A Massachusetts company owned by education-lending giant Sallie Mae has agreed to pay authorities a $500,000 penalty and be subjected to 20 years of federal oversight to settle allegations it secretly tracked its users’ web traffic.
“Upromise once again didn’t disclose to consumers the extent of its data collection, and failed to comply with the FTC’s order to get required privacy assessments, said Tom Hahl, acting director of the Federal Trade Commission’s Bureau of Consumer Protection. “Companies must keep their privacy promises.”
Based in Newton, Upromise makes and promotes a series of products designed to help users funnel cash back from purchases to pay off student loans or go directly to a savings account. The company has a Upromise credit card, where purchases at participating stores — including Barnes & Noble, Wal-Mart, L.L. Bean and hundreds of other brands and companies — result in a small percentage of the amount spent being returned to the consumer in an account held by Upromise.
In an effort to notify users when they were on the website of a participating company, Upromise began promoting a toolbar, RewardU, that would send an alert when the customer went to one of them.
But to do that, the FTC alleged, the toolbar tracked every website users visited, and then sent the information to two Upromise affiliates involved in the toolbar. The FTC alleged Upromise did not clearly disclose that to users.
“The RewardU download page purportedly disclosed the toolbar’s data collection and use practices after a consumer clicked a link or scrolled down two full screens and passed a large amount of intervening text,” the complaint said.
Under a 2012 settlement with the FTC, Upromise had said it would make any tracking by its products obvious. That order came after Upromise failed to disclose web tracking by another toolbar it promoted. The penalty is specifically for violating the first order.
In a statement, Upromise said it no longer promotes the toolbar, and called the allegations “technical.”
“Upromise reached a settlement with the Federal Trade Commission in response to an alleged technical violation regarding a discontinued online toolbar. Upromise has settled the issue with no admission of wrongdoing,” said Richard Castellano, a Upromise spokesman.
In addition to the penalty, Upromise must get a third party to assess any new product to make sure it adequately discloses any data tracking, and tell authorities about nearly every aspect of its business, including revenues, employees, and any sale, acquisition or new product it announces for 20 years.
