If you make promises to consumers, you must honor them – and if you sign an FTC order, you must comply with it. That’s the lesson learned by Upromise, a college savings website, which must pay $500,000 for violating its existing FTC order.
Not familiar with Upromise? It offers free memberships that allow consumers to earn cash-back rewards on certain purchases. Members can direct those rewards to a college savings plan or to pay down student loans.
In 2012, Upromise signed an FTC settlement order stating that it would clearly disclose its toolbar data collection practices and obtain a third-party assessment of them. Why? At the time, the FTC alleged that Upromise’s TurboSaver toolbar collected information about users – like search terms, usernames, passwords and even credit card information – without disclosing the full extent of what was being collected.
So what’s the latest? Now, the FTC is bringing a civil penalty action against Upromise for violating the Commission’s 2012 order. The FTC alleges that Upromise has made some of the same mistakes with its RewardU toolbar as it did with its TurboSaver toolbar.
In particular, Upromise violated two provisions of the FTC’s order. First, it failed to clearly and prominently disclose the collection and use of consumer data by its RewardU toolbar. The relevant disclosures were displayed only after a consumer clicked a link or scrolled down two full screens of text, to the second paragraph of a footnote-style statement. Second, Upromise failed to obtain required third-party assessments of the RewardU toolbar. Instead, the company submitted assessments that evaluated Upromise’s operations not implicated under the Order.
When it comes to enforcing orders, the FTC is serious. That’s why Upromise must pay a $500,000 civil penalty judgment, under the terms of the proposed settlement. In addition, Upromise must configure its systems to permanently expire any RewardU-related cookies. Upromise also must tell users who downloaded the RewardU toolbar how they can uninstall the toolbar and delete associated cookies.
This case makes clear that the FTC will scrutinize order compliance. Companies who sign FTC orders must comply with all of the terms of the order. FTC orders are promises meant to be kept.