THE DETAILS ARE IN YOUR ONLINE CONTRACT? THINK AGAIN!
By:  Susan E. Gindin

In September 2009, the Federal Trade Commission ("FTC") approved a final consent order in the Matter of Sears Holdings Management Corp. ("Sears"), in which the FTC charged that Sears violated Section 5 of the FTC Act in connection with a software application it offered as part of its "My SHC Community Program." The software application (the "Tracking Application") allowed Sears to track consumers’ online behavior, as well as to access some personally sensitive consumer data (for example, online bank account and prescription drug records).

In most respects, Sears did what nearly fifteen years of legal decisions, with only a few exceptions, have indicated make an enforceable online contract and privacy policy, namely, the user has a reasonable opportunity to review the terms of the agreement and the user indicates assent. For example, Sears included a combined Privacy Statement/User License Agreement ("PSULA") that described the Tracking Application in detail, and before a consumer agreed to have the Tracking Application installed, the consumer was required to check a box stating: "I am the authorized user of this computer and I have read, agree to, and have obtained the agreement of all computer users to the terms and conditions of the Privacy Statement and User License Agreement."

This action was alarming in light of the fact that for online transactions, it has been standard practice to include important disclosures in online contracts and privacy notices, and there is a long line of legal decisions upholding most electronic contracts. However, it is important to note that the FTC did not question whether the PSULA was enforceable—but rather whether Sears’ actions were unfair or deceptive.

The essence of the FTC’s complaint is that Sears did not adequately disclose the actual functions of the Tracking Application, and that understanding of the functions would be material to consumers when deciding whether to participate in the SHC Community.  Sears’ disclosures regarding the Tracking Application came too late in the process. First, consumers received extensive advertising material (including such enticements as “Get Advice Before You Buy,” “Join the Community. It’s Free!,” “Talk to Us! We’re Ready to Make Things Happen,” and “Connect With Others”) which did not describe the functions of the Tracking Application before consumers started the registration process.  Sears also offered $10 to consumers who kept the Tracking Application on their computers for at least thirty days, and therefore the opportunity was even more enticing. However, consumers did not have the opportunity to review the detailed description of the Tracking Application until they had taken multiple steps to register, and were then required to agree to the PSULA. Even then, the description of the functions of the Tracking Application did not appear until approximately the 75th line down in the PSULA which was presented to the consumer in a scroll box.

In the Complaint against Sears, the FTC alleged:

Respondent failed to disclose adequately that the software application, when installed, would: monitor nearly all of the Internet behavior that occurs on consumers’ computers, including information exchanged between consumers and websites other than those owned, operated, or affiliated with respondent, information provided in secure sessions when interacting with third-party websites, shopping carts, and online accounts, and headers of web-based email; track certain non-Internet related activities taking place on those computers; and transmit nearly all of the monitored information (excluding selected categories of filtered information) to respondent’s remote computer servers. These facts would be material to consumers in deciding to install the software. Respondent’s failure to disclose these facts, in light of the representations made, was, and is, a deceptive practice. . . . (emphasis added)

Material Terms Must Be Presented Clearly and Prominently

The enforcement action provides important lessons to advertisers regarding what constitutes acceptable online advertising.  First, it indicates that terms which are likely material to consumers must be presented clearly and prominently. It may not be enough to present consumers with important disclosures only in online contracts (no matter how completely the online contracts describe the product or service) if the material terms have not been presented clearly and prominently to the consumer in a meaningful manner.

This is not new. In 2000, the FTC issued Dot Com Disclosures, important guidelines for online businesses and advertisers conducting business online. Dot Com Disclosures is a detailed tutorial regarding what makes advertising acceptable in an online setting, and a review is helpful in understanding the reasons the FTC took action against Sears. The primary focus of the tutorial is that all disclosures to consumers must be Clear and Conspicuous, and it provides a lengthy list of actions advertisers should take to ensure that disclosures are clear and conspicuous, including:

Place disclosures near, and when possible, on the same screen as the triggering claim.
Use text or visual cues to encourage consumers to scroll down a Web page when it is necessary to view a disclosure.

Along with publication of Dot Com Disclosures, the FTC further emphasized its policy regarding online disclosures by holding multiple and repeated Green Lights & Red Flags: FTC Rules of the Road for Advertisers workshops in numerous different cities around the U.S. in the 2000’s.

In addition, in 2006 and 2007, the FTC brought enforcement actions against two companies, Zango, Inc. and DirectRevenue,  which, like Sears, did not adequately disclose that consumers' installation of software would monitor their Internet use.   In response to comments made regarding the Zango and Sears matters, the FTC has further clarified that disclosures made in user license agreements or privacy notices may not be sufficient to correct a misleading impression created elsewhere (for example, in advertising materials).

