The settlement will bar use of the personal data the company has
already collected, as well as future misrepresentations about the
collection, use, or disclosure of personally identifiable
information
According to the FTC, Vision I Properties, LLC, doing business
as CartManager International, provides its shopping cart software
and related services to thousands of on-line merchants.
When consumers are ready to make a purchase, they enter
information on "shopping cart" and "check out" pages that ask for
their name, address, phone number, e-mail address, credit card
number, and merchandise.
The pages are designed to look like the other pages on the
merchants' sites, and typically display the merchants' names and
logos, but are actually located on the CartManager site.
According to the regulator, some of the merchants who used
CartManager's shopping cart and check out software made privacy
pledges to their customers such as "PRIVACY POLICY: It's simple. We
don't sell, trade, or lend any information on our customers or
visitors to anyone."
But CartManager collected and rented the personal information of
nearly one million consumers who shopped at merchant sites.
The FTC alleges that CartManager did not adequately inform
consumers or merchants that it would collect and rent this
information and that it acted knowing that renting the information
was contrary to many merchants' privacy policies. The agency
charged that CartManager was unfair and violated federal law.
"Companies and service providers must make sure that their
privacy policies are in sync," said Lydia Parnes, Acting Director
of the FTC's Bureau of Consumer Protection. "A service provider
cannot secretly collect and rent consumers' personal information,
contrary to a merchant's privacy policy. At the same time,
merchants have an obligation to know what their service providers
are doing with consumers' personal information."
The settlement bars disclosure of previously collected personal
information and bars misrepresentations about the collection, use,
or disclosure of personally identifiable information.
It requires that CartManager and merchants' privacy practices be
consistent, or, if not, that CartManager post a clear and
conspicuous disclosure to consumers on each of its pages stating
that consumers are on a CartManager site and that personal
information collected on the site will be used, sold, rented, or
disclosed to third parties.
The settlement also requires that CartManager give up the
$9,101.63 in fees it made by selling the information.
Finally, the settlement contains certain record-keeping
provisions to allow the Commission to monitor compliance with its
order.
