I like to keep my eye on the FTC site; they are very active in catching businesses violating the U.S. FTC Act by practicing unfair and deceptive business practices, particularly via the Internet. They really demonstrate the need for privacy and information security professionals to stay on top of what their business units and marketing areas are doing with regard to contacting consumers, forcing ads upon them, and gathering information from them.
On December 6 a consent order was filed, against Various Inc. and Adultfriendfinder.com, banning their adult-oriented, sexually explicit, online pop-up marketing ads that basically hit everyone using the Internet, including minors.
The FTC pointed out in the complaint that consumers, of all ages, who used innocent search terms such as “flowers,” “travel,” and “vacations” were forced “to view unsolicited sexually explicit online advertisements for AdultFriendFinder.com and Cams.com.”
The defendants
“used ad-serving software, often referred to as ‘spyware’ or ‘adware,’ that has been installed on consumers’ computers, often without consumers’ knowledge or consent, to cause … sexually explicit, full-screen advertisements to ‘pop-up’ on consumers’ computer screens.”
The defendants’ ads
“contain graphic images of fully or partially nude persons … and in many cases engaging in actual or simulated sexual conduct.”
The ads were
“displayed to computer users, including minors, who do not want to and who are not seeking out sexually explicit material.”
The FTC complaint claimed the defendants used several third-party marketing partners to get these marketing materials out to consumers.
The FTC determined the defendants, directly and through their contracted marketing partners,
“causes sexually explicit marketing media advertising [its] websites, including but not limited to pop-up advertisements, … to be foisted on consumers who do not want to view and have not solicited sexually explicit content.”
In many to most cases the material
“is disseminated to consumers who are not affirmatively and concurrently accessing sexually explicit content on the Internet.”
The FTC pointed out that many to most times computer users got the
“sexually explicit pop-ups when they were not visiting a sexually explicit website.”
Some of the terms of the proposed settlement include:
* Prohibiting the defendants from displaying the pop-up ads unless the consumers are actively seeking out sexually explicit content or have consented to viewing sexually explicit content.
* Defendents must take steps to ensure that third-party marketing partners comply with the settlement’s provisions, and terminate relationships with any contractors who do not comply.
* Defendants must establish an Internet-based way to allow consumers to submit complaints regarding the ads.
* Defendents must maintain records to enable the FTC to monitor the defendant’s compliance.
Even though this case was about sexually explicit pop-ups, the lessons learned go beyond that and should be considered by all businesses that want to use popup ads. Here are just a few:
1) The FTC has basically gone on record as considering these types of pop-up ads as spyware.
2) The way these pop-up ads are implemented may result in software being installed onto consumers’ computers without their consent. Obtaining consent to do such actions is one of the basic privacy principles upon which most data protection and privacy laws throughout the world are based.
3) Pop-up ads with content inappropriate to minors is an issue the FTC *will* bring into contention with an organization.
4) The FTC is increasingly broadening its application of the FTC Act to more types of activities.
5) Even though there was not a hard dollar fine involved, you can bet it is going to cost the defendants significant money to meet the settlement requirements, including maintaining detailed records for at least 5 years that must be provided to the FTC immediately upon their request, implement a system to allow complaints, review their contracted marketing vendors and get rid of those not up to these standards, have staff to handle all these activities, and so on.
Tags: Adultfriendfinder, adware, awareness and training, FTC Act, Information Security, information security policies, IT compliance, personally identifiable information, PII, policies and procedures, popup marketing, protecting information, risk management, security risk, security training, spyware, Various Inc.