Agreement Enforces Privacy Promises, Prohibits Sale of Customer Lists Except Under Very Restricted Circumstances; Company Also Faces First Charge of Violation of the Children's Online Privacy Protection Act (COPPA)
In a settlement announced today by the Federal Trade Commission, Toysmart.com ("Toysmart") has agreed to settle charges the company violated Section 5 of the FTC Act by misrepresenting to consumers that personal information would never be shared with third parties and then disclosing, selling, or offering that information for sale in violation of the company's own privacy statement. The agreement forbids the sale of this customer information except under very limited circumstances.
The Commission also announced today that it will file an amended complaint with the U.S. District Court in Massachusetts alleging that Toysmart collected personal information from children in violation of the Children's Online Privacy Protection Act of 1998 ("COPPA") and its implementing regulations. The FTC's regulations went into effect on April 21, 2000, and this is the first complaint the Commission has filed alleging a violation of COPPA. COPPA requires that operators of commercial Web sites and online services directed to children under 13, and general audience sites that know that they are collecting personal information from children, obtain parents' consent before personal information is collected from their children. The amended complaint against Toysmart alleges that the site collected names, e-mail addresses, and ages of children under 13 without notifying parents or obtaining parental consent.
"Customer data collected under a privacy agreement should not be auctioned off to the highest bidder," according to Jodie Bernstein, Director of the FTC's Bureau of Consumer Protection. "This settlement protects consumers from a winner-take-all bid in bankruptcy court, ensuring only a family-oriented Web site willing to buy the entire Toysmart Web site has the ability to do so."
Bernstein also stated that "this settlement shows that the FTC is serious about enforcing the Children's Online Privacy Protection Act. This is the first charge brought under COPPA, and is only the start of our efforts to ensure that Web sites that gather information from children under 13 comply with the parental notification requirements of the law."
The settlement announced today resolves the issues in that lawsuit. The company is currently in Chapter 11 bankruptcy, in a case pending in the U.S. Bankruptcy Court for the District of Massachusetts, in Boston. Toysmart's motion to sell its assets, including the customer information, is set for hearing July 26, 2000.
Under the settlement agreement, Toysmart will file an order today in Bankruptcy Court ("Bankruptcy Order"), prohibiting Toysmart from selling the customer list as a stand-alone asset. The settlement only allows a sale of such lists as a package which includes the entire Web site, and only to a "Qualified Buyer"-- an entity that is in a related market and that expressly agrees to be Toysmart's successor-in-interest as to the customer information.
The Qualified Buyer must abide by the terms of the Toysmart privacy statement. If the buyer wishes to make changes to that policy, it must follow certain procedures to protect consumers. It may not change how the information previously collected by Toysmart is used, unless it provides notice to consumers and obtains their affirmative consent ("opt-in") to the new uses.
In the event that the Bankruptcy Court does not approve the sale of the customer information to a Qualified Buyer or a plan of reorganization within the next year, Toysmart must delete or destroy all customer information. In the interim, Toysmart is obligated to abide by its privacy statement.
After the Bankruptcy Order is approved, the FTC will also file a stipulated consent agreement and final order before the U.S. District Court, Massachusetts ("District Court Order"), enjoining the unlawful practices alleged in the Complaint, prohibiting Toysmart from making any false or misleading statements about the disclosure of personal information to third parties, and prohibiting Toysmart from disclosing, selling, or offering for sale to any third party any customer information, except as provided for in the Bankruptcy Order.
The District Court Order requires that Toysmart immediately delete or destroy all information collected in violation of COPPA. The District Court Order also requires that Toysmart confirm through a sworn statement under penalty of perjury that it has never previously violated its privacy statement.
The Commission vote to approve the settlement was 3-2, with Commissioners Sheila F. Anthony and Orson Swindle voting against the settlement, and with Commissioner Mozelle W. Thompson issuing a separate statement.
In her statement, Commissioner Anthony declared that the terms of the negotiated settlement were insufficient to protect consumer privacy. Anthony stated: "To accept the bankruptcy settlement would place business concerns ahead of consumer privacy. Although the proposed settlement's definition of a qualified buyer attempts to ensure that only an entity 'similar' to Toysmart is eligible to purchase the list, I do not believe that this limitation is an adequate proxy for consumer privacy interests. In my view, consumer privacy would be better protected by requiring that consumers themselves be given notice and choice before their detailed personal information is shared with or used by another corporate entity -- especially where, as here, consumers provided that information pursuant to a promise not to transfer it."
Commissioner Swindle argued against any sale of the consumer information collected by Toysmart. Swindle said: "I agree that a sale to a third party under the terms of the Bankruptcy Order would be a substantial improvement over the sale that likely would have occurred without Commission action. Nevertheless, I do not think that the Commission should allow the sale.
If we really believe that consumers attach great value to the privacy of their personal information and that consumers should be able to limit access to such information through private agreements with businesses, we should compel businesses to honor the promises they make to consumers to gain access to this information. Toysmart promised its customers that their personal information would never be sold to a third party, but the Bankruptcy Order in fact would allow a sale to a third party. In my view, such a sale should not be permitted because 'never' really means never."
NOTE: The stipulated final judgment and order is for settlement purposes only and does not constitute an admission by the defendants of a law violation. The judgment has the force of law when signed by the judge.
Copies of the amended complaint, the proposed settlement agreement, and the statements of the Commissioners are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580; 877-FTC-HELP (877-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.
Office of Public Affairs
Bureau of Consumer Protection
Bureau of Consumer Protection
(FTC File No. X000075)
1. See July 10, 2000, press release, FTC Sues Failed Website, Toysmart.com, for Deceptively Offering for Sale Personal Information of Website Visitors, available at http://www.ftc.gov/opa/2000/07/toysmart.htm.