FTC Announces Settlement With Bankrupt Website, Toysmart.com, Regarding Alleged Privacy Policy Violations

In a settlement announced today by the Federal Trade Commission, Toysmart.com ("Toysmart") has agreed to settle charges the company violated Section 5 of the FTC Act by misrepresenting to consumers that personal information would never be shared with third parties and then disclosing, selling, or offering that information for sale in violation of the company's own privacy statement. The agreement forbids the sale of this customer information except under very limited circumstances.

The Commission also announced today that it will file an amended complaint with the U.S. District Court in Massachusetts alleging that Toysmart collected personal information from children in violation of the Children's Online Privacy Protection Act of 1998 ("COPPA") and its implementing regulations. The FTC's regulations went into effect on April 21, 2000, and this is the first complaint the Commission has filed alleging a violation of COPPA. COPPA requires that operators of commercial Web sites and online services directed to children under 13, and general audience sites that know that they are collecting personal information from children, obtain parents' consent before personal information is collected from their children. The amended complaint against Toysmart alleges that the site collected names, e-mail addresses, and ages of children under 13 without notifying parents or obtaining parental consent.

"Customer data collected under a privacy agreement should not be auctioned off to the highest bidder," according to Jodie Bernstein, Director of the FTC's Bureau of Consumer Protection. "This settlement protects consumers from a winner-take-all bid in bankruptcy court, ensuring only a family-oriented Web site willing to buy the entire Toysmart Web site has the ability to do so."

Bernstein added: "The settlement also protects customers of Toysmart from unilateral privacy policy changes in the future by a bankruptcy purchaser. Any change in the original Toysmart policy will have to be approved by consumers on an 'opt-in' basis before the successor company can make such a change."

Bernstein also stated that "this settlement shows that the FTC is serious about enforcing the Children's Online Privacy Protection Act. This is the first charge brought under COPPA, and is only the start of our efforts to ensure that Web sites that gather information from children under 13 comply with the parental notification requirements of the law."

Until recently, Toysmart was a popular Web site that marketed and sold educational and non-violent children's toys over the Internet. Through its Web site, Toysmart collected detailed personal information about its visitors, including name, address, billing information, shopping preferences, and family profiles -- which included the names and birthdates of children. Since September 1999, Toysmart has posted a privacy policy which states that information collected from customers will never be shared with third parties. When it ran into financial difficulties, however, it attempted to sell all of its assets, including its detailed customer databases, and on July 10, 2000, the FTC filed a lawsuit in the U.S. District Court for the District of Massachusetts against Toysmart to prevent the sale of the customer information.(1)

The settlement announced today resolves the issues in that lawsuit. The company is currently in Chapter 11 bankruptcy, in a case pending in the U.S. Bankruptcy Court for the District of Massachusetts, in Boston. Toysmart's motion to sell its assets, including the customer information, is set for hearing July 26, 2000.

Under the settlement agreement, Toysmart will file an order today in Bankruptcy Court ("Bankruptcy Order"), prohibiting Toysmart from selling the customer list as a stand-alone asset. The settlement only allows a sale of such lists as a package which includes the entire Web site, and only to a "Qualified Buyer"-- an entity that is in a related market and that expressly agrees to be Toysmart's successor-in-interest as to the customer information.

The Qualified Buyer must abide by the terms of the Toysmart privacy statement. If the buyer wishes to make changes to that policy, it must follow certain procedures to protect consumers. It may not change how the information previously collected by Toysmart is used, unless it provides notice to consumers and obtains their affirmative consent ("opt-in") to the new uses.

In the event that the Bankruptcy Court does not approve the sale of the customer information to a Qualified Buyer or a plan of reorganization within the next year, Toysmart must delete or destroy all customer information. In the interim, Toysmart is obligated to abide by its privacy statement.

After the Bankruptcy Order is approved, the FTC will also file a stipulated consent agreement and final order before the U.S. District Court, Massachusetts ("District Court Order"), enjoining the unlawful practices alleged in the Complaint, prohibiting Toysmart from making any false or misleading statements about the disclosure of personal information to third parties, and prohibiting Toysmart from disclosing, selling, or offering for sale to any third party any customer information, except as provided for in the Bankruptcy Order.

The District Court Order requires that Toysmart immediately delete or destroy all information collected in violation of COPPA. The District Court Order also requires that Toysmart confirm through a sworn statement under penalty of perjury that it has never previously violated its privacy statement.

The Commission vote to approve the settlement was 3-2, with Commissioners Sheila F. Anthony and Orson Swindle voting against the settlement, and with Commissioner Mozelle W. Thompson issuing a separate statement.

In her statement, Commissioner Anthony declared that the terms of the negotiated settlement were insufficient to protect consumer privacy. Anthony stated: "To accept the bankruptcy settlement would place business concerns ahead of consumer privacy. Although the proposed settlement's definition of a qualified buyer attempts to ensure that only an entity 'similar' to Toysmart is eligible to purchase the list, I do not believe that this limitation is an adequate proxy for consumer privacy interests. In my view, consumer privacy would be better protected by requiring that consumers themselves be given notice and choice before their detailed personal information is shared with or used by another corporate entity -- especially where, as here, consumers provided that information pursuant to a promise not to transfer it."

Commissioner Swindle argued against any sale of the consumer information collected by Toysmart. Swindle said: "I agree that a sale to a third party under the terms of the Bankruptcy Order would be a substantial improvement over the sale that likely would have occurred without Commission action. Nevertheless, I do not think that the Commission should allow the sale.

If we really believe that consumers attach great value to the privacy of their personal information and that consumers should be able to limit access to such information through private agreements with businesses, we should compel businesses to honor the promises they make to consumers to gain access to this information. Toysmart promised its customers that their personal information would never be sold to a third party, but the Bankruptcy Order in fact would allow a sale to a third party. In my view, such a sale should not be permitted because 'never' really means never."

In his statement approving the settlement, Commissioner Thompson underlined the fact that Toysmart's customer database - its most valuable asset in bankruptcy - is intrinsically linked to its privacy policy. "In building this asset, however, Toysmart made a covenant with its customers; the company's lack of success does not extinguish this important obligation which forms the very basis for the existence of the asset." Thompson added that his "decision to approve the settlement is not without reservation. Like my colleagues Commissioner Anthony and Commissioner Swindle, I think that consumers would benefit from notice and choice before a company transfers their information to a corporate successor." He concluded by urging "any successor to provide Toysmart customers with notice and an opportunity to 'opt out' as a matter of good will and business practice."

NOTE: The stipulated final judgment and order is for settlement purposes only and does not constitute an admission by the defendants of a law violation. The judgment has the force of law when signed by the judge.

Copies of the amended complaint, the proposed settlement agreement, and the statements of the Commissioners are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580; 877-FTC-HELP (877-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.

1.  See July 10, 2000, press release, FTC Sues Failed Website, Toysmart.com, for Deceptively Offering for Sale Personal Information of Website Visitors

(FTC File No. X000075)