoice, or send comments to the Office of the Secretary, Federal Trade Commission, Room H-135 (Annex A), 600 Pennsylvania Avenue, N.W., Washington, DC 20580. (The staff contact is Ruth Yodaiken, Bureau of Consumer Protection, 202-326-2127; see press release dated February 4, 2008.)

Copies of the documents mentioned in this release are available from the FTC’s Web site at http://www.ftc.gov and from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Call toll-free: 1-877-FTC-HELP.

FTC Issues 2008 Fair Debt Collection Practices Report to Congress

For Your Information

Issuance of Commission report to Congress: The Commission has authorized the staff to release publicly the 30th Annual Report to Congress on the Fair Debt Collection Practices Act (FDCPA). This report, which is available now on the FTC’s Web site, summarizes the Commission’s administration and enforcement of the FDCPA during 2007. It presents an overview of the types of consumer complaints received by the Commission, descriptions of the Commission’s debt-collection law enforcement actions, and a summary of the Commission’s consumer and industry education initiatives. The FDCPA prohibits deceptive, unfair, and abusive practices by third-party debt collectors. Section 815 of the FDCPA requires the Commission to submit annual reports to Congress. The Commission vote to issue the report was 5-0. (FTC File No. P084802; the staff contact is Karen Hickey, Bureau of Consumer Protection, 202-326-3224.)

Copies of the documents mentioned in this release are available from the FTC’s Web site at http://www.ftc.gov and from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Call toll-free: 1-877-FTC-HELP.

Contact Information

MEDIA CONTACT:
Office of Public Affairs
202-326-2180

FTC to Host Roundtable Discussion on Phishing Education

The Federal Trade Commission’s Bureau of Consumer Protection will host a half-day roundtable discussion on phishing education on Tuesday, April 1, 2008. Phishing is a form of online identity theft that uses deceptive spam to trick consumers into divulging sensitive or personal information, including credit card numbers and other financial data, either through email or a link to a copycat site. The roundtable event will provide an opportunity for experts from business, government, the technology sector, the advocacy community, academia, and the media to discuss new strategies to increase awareness of the issue and decrease risky online behavior.

The event will be held from 9 a.m. until 1 p.m. at the FTC’s conference center, 601 New Jersey Avenue, NW, Washington, DC. Doors will open at 8:30 a.m. It will begin with a guided discussion on the problem and current efforts to fight phishing attacks and educate consumers. A working session where participants will develop plans to increase consumer awareness about phishing will follow.

The event is open to the public. Those planning to attend should email Rosario Méndez at [email protected]. Reasonable accommodations for people with disabilities are available. Submit your request in advance to Carrie McGlothlin via email ([email protected]) or phone (202-326-3388). Please include a detailed description of the accommodation you need and how you can be reached if there are questions.

The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, click http://www.ftc.gov/ftc/complaint.shtm or call 1-877-382-4357. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad. For free information on a variety of consumer topics, click http://ftc.gov/bcp/consumer.shtm.

FTC Approves Federal Register Notice Seeking Comments on Revised Proposed Business Opportunity Rule

Commission approval of Federal Register notice: The Commission has approved the publication of a Federal Register notice seeking comments on a revised proposal for a new trade regulation rule governing business opportunities. Dating from 1978, the FTC historically has had a single rule covering two distinct types of offerings: franchises and business opportunity ventures. Many of the very familiar national fast-food restaurants and hotels, for example, are franchises, business opportunity ventures include vending machine routes, rack display operations, and medical billing schemes ventures. These ventures, unlike franchises, typically do not involve the right to use a trademark or other commercial symbol. Nevertheless, they do call for the opportunity seller to provide purchasers with locations for machines, or with accounts, or clients, and have been covered by the Franchise Rule.

In April 2006, the Commission proposed a separate Business Opportunity Rule that would cover just business opportunities ventures. Part of the proposal was to expand coverage to business arrangements that were not formerly covered by the Franchise Rule and to streamline disclosure obligations. (Business opportunities formerly covered by the Franchise Rule remain covered under an interim Business Opportunity Rule.) The revised notice announced today modifies the April 2006 proposal for the Business Opportunity Rule. The revised notice of proposed rulemaking (RNPR) will be published soon and is available now on the FTC’s Web site and as a link to this press release.

After evaluating the comments received on the April 2006 notice, the Commission has decided to issue an RNPR that is more narrowly focused than the April 2006 proposal. As proposed now, the Business Opportunity Rule would still cover those schemes currently covered by the interim Business Opportunity Rule, and it would expand coverage to include work-at-home schemes. The revised proposal, however, would not reach multi-level marketing companies or certain companies that may have been swept inadvertently into scope of the April 2006 proposal. The revised proposed rule also streamlines the requirement to disclose material information by eliminating requirements to disclose the number of cancellations and refund requests that a business opportunity seller receives or the litigation history of sales personnel.

