FTC Fines Upromise For Failing To Disclose Data Collection Practices
- by Wendy Davis @wendyndavis, March 22, 2017
The Federal Trade Commission has fined rebate company Upromise $500,000 for allegedly violating an order requiring it to disclose how the RewardU toolbar collects and uses data.
“Upromise once again didn’t disclose to consumers the extent of its data collection,” Tom Pahl, acting director of the Federal Trade Commission’s Bureau of Consumer Protection, said in a statement.
Upromise operates a loyalty program that promises rebates to members when they shop at specific merchants. The company also offers tools that enable users to easily add those rebates to a college savings account, or pay down student loans.
Between 2013 and 2016, Upromise distributed the free toolbar, RewardU, which collected data about users' search queries and other online activity, the FTC alleged in a complaint unveiled late last week.
"This collection occurs in the background as a consumer uses the Internet, and there is no way for consumers -- without special software or technical expertise -- to discover the extent of the data collection," the FTC alleged. "At least until January 2016, Upromise shared collected data with its affiliates with whom Upromise co-branded the toolbar."
According to the complaint, Rakuten Loyalty created and operated the toolbar, while Yahoo powered its search features. Yahoo paid commissions to Rakuten, which paid a portion to Upromise, the FTC said. In early 2016, Upromise stopped supporting the RewardU toolbar.
While Upromise made some disclosures, they did not appear until after "clicked a link or scrolled down two full screens and passed a large amount of intervening text," the FTC alleged.
What's more, the information was presented in small print, and in the style of a footnote, according to the FTC. The disclosures were written "in a style that is difficult for consumers to decipher," and the text was light gray.
Five years ago, Upromise settled FTC charges by agreeing to destroy data collected from 150,000 Web, and to clearly disclose its data collection practices.
