Compete settles with FTC over ‘unauthorised’ data collection

In addition, Compete “failed to honour” promises it had made to protect the data it had collected, the FTC said.

The proposed settlement will require Compete to obtain “express consent” from consumers before collecting any data and ensure that the company delete or anonymise any data that has already been collected.

According to the FTC, Compete got consumers to download tracking software in a number of ways, including inviting them to join a Consumer Input Panel that would give them the opportunity to earn rewards while sharing their opinions about products and services. Compete also promised that consumers who downloaded and installed another piece of software, a toolbar, could collect instant data about the websites they had visited.

The FTC said: “Once installed, the Compete tracking component operated in the background, automatically collecting information about consumers’ online activity. It captured information consumers entered into websites, including consumers’ usernames, passwords, and search terms, and also some sensitive information such as credit card and financial account information, security codes and expiration dates, and Social Security Numbers.” 

The commission charged that several of Compete’s business practices were “unfair or deceptive and violated the law” and that the firm failed to disclose to consumers that it would be collecting detailed information. The FTC also accused it of making false promises about the data security measures it employed.

Under the terms of the proposed settlement, Compete must submit to third-party audits of its data privacy and security practices every two years for the next 20 years.

The settlement is subject to public comment for 30 days before final approval.