Now Available:

line

Featured Resources:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Rebecca.

« And The Award For Best Email Security Awareness Film of 2007 Goes To... | Main | FDIC Releases Updated IT Officer’s Risk Management Program Questionnaire »

FTC Settlement For Marketing Via Pop-up Ads: Lessons For All Marketers Regarding Consent & Consumer Complaints

I like to keep my eye on the FTC site; they are very active in catching businesses violating the U.S. FTC Act by practicing unfair and deceptive business practices, particularly via the Internet. They really demonstrate the need for privacy and information security professionals to stay on top of what their business units and marketing areas are doing with regard to contacting consumers, forcing ads upon them, and gathering information from them.

On December 6 a consent order was filed, against Various Inc. and Adultfriendfinder.com, banning their adult-oriented, sexually explicit, online pop-up marketing ads that basically hit everyone using the Internet, including minors.

The FTC pointed out in the complaint that consumers, of all ages, who used innocent search terms such as "flowers," "travel," and "vacations" were forced "to view unsolicited sexually explicit online advertisements for AdultFriendFinder.com and Cams.com."

The defendants

"used ad-serving software, often referred to as 'spyware' or 'adware,' that has been installed on consumers' computers, often without consumers' knowledge or consent, to cause ... sexually explicit, full-screen advertisements to 'pop-up' on consumers' computer screens."

The defendants' ads

"contain graphic images of fully or partially nude persons ... and in many cases engaging in actual or simulated sexual conduct."

The ads were

"displayed to computer users, including minors, who do not want to and who are not seeking out sexually explicit material."

The FTC complaint claimed the defendants used several third-party marketing partners to get these marketing materials out to consumers.

The FTC determined the defendants, directly and through their contracted marketing partners,

"causes sexually explicit marketing media advertising [its] websites, including but not limited to pop-up advertisements, ... to be foisted on consumers who do not want to view and have not solicited sexually explicit content."

In many to most cases the material

"is disseminated to consumers who are not affirmatively and concurrently accessing sexually explicit content on the Internet."

The FTC pointed out that many to most times computer users got the

"sexually explicit pop-ups when they were not visiting a sexually explicit website."

Some of the terms of the proposed settlement include:

* Prohibiting the defendants from displaying the pop-up ads unless the consumers are actively seeking out sexually explicit content or have consented to viewing sexually explicit content.

* Defendents must take steps to ensure that third-party marketing partners comply with the settlement's provisions, and terminate relationships with any contractors who do not comply.

* Defendants must establish an Internet-based way to allow consumers to submit complaints regarding the ads.

* Defendents must maintain records to enable the FTC to monitor the defendant's compliance.

Even though this case was about sexually explicit pop-ups, the lessons learned go beyond that and should be considered by all businesses that want to use popup ads. Here are just a few:

1) The FTC has basically gone on record as considering these types of pop-up ads as spyware.

2) The way these pop-up ads are implemented may result in software being installed onto consumers' computers without their consent. Obtaining consent to do such actions is one of the basic privacy principles upon which most data protection and privacy laws throughout the world are based.

3) Pop-up ads with content inappropriate to minors is an issue the FTC *will* bring into contention with an organization.

4) The FTC is increasingly broadening its application of the FTC Act to more types of activities.

5) Even though there was not a hard dollar fine involved, you can bet it is going to cost the defendants significant money to meet the settlement requirements, including maintaining detailed records for at least 5 years that must be provided to the FTC immediately upon their request, implement a system to allow complaints, review their contracted marketing vendors and get rid of those not up to these standards, have staff to handle all these activities, and so on.

TrackBack

TrackBack URL for this entry:
http://www.realtime-itcompliance.com/type/mt-tb.cgi/597

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.