Online market researcher Compete agreed to settle Federal Trade Commission charges that it deceived consumers and failed to safeguard the sensitive information it collected.
Compete recruits consumers to download tracking software by urging them to join a consumer panel or install a toolbar that would provide data about Web sites visited. In exchange, Compete collected information about consumer online behavior that it analyzed and sold to companies that use the reports to create Web sites and ad campaigns.
But the company, owned by media research goliath Kantar Media, collected a lot more than just "the Web pages you visit." According to the FTC complaint, Compete captured sensitive personal information such as passwords, credit card info and social security numbers, even though it told consumers that it would strip all that data out. It also failed to disclose that it would collect information about consumer purchases. By 2011, the company had gathered personal data about more than four million consumers.
The settlement requires Compete to obtain consumers' express consent before collecting any data and fully disclose the information collected. It must also delete or anonymize the use of the data and provide directions to consumers for uninstalling the software Compete uses to gather the data. Barred from misrepresenting its privacy and security policies in the future, Compete must also undergo third-party audits every two years for 20 years.
In a statement, Compete said it has already made changes. "Compete is committed to maintaining consumer privacy. When we learned in January 2010 that there was a potential security issue, we immediately disabled data collection from affected versions of the software and deleted from our servers information that may have been inadvertently collected. We also implemented new data filters and security measures. We will continue to develop and uphold new standards for transparency and security."
Four of the FTC commissioners voted to accept the settlement. Commissioner Thomas Rosch (R) abstained.