Upromise, a Sallie Mae-owned rewards program, agreed to settle Federal Trade Commission charges that it collected consumers' personal information without adequately disclosing the extent of the information it collected, the FTC announced.
Upromise collected personal information via its TurboSaver Toolbar, a browser add-on for members that reveals savings offers from participating retailers, according to the FTC. When the toolbar's “Personalized Offers” feature was enabled, Upromise collected data related to consumers' browsing behavior, such as names of sites visited, links clicked, search queries, user names and passwords.
The settlement terms state that Upromise must “clearly disclose its data collection practices,” receive consumer consent before installing or reactivating the toolbar and inform consumers how to uninstall the toolbar. Upromise also must destroy data collected through the “Personalized Offers” feature and notify consumers who had enabled the feature about the type of information collected and how to disable it.
The FTC noted that the information was transmitted without encryption, violating the toolbar's privacy statement which states that “all information collected in connection with the Personalized Offers” feature is transmitted using encryption.
“In some cases, the information collected included credit card and financial account numbers, user names and passwords used to access secured websites, security codes and expiration dates, and any Social Security numbers consumers entered into the webpages,” the FTC said in a statement.
Upromise's failure to disclose the extent of information collected by the toolbar, and its claims that it encrypted consumer data and took reasonable measures to protect data from unauthorized access, were deceptive and violated federal law, according to the FTC's complaint.
