Be clear about what you collect
Twenty years ago nobody told their third grade classmates they wanted to go into web analytics when they grew up. But unlike cowboys and dinosaur wranglers, the analytics business is booming. Information about consumer behavior can offer companies helpful insights to boost web traffic and sales. But as a recent FTC settlement suggests, it’s wise to be transparent about your practices and take reasonable and appropriate measures to keep sensitive information secure.
Compete, Inc., is a market research company that develops and sells analytical reports about consumers’ online behavior. How did Compete compile the data it was selling? The FTC’s complaint focused on the operation of two of the company’s products: the Compete Toolbar, which consumers installed to get “instant access” to information about sites (like how popular the sites are) and the Consumer Input Panel, which invited people to sign up to be eligible for rewards while telling companies what they thought about their products. Compete offered the Toolbar and the Consumer Input Panel directly to consumers to install on their own, but also licensed its software so that other companies could incorporate the technology into their own toolbars and reward programs. Either way, the information ultimately went to Compete. By 2011, Compete had gathered data about more than four million consumers.
So what did Compete tell people — and not tell people — about what was going on? When consumers installed the Toolbar, they were prompted either to leave enabled or disable a feature called Community Share. As Compete explained, “By joining Community Share, the web pages you visit will be anonymously pooled with the Compete community to provide site trust rankings and analytics.” When people signed up for the Consumer Input Panel, here’s what Compete said: “[W]e measure your behavior as well as your opinions. Consumer Input utilizes a piece of software stored on your computer that anonymously transmits aspects of your Internet browsing behavior so that we can understand the sites, products and services you interact with.”
But according to the complaint, Compete collected a lot more than just browsing behavior or URLs. The FTC says that Compete’s Toolbar, the Consumer Input Panel, and third-party software incorporating Compete’s technology captured a lot of information consumers communicated on secure web pages, like credit card numbers, account numbers, security codes and expiration dates, user names, passwords, search terms, and Social Security numbers. Furthermore, the complaint charged that the information was transmitted to Compete’s servers in clear readable text. All this occurred in the background as consumers used the internet. Without special software and technical expertise, there was no way people would have known just how much info was being collected.
Next: More about the proposed Compete settlement