Vision I Properties, LLC, doing business as Cartmanager International

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF VISION I PROPERTIES, LLC, doing business as CARTMANAGER INTERNATIONAL CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4135; File No. 0423068 Complaint, April 19, 2005–Decision, April 19, 2005 This consent order, among other things, prohibits the respondent from making, expressly or by implication, any false or misleading representation regarding the collection, use, or disclosure of personally identifiable information (“PII”). The order also prohibits the respondent from selling, renting, or disclosing to any third party for marketing purposes any PII collected from consumers -through shopping cart software used at a merchant customer’s Web site -before the order became effective. In addition, the order prohibits the respondent from selling, renting or disclosing to any third party for marketing purposes any PII collected from consumers -- through shopping cart or other software used at a merchant customer’s Web site -- after the order became effective, without taking certain steps to ensure that consumers receive advance notice that the information they provide may be sold, rented, or disclosed to third parties. The order also requires the respondent to disgorge to the United States Treasury the fees it received from renting consumer information. Participants For the Commission: Loretta H. Garrison, Laura Mazzarella, Jessica L. Rich, Joel Winston, Louis Silversin, and Gerard R. Butters.

For the Respondent: Joseph Emig.

COMPLAINT The Federal Trade Commission, having reason to believe that Vision I Properties, LLC, doing business as CartManager International, a corporation (“Vision One” or “Respondent”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

VISION I PROPERTIES, LLC, ET AL. 297 Complaint 1. Respondent Vision One is a Utah corporation with its principal office or place of business at 2250 N. University Parkway, Suite 4880, Provo, UT 84604.

2. The acts and practices of Respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. 3. Respondent licenses shopping cart software and provides related services to thousands of small online retail merchants through its Web site, www.cartmanager.com. The shopping cart software generates customizable “shopping cart” and “check out” Web pages for use on the merchants’ Web sites. These pages reside on Respondent’s Web site but are designed to look like the other pages on the merchant’s site and typically display the merchant’s name and logo.

4. When a consumer seeks to make a purchase from a merchant Web site that uses Respondent’s software, the software generates shopping cart and check out pages, which collect information provided by the consumer. Such information includes the consumer’s name, billing and shipping addresses, phone number, email address, credit card information, and the item and quantity of merchandise selected by the consumer. The software then transmits the customer information to Respondent and notifies the merchant so that the merchant can fulfill the customer’s order.

5. Some of the merchants using Respondent’s shopping cart software have disseminated or caused to be disseminated various privacy policies on their Web sites. These privacy policies contain statements regarding the use and disclosure of personal information collected through their Web sites. A few examples of these statements are as follows: A. “[ ] is committed to protecting customer privacy. We use the information we collect from you to process orders and to provide an enhanced shopping experience. [ ] does not sell, VOLUME 139 Complaint trade or rent personal information or shopping habits to third parties. Customer account and transaction information, as well as correspondence, is handled with the utmost discretion.”

B. “PRIVACY POLICY: It’s simple. We don’t sell, trade, or lend any information on our customers or visitors to anyone.”

C. “[ ] Pledges and solidly guarantees that all personal information, from any source, that is submitted, gathered, tracked or otherwise obtained or retained in the normal course of online business activity associated with the company’s Web site/s, is secure and held confidential at all times from sale, disclosure, rental, and tampering by any known third party. . . .”

D. “[ ] is committed to protecting your privacy. . . . We never sell any information to outside parties. We protect your information from unauthorized access. Information you give us is used only to the extent needed to conduct our business and to meet the highest quality service standards for processing, verifying and filling your orders.” 6. In January 2003, Respondent began renting to third parties for marketing purposes consumers’ personal information collected through shopping cart and check out pages generated by its software at merchant sites. Such personal information includes the name, address, phone number, and purchase history of nearly one million consumers. This personal information was used by third parties to send direct mail and make telemarketing calls to consumers who shopped at merchant sites using the software.

7. Although the shopping cart and check out pages generated by Respondent’s software appear to be part of the merchants’ sites, the pages do not disclose to consumers that the information entered on them is not subject to the merchant VISION I PROPERTIES, LLC, ET AL. 299 Complaint privacy policies or that it will be shared with third parties for marketing purposes. Further, because the shopping cart and check out pages are typically the only pages on the merchants’ sites that collect personal information, consumers reasonably expect that the merchants’ privacy policies cover information consumers provide on those pages.

8. Respondent also does not adequately inform merchants – in promoting its shopping cart software or at a later time – that it intends to use information collected from merchants’ customers in a manner that may be inconsistent with the merchants’ privacy policies or that it intends to share the information with third parties for marketing purposes. Although Respondent’s online license agreement asserts that "CartManager shall retain full ownership of all data submitted by either Merchant or Purchaser through the CartManager Shopping Cart . . . including, but not limited to name, mailing & shipping address, email address, phone number, dollar amount of purchase, type of purchase and description of purchase," this statement is buried in the middle of the online agreement and does not explain how Respondent intends to use the information or that such use may conflict with the merchants’ privacy policies.

9. Through shopping cart software used at merchant Web sites, Respondent has collected personal information from consumers and shared it with third parties knowing that such practices were contrary to merchant privacy policies. Respondent’s practices have caused consumers substantial injury that is not offset by countervailing benefits to consumers or competition. Further, because Respondent’s practices were not adequately disclosed to merchants or consumers, the injury was not reasonably avoidable.

10. The acts and practices of Respondent as alleged in this complaint constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a).

VOLUME 139 Complaint THEREFORE, the Federal Trade Commission this nineteenth day of April, 2005, has issued this complaint against Respondent. VISION I PROPERTIES, LLC, ET AL. 301 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft Complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondent with violation of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq; The Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by Respondent that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission's Rules; and The Commission having thereafter considered the matter and having determined that it has reason to believe that the Respondent has violated the said Act, and that a Complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days, now in further conformity with the procedure described in Section 2.34 of its Rules, the Commission hereby issues its Complaint, makes the following jurisdictional findings and enters the following Order:

1. Respondent Vision I Properties, LLC, d/b/a CartManager International (“Vision One”), a corporation with its principal office or place of business at 2250 N. University Parkway, Suite 4880, Provo, UT 84604.

VOLUME 139 Decision and Order 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondents, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply: 1. “Personally identifiable information” or “personal information” shall mean individually identifiable information from or about an individual including, but not limited to: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name that reveals an individual’s email address; (d) a telephone number; (e) a Social Security number; (f) a persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual; or (g) any information that is combined with any of (a) through (f) above. 2. Unless otherwise specified, “Respondent” shall mean Vision One and its successors and assigns and its officers, and its agents, representatives, and employees. 3. “Merchant customer” shall mean a person or entity that uses Respondent’s shopping cart software and related services in connection with the sale of products and services on a Web site.

4. “Clearly and conspicuously” shall mean as follows: A. In print communications, the message shall be in a type size and location sufficiently noticeable for an ordinary consumer to read and comprehend it, in print that contrasts with the background against which it appears. VISION I PROPERTIES, LLC, ET AL. 303 Decision and Order B. In communications disseminated orally, the message shall be delivered in a volume and cadence sufficient for an ordinary consumer to hear and comprehend it. C. In communications made through an electronic medium (such as television, video, radio, and interactive media such as the Internet, online services and software), the message shall be presented simultaneously in both the audio and visual portions of the communication. In any communication presented solely through visual or audio means, the message may be made through the same means in which the communication is presented. Any audio message shall be delivered in a volume and cadence sufficient for an ordinary consumer to hear and comprehend it. Any visual message shall be of a size and shade, with a degree of contrast to the background against which it appears, and shall appear on the screen for a duration and in a location, sufficiently noticeable for an ordinary consumer to read and comprehend it. The message shall be in understandable language and syntax. Nothing contrary to, inconsistent with, or in mitigation of the message shall be used in any communication. 5. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

I.

IT IS ORDERED that Respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the collection of personally identifiable information from or about consumers, shall not make, expressly or by implication, any false or misleading representation regarding the collection, use, or disclosure of personally identifiable information. VOLUME 139 Decision and Order II.

IT IS FURTHER ORDERED that Respondent, directly or through any corporation, subsidiary, division, or other device, shall not sell, rent, or disclose to any third party for marketing purposes any personally identifiable information that was collected from consumers through shopping cart software used at a merchant customer’s Web site prior to the date of service of this Order.

III.

IT IS FURTHER ORDERED that Respondent, directly or through any corporation, subsidiary, division, or other device, shall not sell, rent, or disclose to any third party for marketing purposes any personally identifiable information collected from consumers through shopping cart or other software used at a merchant customer’s Web site after the date of service of this Order unless, prior to the date such information was collected, Respondent took one of the following two actions: A. Provided to the merchant customer a clear and conspicuous written notice of its information practices and obtained from the merchant customer a written certification stating:

(1) that the merchant customer received such notice; and (2) either (a) that its posted privacy policy states that consumers’ information may be sold, rented, or disclosed to third parties, or (b) that it provides a clear and conspicuous disclosure, before any personally identifiable information is collected from consumers through Respondent’s shopping cart or other software, stating that the consumer is leaving the merchant customer’s Web site and entering Respondent’s Web site, and that Respondent’s site is governed by Respondent’s own privacy policy. VISION I PROPERTIES, LLC, ET AL. 305 Decision and Order The written notice to merchants required by this Paragraph shall be labeled "Important Notice to Merchants from CartManager" and must: (1) state that Respondent intends to sell, rent, or disclose such information; (2) identify the types or categories of any entities to which such information will be disclosed; (3) advise the merchant customer that it may be liable for any misrepresentations it makes about the use or disclosure of information collected from consumers at its Web site, including through software used at the site; and (4) contain no other information;

OR B. Provided a clear and conspicuous disclosure on the page(s) through which it collected such information stating: (1) that the consumer is on Respondent’s Web site, and (2) that information provided by the consumer to Respondent will be used, sold, rented, or disclosed to third parties for marketing purposes.

IV.

IT IS FURTHER ORDERED that within five (5) days of the date of service of this Order, Respondent shall pay $9,101.63 to the United States Treasury as disgorgement. Such payment shall be by cashier’s check or certified check made payable to the Treasurer of the United States. In the event of any default in payment, which default continues for more than ten (10) days beyond the due date of payment, Respondent shall also pay interest as computed under 28 U.S.C. § 1961, which shall accrue on the unpaid balance from the date of default until the date the balance is fully paid.

V.

IT IS FURTHER ORDERED that Respondent Vision One and its successors and assigns shall, for a period of five (5) years after the last date of dissemination of any representation covered by this VOLUME 139 Decision and Order Order, maintain and upon request make available to the Federal Trade Commission for inspection and copying a print or electronic copy of all documents demonstrating their compliance with the terms and provisions of this Order, including, but not limited to: A. A sample copy of each different privacy statement or communication relating to the collection of personally identifiable information containing representations about how personally identifiable information will be used and/or disclosed. Each Web page copy shall be dated and contain the full URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting the information on the Web; provided, however, that after creation of any Web page or screen in compliance with this Order, Respondent shall not be required to retain a print or electronic copy of any amended Web page or screen to the extent that the amendment does not affect Respondent’s compliance obligations under this Order;

B. A sample copy of each different document containing the disclosures required by Part III.A. of this Order; a list of all merchant customers who received each different document containing such disclosures; all communications by merchant customers in response to such disclosures, including all written certifications received pursuant to Part III.A. and any complaints received from merchant customers; and a sample copy of each different document containing the disclosures required by Part III.B.; and C. All invoices, communications, and records relating to the disclosure to third parties of personally identifiable information collected through merchant customer Web sites.

VISION I PROPERTIES, LLC, ET AL. 307 Decision and Order VI.

IT IS FURTHER ORDERED that Respondent Vision One and its successors and assigns shall deliver a copy of this Order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities with respect to the subject matter of this Order, and shall secure from each such person a signed and dated statement acknowledging receipt of the Order. Respondent shall deliver this Order to such current personnel within thirty (30) days after the date of service of this Order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. VII.

IT IS FURTHER ORDERED that Respondent Vision One and its successors and assigns shall notify the Commission at least thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations arising under this Order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which Respondent learns less than thirty (30) days prior to the date such action is to take place, Respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VOLUME 139 Decision and Order VIII.

IT IS FURTHER ORDERED that Respondent Vision One and its successors and assigns shall, within sixty (60) days after service of this Order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this Order.

IX.

This Order will terminate on April 19, 2025, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part in this Order that terminates in less than twenty (20) years;

B. This Order’s application to any respondent that is not named as a defendant in such complaint; and C. This Order if such complaint is filed after the Order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent did not violate any provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Part as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. VISION I PROPERTIES, LLC, ET AL. 309 Analysis Analysis of Proposed Consent Order to Aid Public Comment The Federal Trade Commission has accepted an agreement, subject to final approval, to a proposed consent order from Vision I Properties, LLC, d/b/a CartManager International (“Vision One”). Vision One licenses shopping cart software and provides related services to thousands of small online retail merchants through its Web site, www.cartmanager.com. The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received and will decide whether it should withdraw from the agreement and take other appropriate action or make final the agreement’s proposed order.

This matter concerns Vision One’s collection and rental of personal information obtained from consumers making purchases from online merchants that used Vision One’s software. Vision One provides shopping cart software and services to thousands of small online retail merchants. The shopping cart software generates customizable “shopping cart” and “check out” Web pages that enable the merchant to process consumer purchases. A consumer uses these pages to select items for purchase. These pages then collect the consumer’s payment, shipping, and billing information.

The shopping cart and check out pages reside on Vision One’s Web site, enabling Vision One to collect consumers’ personal information through its software. The shopping cart and check out pages are designed to look like the other pages on the merchant’s site and typically display the merchant’s name and logo.

Many of the merchants using Vision One’s shopping cart software have posted privacy policies on their Web sites, which VOLUME 139 Analysis generally limit the disclosure of personal information collected from consumers. Many of these privacy policies have stated that the merchant’s practice is never to sell or rent personal information to third parties. Notwithstanding the promises made in these merchants’ privacy policies, Vision One rented the personal information (including name, address, telephone number, and purchase history) of nearly one million consumers it obtained through its software to third parties for marketing purposes. According to the complaint, Vision One failed to inform adequately these merchants or the consumers shopping at their sites that it intended to disclose this information. The Commission’s complaint charges that, by collecting consumers’ personal information at these merchant sites and renting it to third parties, knowing that such practices were contrary to these merchants’ privacy policies, Vision One engaged in unfair practices prohibited by Section 5 of the Federal Trade Commission Act.

The proposed consent order is designed to stop Vision One from violating Section 5 and to prevent Vision One from engaging in such violations in the future. Part I of the proposed consent order prohibits Vision One from making any misrepresentations regarding its collection, use, or disclosure of consumers’ personal information. Part II of the order prohibits Vision One from disclosing to any third party for marketing purposes any personal information it previously collected from consumers through its shopping cart software used at a merchant’s site. Part III of the proposed order addresses Vision One’s future collection of personal information. It prohibits Vision One from selling, renting, or disclosing to any third party for marketing purposes any personal information it collects from consumers through its shopping cart software, unless consumers are provided with notice. Vision One must disclose its information practices either to the merchants or directly to consumers prior to its collection of any personal information. If Vision One provides the notice directly to its merchants, it must obtain certifications from the merchants that they received the notice and have either VISION I PROPERTIES, LLC, ET AL. 311 Analysis (1) posted a privacy policy stating that consumers’ information may be sold, rented, or disclosed to third parties, or (2) posted a clear and conspicuous notice on their Web sites advising consumers that they are leaving the merchant’s site and entering Vision One’s site where a different privacy policy governs. If Vision One chooses to provide notice directly to consumers rather than to the merchants, it must clearly and conspicuously post the notice on the page(s) where it collects personal information. The notice must state that the consumer is on Vision One’s site and that personal information provided by the consumer will be used, sold, rented, or disclosed to third parties for marketing. Part IV of the proposed order requires Vision One to pay $9,101.63 to the United States Treasury as disgorgement of the fees it received from renting consumer information. The remainder of the proposed order contains standard requirements that Vision One: maintain copies of privacy statements and other documents relating to the collection, use, or disclosure of personally identifiable information, and all notices, certifications, and other documents relating to the disclosures required by Part III of the order; distribute copies of the order to certain company officials and employees; notify the Commission of any change in the corporation that may affect compliance obligations under the order; and file one or more reports detailing its compliance with the order. Part IX of the proposed order is a provision whereby the order, absent certain circumstances, terminates twenty years from the date of issuance. The purpose of this analysis is to facilitate public comment on the proposed order, and is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way its terms.

The proposed order, if issued in final form, will resolve the claims alleged in the complaint against the named respondent. It is not the Commission’s intent that acceptance of this consent agreement and issuance of a final decision and order will release VOLUME 139 Analysis any claims against any unnamed persons or entities associated with the conduct described in the complaint. HI-HEALTH SUPERMART CORPORATION, ET AL. 313 Complaint