The final settlement order requires Compete to obtain express consent from consumers before it collects any data, that it deletes or anonymises the data it has already collected and that it provides instructions to consumers on how to uninstall its software.

The settlement also bars Compete from making misrepresentations about its privacy and data security practices and requires the company to submit to independent privacy audits every two years for the next two decades.

Compete first agreed to settle with the FTC in October. The case attracted the attention of privacy advocates at the Electronic Privacy Information Center (Epic), who called on the FTC to toughen up the terms of the settlement and “grant consumers a right to access and ensure the accuracy of the data Compete maintains”.

Epic made several other demands, all of which were formally challenged by the Marketing Research Association on the grounds that they could have repurcusions for the wider research industry.

Having seen the FTC reject Epic’s proposals, Howard Fienberg, the MRA’s director of government affairs, said: “The agency’s enforcement action against Compete may be a great example of how the agency properly executes its authority and responsibility: by combating bad behaviour and working with possible offenders in order to remedy such behaviour and keep it from happening again.

“Activist groups such as Epic seem eager to turn the FTC into a policy-making body instead of an enforcement agency. We commend the FTC for staying focused on their primary mission: enforcing the law in order to protect American consumers.”