Increased FTC Online Consumer Protection

The Sears matter also reflects a possible shift from the position that the consumer is legally responsible for his actions (and in fact has a duty to read legal documents) to a more consumer protective position. Studies show that the online consumer is "click-happy" in accepting online contracts and is unlikely to consider the legal consequences of his or her online behavior. This has concerned the FTC for several years, and while the FTC has been engaged in multiple efforts to explore appropriate formats for notices that consumers will read, the FTC has also signaled commitment to increase online consumer protection efforts with enforcement actions like the Sears matter, as well as in official and unofficial statements.

The FTC has become quite emphatic about transparency regarding privacy issues since dealing with the Sears matter. In an interview with the New York Times in August, 2009, the new director of the FTC’s Bureau of Consumer Protection, David C. Vladeck, stated:

There is a sense of urgency around here. . . Consumers, I don’t think are sufficiently protected under the current regime. . . . [Disclosures are not] written principally to communicate information; they’re written defensively. I’m a lawyer. . . . I can’t figure out what the hell these consents mean anymore. And I don’t believe that most consumers either read them, or, if they read them, really understand it. . . . We’d prefer to persuade industry it’s in their best interests to cooperate on these sorts of things. If not, we’ll be forced to imagine the worst, and that doesn’t help anybody. . . . [T]here has to be greater transparency about what’s going on. Until I see evidence otherwise, we have to presume that most people don’t understand, and the burden is going to be on industry to persuade us that people really are well informed about this. . . . Our patience isn’t infinite. . . . [W]e can always bring enforcement cases, and we do set guidance through enforcement cases.

Therefore, it is especially important for businesses to avoid "hiding" material terms in online contracts or privacy policies but rather to ensure that material terms are presented clearly and prominently perhaps in notices separate from privacy policies and online contracts.

Advertising Materials Should Be Reviewed Together With the Terms of Online Contracts and Privacy Policies

Advertising materials (and particularly advertising associated with tracking of consumer personal data) should receive legal review to determine whether such materials comply with advertising legal requirements. The Sears matter also signals that advertising materials should be reviewed together with the terms of online contracts and privacy policies associated with the advertising campaign. This is to ensure that material disclosures are included clearly and conspicuously in advertising materials as well as in online contracts and/or privacy policies. The Sears PSULA likely would not have concerned the FTC if the advertising materials presented to the consumer had clearly and prominently disclosed the functions of the Tracking Application early in the process.

As a practical matter, advertising is typically created shortly before publication and lawyers are asked to review the advertising material under an extremely tight time frame. However, the FTC’s enforcement action is a lesson that the consequences for using problematic advertising materials can be harsh.

The fact that Sears was tracking the online (and some offline) activities of consumers seems to have been particularly problematic for the FTC. In another Alert, Perfect Storm for Behavioral Advertising, I discuss the implications of the Sears matter and other 2009 events on the behavioral advertising debate.

© 2009 Susan E. Gindin. Susan is Of Counsel, Intellectual Property & New Media Group, Isaacson Rosenbaum P.C., Denver, and she has concentrated on data privacy and security, electronic contracting, advertising, and intellectual property law for nearly fifteen years. She is also the author of Lost and Found in Cyberspace: Informational Privacy in the Age of the Internet, 34 San Diego L. Rev.1153 (1997) http://www.info-law.com/lost.html; Guide to E-Mail & the Internet in the Workplace, Bureau of Nat'l Affairs, Inc. (1999) http://www.info-law.com/guide.html; Current Issues in Drafting Electronic Transaction Agreements, Colo. Bar Ass'n (2002), When Are A Posted Privacy Policy and "Enforceable" Terms Of Use Not Enough? Lessons Learned and Questions Raised by the FTC’s Action Against Sears, 8 Nw. J. Tech. & Intell. Prop. (forthcoming Fall 2009); Nobody Reads Your Privacy Policy? It's Time for a New One!; and Perfect Storm for Behavioral Advertising: Four 2009 Events That May Hasten Legislation (and What This Means for Companies That Use Behavioral Advertising).

In the Matter of Zango, Inc. f/k/a 180Solutions, Inc., FTC File No. 052 3130 (Nov. 3, 2006) available at http://www.ftc.gov/os/caselist/0523130/index.shtm.  In the Matter of DirectRevenue LLC, File No. 052 3131 (Feb. 16, 2007) available at http://www.ftc.gov/os/caselist/0523131/index.shtm. Zango and DirectRevenue offered consumers free content and software, such as screensavers, games, and utilities, and downloading them would result in installation of adware which monitored consumers’ Internet use in order to display targeted pop-up ads.

Stephanie Clifford, Fresh Views at Agency Overseeing Online Ads,  N.Y. Times, Aug. 5, 2009, available at
http://www.nytimes.com/2009/08/05/business/media/05ftc.html?_r=1; and An Interview with David Vladeck of the F.T.C., N.Y. Times, Aug. 5, 2009, available at http://mediadecoder.blogs.nytimes.com/2009/08/05/an-interview-with-david-vladeck-of-the-ftc/.