Explanation of the FTC and Upromise Settlement Order
Users of the rewards program and college savings plan, Upromise will be interested in the order filed by the Federal Trade Commission regarding Upromise. The final order which settles charges with Upromise, Inc. includes a number of new requirements that have to be followed in order to keep the college savings service going.
What Is Upromise?
Upromise, Inc., is most known for providing a membership reward service which assisted consumers in saving money for college. With the service, you would use the web-browser toolbar that was provided. You would then use the toolbar for your online shopping through thousands of Upromise partner sites, such as with Overstock.com, Walmart, and Best Buy, and earn rewards. Rewards are also earned similar to credit card rewards on dining out, book travel and grocery coupons. You could even earn rewards from the Upromise credit card. These rewards are then redeemed for a savings plans in the form of savings accounts, 529 Savings Account Plans, payment toward an eligible Sallie Mae Student Loan, or just a check.
The Charges Against Upromise
It seemed like a handy dandy tool that may help consumers earn rewards like the many other toolbars out there that do the same thing. However, the Upromise TurboSaver Toolbar allegedly collected consumer’s personal information without disclosing that this information was being collected.
The information collected included minor things such as usernames and passwords, but also user information on secure websites such as online banks, credit card numbers, and Social Security numbers.
In fact, pre settlement order, the privacy disclaimer on the Upromise toolbar falsely indicated that personal information was secure and private with policies and procedures designed to safeguard information. They also claimed to automatically encrypt information but the filter used to collect the date was found to be too narrow and not structured properly. A lot of personal information that was entered onto web pages was actually collected without encryption.
Upromise defended the practices by claiming that some of the information was collected inadvertently but personal information was removed before transmitted. However, the failure to disclose the practice of collecting information was deemed by the FTC as failure to take reasonable and appropriate measures to protect consumers’ data.
The Settlement Order Between Upromise and the FTC
The Final Order by the FTC settling charges with Upromise does not require Upromise to discontinue collecting personal data as many people would probably prefer, instead they are required to disclose its exact data collection practices and ask for the consent before any toolbar products are added or installed. Other requirements include barring misrepresentations about the extent of the maintenance of the privacy and security of user’s personal information, among other things.
This order also requires Upromise to destroy data that has already been collected and to insure they have clear consent from the consumer to install any product similar to the Upromise toolbar. This disclosure also has to be separate from any other agreement, partially I would suspect, to insure that consumers are actually paying attention to and reading the disclosure. Consumers must also be notified of how the information will be collected and be provided instructions on disabling the toolbar and/or uninstalling the toolbar.
What Does this Mean to You?
The question however, is whether these types of requirements mean anything to consumers who probably never paid much attention the disclosures in the first place. How many Upromise users were ever aware that there was a security issue, or that their personal information was being collected? At some point, consumers will need to become more educated on how these services work and the potential risks of using these services. Upromise is guilty most of all for not disclosing information, but consider how many consumers ever thought to look into or investigate on their own how their personal information was being used when they installed the toolbar and shopped at participating retailers directly through the Upromise toolbar.
The other question is also directed toward consumers. At what point are we to be responsible for looking into and investigating services when we know full well, our information may be collected? And how many consumers will still choose to opt in on these services, even when they know that all of their personal information may be collected? Furthermore at what point if any, is the deal or discount worth sacrificing privacy?
Sources:
