Selling customer data breached privacy policy, says FTC

This is the first FTC case to challenge deceptive and unfair practices in connection with a company's material change to its privacy policy.

The proposed settlement bars Gateway Learning from making deceptive claims about how it will use consumers' information and from applying material changes in its privacy policy retroactively, without consumers' consent. It also requires that the company give up $4,600 it earned from renting the data.

Gateway Learning, which markets and sells products under the "Hooked on Phonics" brand name, is based in Santa Ana, California.

"It's simple – if you collect information and promise not to share, you can't share unless the consumer agrees," said Howard Beales, Director of the FTC's Bureau of Consumer Protection. "You can change the rules but not after the game has been played."

Since 2000, Gateway Learning has marketed its "Hooked on Phonics" products on the Internet at www.hop.com. The site's privacy policy stated: 2We do not sell, rent or loan any personally identifiable information regarding our consumers with any third party unless we receive customer's explicit consent."

Another statement said, "We do not provide any personally identifiable information about children under 13 years of age to any third party for any purpose whatsoever." The policy also said that if Gateway Learning changed its policy, it would give consumers the chance to opt-out of having their information shared.

According to the FTC, in April 2003, despite these promises, Gateway Learning started renting personal information provided by consumers – including their names, addresses, phone numbers, and age ranges and gender of their children – to target marketers to send mailings and make telemarketing calls.

In June 2003, Gateway Learning revised the privacy policy on its Web site to say that "from time to time" Gateway Learning would provide consumers' personal information to "reputable companies" whose products or services consumers might find of interest, the FTC complaint says.

However, according to the FTC, Gateway Learning continued to rent information collected under the earlier policy. The FTC alleges that Gateway Learning did not contact consumers who had already provided their information to say that it had revised its privacy policy, nor did it highlight on its web site the fact that the privacy policy had changed. On 1st July, 2003, Gateway Learning halted its rentals of consumer data collected on-line.

The settlement bars misrepresentations about how Gateway Learning will use data it collects from consumers. It prohibits Gateway Learning from sharing any personal information collected from consumers on its Web site under the earlier privacy policy unless it first obtains express affirmative ("opt-in") consent from consumers, and prohibits it from applying future material changes to its privacy policy retroactively without consumers' consent. It also requires Gateway Learning to give up $4,608 it earned from renting consumers' information.