When are a Posted Privacy Policy and 'Enforceable' Terms of Use Not Enough‘ The Many Lessons Learned and Questions Raised by the FTC’s Action Against Sears (Published as Nobody Reads Your Privacy Policy or Online Contract‘ Lessons Learned and Questions Raised by the FTC's Action Against Sears)

Abstract

In September 2009, the Federal Trade Commission ("FTC") approved a final consent order in the matter of Sears Holdings Management Corp. ("Sears"), regarding the FTC’s charges that Sears violated Section 5 of the FTC Act in connection with a software application it offered as part of its "My SHC Community Program." The software application (the "Tracking Application") allowed Sears to track consumers’ online behavior, as well as some offline activities.

In most respects, Sears did what nearly fifteen years of legal decisions, with only a few exceptions, have indicated make an enforceable online contract and privacy policy, namely, the user has a reasonable opportunity to review the terms of the agreement and the user indicates assent. For example, Sears included a Privacy Statement and User License Agreement ("PSULA") that described the Tracking Application in detail, and before a consumer agreed to have the Tracking Application installed, the consumer was required to check a box stating: "I am the authorized user of this computer and I have read, agree to, and have obtained the agreement of all computer users to the terms and conditions of the Privacy Statement and User License Agreement."

This action was alarming in light of the long line of legal decisions upholding most electronic contracts. However, it is important to note that the FTC did not question whether the PSULA was enforceable - but rather whether Sears’ actions were unfair or deceptive. The author concludes that Sears' disclosures regarding the Tracking Application were not clear and conspicuous, as required by FTC, and that the enforcement action was consistent with FTC long-standing policy and enforcement actions. However, the enforcement action raises serious questions regarding what constitutes effective notice, consent, and disclosure for advertising, privacy policy, and electronic contracting purposes.

Furthermore, the fact that a prominent "brick and mortar" retailer now employs online behavioral tracking technologies without providing adequate disclosures has intensified concerns in the current behavioral tracking/advertising dialogue (industry self-regulation v. federal legislation) in which Congress and the FTC remain very concerned regarding behavioral advertising/tracking. Yet, industry pundits and others claim that privacy concerns are overrated. Moreover, studies show that previous attempts to educate consumers about risks have been fruitless. However, a 2009 study and recent events indicate that consumers become very concerned about online privacy when they become aware of companies' uses of their personal information. The author affirms Congressional/FTC concerns but urges Congress to postpone legislation that would regulate behavioral advertising and instead favors allowing new self-regulatory initiatives time to work, while encouraging the FTC to bring enforcement actions against those companies which overstep the behavioral advertising boundaries.

Keywords: privacy, consumer protection, administrative law, legislation, advertising, contracts