California Company Settles FTC Charges, Agrees to Provide Effective Opt-Out for Consumers

Privacy/Cyber Risk & Data Security FTC

On April 21, the FTC announced that it had reached a settlement with a California company, which enables sellers to target digital advertisements to consumers, over allegations in violation of the FTC Act that the company deceived consumers by tracking them online and through their mobile devices even after consumers elected to opt out of such tracking. According to the 2016 complaint, the company’s privacy policy conveyed to consumers that its “opt-out mechanism would be effective in blocking tailored, anonymous ads on websites and apps. However, the opt-out cookie applied only to mobile browsers, and was not effective in blocking tailored, anonymous ads on mobile applications.” Moreover, the complaint also alleged that the company used unique identifiers to track specific consumers, even after they had blocked or deleted cookies.

Following a 30-day public comment period, the Commission voted 2-0 to approve the final order. The order prohibits the company from misrepresenting “the extent to which [it] collects, uses, discloses, retains, or shares” consumers’ information and the ability of consumers to limit, control, or prevent the ways the company uses their data. Furthermore, the company must direct consumers to a disclosure explaining the types of information the company collects and how it uses it for targeted advertising. Clear, easily-accessible opt-out options for consumers who choose not to have their information used in targeted advertising must also be featured. Notably, the Commission stated in letter-responses to two commenters that while it lacks the authority to obtain civil penalties for initial violations under Section 5 of the FTC Act, the company would risk civil penalties of up to $40,654 per violation per day as a compliance incentive and to deter other companies from engaging in similar conduct.