The Commission will be accepting comments on the RNPR until May 27, 2008. Thereafter, rebuttal comments can be made by June 16, 2008.

The Commission vote approving publication of the notice was 5-0. (FTC File No. R511993; the staff contact is Monica E. Vaca, Bureau of Consumer Protection, 202-326-2245; see related press release dated April 5, 2006.)

Copies of the documents mentioned in this release are available from the FTC’s Web site at http://www.ftc.gov and from the FTC’s Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, DC 20580. Call toll-free: 1-877-FTC-HELP.

ValueClick to Pay $2.9 Million to Settle FTC Charges

Online advertiser ValueClick, Inc., will pay a record $2.9 million to settle Federal Trade Commission charges that its advertising claims and e-mails were deceptive and violated federal law. The agency also charged that ValueClick and its subsidiaries, Hi-Speed Media and E-Babylon failed to secure consumers’ sensitive financial information, despite their claims to do so. The settlement, filed by the Department of Justice on behalf of the FTC, requires ValueClick to clearly and conspicuously disclose the costs and obligations consumers must incur to receive the products it touts as “free” and bars future violations of the CAN-SPAM Act. The settlement also bars deceptive claims about the security of the consumer information collected at its e-commerce Web sites.

According to the FTC, ValueClick subsidiary Hi-Speed Media used deceptive e-mails, banner ads, and pop-ups to drive consumers to its Web sites. The e-mails and online ads claimed that consumers were eligible for “free” gifts, including laptops, iPods, and high-value gift cards, and included come-ons such as “Free PS3 for survey,” and “CONGRATULATIONS! Select your FREE Plasma TV.” The FTC alleged that consumers lured to ValueClick’s Web sites by these promises were led through a maze of expensive and burdensome third-party offers – including car loans and satellite television subscriptions – which they were required to “participate in” at their own expense, in order to receive the promised “free” merchandise. The FTC charged that ValueClick’s use of deceptively labeled e-mail offering free gifts and its failure to disclose that consumers must expend substantial sums of money to obtain the promised “free” merchandise violates the CAN-SPAM Act and the FTC Act.

The FTC also charged that ValueClick, Hi-Speed Media, and E-Babylon, misrepresented that they secured customers’ sensitive financial information consistent with industry standards. The FTC alleged the companies published online privacy policies claiming they encrypted customer information, but either failed to encrypt the information at all or used a non-standard and insecure form of encryption. The agency also charged that several of the companies’ e-commerce Web sites were vulnerable to SQL injection, a commonly known form of hacker attack, contrary to claims that the companies implemented reasonable security measures.

The settlement bars future violations of the CAN-SPAM Act. It requires ValueClick and Hi-Speed Media to clearly and conspicuously disclose in their ads and on their promotional Web pages that consumers have to spend money or incur other obligations to qualify for “free” merchandise. The settlement also requires them to provide a list of the obligations – such as applying for credit cards, purchasing products, or obtaining a car loan – that consumers must incur to qualify for a free product. In addition, ValueClick and Hi-Speed Media will pay a $2.9 million civil penalty to resolve the Commission’s CAN-SPAM allegations. This is the largest settlement in a case based on the CAN-SPAM Act, enacted in 2003.

The settlement also bars ValueClick, Hi-Speed Media, and E-Babylon from making misrepresentations about the use of encryption or other electronic measures to protect consumers’ information, and about the extent to which they protect personal information. The order also requires the companies to establish and maintain a comprehensive security program, and obtain independent third-party assessments of their programs, for 20 years.

This is the FTC’s third case targeting the use of deceptive promises of free merchandise by Internet-based “lead generation” operations, and the Commission’s 18th case challenging data security practices by a company handling sensitive consumer information.

The Commission vote to approve the stipulated final order was 5-0. It was filed in U.S. District Court for the Central District of California by the Department of Justice at the FTC’s request.

NOTE: Stipulated final orders are for settlement purposes only and do not constitute an admission by the defendant of a law violation. A stipulated order is subject to court approval and has the force of law when signed by the judge.

The FTC works for the consumer to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, click http://www.ftc.gov/ftc/complaint.shtm or call 1-877-382-4357. The FTC enters Internet, telemarketing, identity theft, and other fraud-related complaints into Consumer Sentinel, a secure, online database available to more than 1,600 civil and criminal law enforcement agencies in the U.S. and abroad. For free information on a variety of consumer topics, click http://ftc.gov/bcp/consumer.shtm.