To quote everyone’s favorite Vulcan, “Live long and prosper.” But an FTC action against a San Francisco-based app company named Vulcun alleges that’s not what happened to consumers. According to the complaint, the company hit customers with an unfair and deceptive switcheroo of galactic proportions.
The story starts with Running Fred, a popular game offered as a Chrome browser extension. With more than 200,000 downloads, Running Fred earned a star rating of 4.5 out of 5 based on more than 2,300 reviews. But then Vulcun acquired the game and replaced it on users’ desktops with a wholly unrelated program called Weekly Android Apps. According to the FTC, the company did that without adequately informing users of the installation.
Once in place, Weekly Android Apps commandeered consumers’ devices in a way that made tribbles seem innocuous in comparison. Vulcun used Weekly Android Apps to force-install other apps onto users’ mobile devices. It managed that by hiding the permission-request associated with the other apps and automatically OKing them without users’ knowledge.
What happened to their devices made consumers wish Scotty could beam them up. Weekly Android Apps opened additional windows and reset their browser homepages. Desktop users saw new tabs or windows open repeatedly, but when they tried to close them, others popped up in their place. Weekly Android Apps would redirect browsers to the Google Play Store and install certain apps without users’ consent.
Judging from consumers’ reaction, it was as if Vulcun had set phasers to stun. As one person described it, “I didn’t ask for this extension to be installed, and there was no notification that it was being installed, yet it just showed up in my browser! I only found out about it because Chrome informed me that it was taking over my home page! How did this happen?” Another consumer pleaded, “I have never authorized this tab. Please stop these people!!!!”
There were other concerns that weren’t as apparent to users. Because Weekly Android Apps secretly accepted the default Android permissions request, the apps could have gained immediate access to users’ address book, photos, location, and persistent device identifiers. With the addition of some malicious code, they could have accessed other data on the device, including consumers’ financial and health information.
Put it all together and you’ve got conduct the complaint alleges as unfair under the FTC Act.
The FTC also challenges a number of Vulcun’s representations as false. For example, Vulcun said that Weekly Android Apps provided an impartial, independent selection of apps when, in fact, it was compensated for installing certain apps on consumers’ devices. Vulcun also claimed its app had 200,000 users and a 4.5 start rating. That may have been true for Running Fred, but it likely wasn’t the case for Weekly Android Apps. In addition, the company falsely claimed that Weekly Android Apps had been featured on prominent tech sites like MacRumors, Engadget and Lifehacker. Vulcun also touted that an associated browser extension, Apps by Cindy, had been selected as “one of the best mobile blogs of 2013” by RunMobile. Flat-out false, says the FTC.
Among other things, the proposed settlement will require Vulcun and officers Ali Moiz and Murtaza Hussain to clearly disclose to consumers before downloading any product or service the information it will access, how it will be used, and any associated built-in permissions. They’ll also have to get consumers’ express affirmative consent.
You can file an online comment about the settlement by March 8, 2016.
What’s the message for other app entrepreneurs? First, clearly disclose material information before consumers download your product and get their express informed approval – let’s call it a Vulcan Mind Meld – up front. Second, once your product is on a user’s device, you’re not free to boldly go wherever you want or to affect their device in ways you didn’t clearly disclose. Third, if there’s a material connection between the provider of a product and an endorser, disclose that connection.