Sears Holdings Management Corporation

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF SEARS HOLDINGS MANAGEMENT CORPORATION CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4264; File No. 082 3099 Complaint, August 31, 2009 - Decision, August 31, 2009 This consent order addresses Sears Holdings Management Corporation’s (“respondent”) advertising and dissemination from April 2007 through January 2008 of a software application that tracked nearly all of the Internet activities that took place on the computers of consumers who installed it. According to the complaint, respondent represented, in the process of soliciting consumers to download and install the application, that it would track consumers' “online browsing.” The complaint alleges that this claim is deceptive because respondent failed to disclose adequately that the application would monitor nearly all of the Internet behavior that occurs on consumers' computers and tracked certain non-Internet-related activities taking place on those computers. The order prevents respondent from engaging in similar acts and practices in the future and sets out the definition of a “Tracking Application”. In advertising or disseminating any Tracking Application the respondent must obtain express consent from consumers prior to downloading or installing a Tracking Application.

Participants For the Commission: David K. Koehler and Carl H. Settlemyer, III.

For the Respondents: Charulata Pagar, Virtual Law Partners, LLP.

COMPLAINT The Federal Trade Commission, having reason to believe that Sears Holdings Management Corporation, a corporation, has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Sears Holdings Management Corporation (“respondent” or “SHMC”) is a Delaware corporation with its VOLUME 148 Complaint principal office or place of business at 3333 Beverly Road, Hoffman Estates, Illinois 60179. SHMC, a subsidiary of Sears Holdings Corporation (“SHC”) with shares owned by Sears, Roebuck and Co. and Kmart Management Corporation, handles marketing operations for the Sears Roebuck and Kmart retail stores, and operates the sears.com and kmart.com retail Internet websites.

2. The acts and practices of respondent, as alleged herein, have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. 3. From on or about April 2007 through on or about January 2008, SHMC disseminated or caused to be disseminated via the Internet a software application for consumers to download and install onto their computers (the “Application”). The Application was created, developed, and managed for respondent by a third party in connection with SHMC’s “My SHC Community” market research program.

4. The Application, when installed, runs in the background at all times on consumers’ computers and transmits tracked information, including nearly all of the Internet behavior that occurs on those computers, to servers maintained on behalf of respondent. Information collected and transmitted includes: web browsing, filling shopping baskets, transacting business during secure sessions, completing online application forms, checking online accounts, and, through select header information, use of web-based email and instant messaging services. 5. SHMC, during the relevant time period, presented fifteen out of every hundred visitors to the sears.com and kmart.com websites with a “My SHC Community” pop-up box (Exhibit A) that said:

Ever wish you could talk directly to a retailer? Tell them about the products, services and offers that would really be right for you? If you’re interested in becoming part of something new, something different, we’d like to invite you to become a member of My SHC Community. My SHC Community, SEARS HOLDINGS MANAGEMENT CORPORATION 85 Complaint sponsored by Sears Holdings Corporation, is a dynamic and highly interactive on-line community. It’s a place where your voice is heard and your opinion matters, and what you want and need counts! The pop-up box made no mention of the Application. Likewise, the general “Privacy Policy” statement accessed via the hyperlink in the pop-up box did not mention the Application. 6. The pop-up box message further invited consumers to enter their email address to receive a follow-up email from SHMC with more information. Subsequently, invitation messages (Exhibit B) were emailed to those consumers who supplied their email address. These emails stated, in pertinent part: From shopping, current events, social networking, to entertainment and email, it seems that the Internet is playing a bigger and bigger role in our daily lives these days.

If you’re interested in becoming part of something new, something different, we’d like to invite you to join a new and exciting online community; My SHC Community, sponsored by Sears Holdings Corporation. Membership is absolutely free! My SHC Community is a dynamic and highly interactive online community. It’s a place where your voice is heard and your opinion matters, and what you want and need counts! As a member of My SHC Community, you’ll partner directly with the retail industry. You’ll participate in exciting, engaging and on-going interactions – always on your terms and always by your choice. My SHC Community gives you the chance to help shape the future by sharing and receiving information about the products, services and offers that would really be right for you. To become a member of My SHC Community, we simply ask you to complete the registration process which includes providing us with your contact information as well as answering a series of profile questions that will help us get to know you better. You’ll also be asked to VOLUME 148 Complaint take a few minutes to download software that is powered by (VoiceFive). This research software will confidentially track your online browsing. This will help us better understand you and your needs, enabling us to create more relevant future offerings for you, other community members, and eventually all shoppers. You can uninstall the software at any time through the Add/Remove program utility on your computer. During the registration process, you’ll learn more about this application software and you’ll always have the opportunity to ask any and every question you may have.

Once you’re a member of My SHC Community, you’ll regularly interact with My SHC Community members as well as employees of Sears Holdings Corporation through special online engagements, surveys, chats and other fun and informative online techniques. We’ll ask you to journal your shopping and purchasing behavior. Again, this will be when you want and how you want to record it – always on your terms and always by your choice. We’ll also collect information on your internet usage. Community engagements are always fun and always voluntary! The email invitation message then described what consumers would receive in exchange for becoming a member of the My SHC Community, including a $10 payment for joining the “online community,” contingent upon the consumer retaining the Application on his or her computer for at least one month. Consumers who wished to proceed further would need to click a button, at the bottom, center portion of the invitation email, that said “Join Today!”

7. Consumers who clicked on the “Join Today!” button in the email invitation were directed to a landing page (Exhibit C) that restated many of the aforementioned representations about the potential interactions between members and the “community” and about the putative benefits of membership. The landing page did not mention the Application.

8. Consumers who clicked on the “Join Today” button in the landing page were directed to a registration page (Exhibit D). To SEARS HOLDINGS MANAGEMENT CORPORATION 87 Complaint complete registration, consumers needed to enter information, including their name, address, age, and email address. Below the fields for entering information, the registration page presented a “Privacy Statement and User License Agreement” (“PSULA”) in a “scroll box” that displayed ten lines of the multi-page document at a time (“Printable version” attached as Exhibit E). A description of the Application’s specific functions begins on approximately the 75th line down in the scroll box: Computer hardware, software, and other configuration information: Our application may collect certain basic hardware, software, computer configuration and application usage information about the computer on which you install our application, including such data as the speed of the computer processor, its memory capacities and Internet connection speed. In addition, our application may report on devices connected to your computer, such as the type of printer or router you may be using. Internet usage information: Once you install our application, it monitors all of the Internet behavior that occurs on the computer on which you install the application, including both your normal web browsing and the activity that you undertake during secure sessions, such as filling a shopping basket, completing an application form or checking your online accounts, which may include personal financial or health information. We may use the information that we monitor, such as name and address, for the purpose of better understanding your household demographics; however we make commercially viable efforts to automatically filter confidential personally identifiable information such as UserID, password, credit card numbers, and account numbers. Inadvertently, we may collect such information about our panelists; and when this happens, we make commercially viable efforts to purge our database of such information. The software application also tracks the pace and style with which you enter information online (for example, whether you click on links, type in webpage names, or use shortcut keys), the usage of cookies, and statistics about your use of online applications (for example, it may VOLUME 148 Complaint observe that during a given period of use of a computer, the computer downloaded X number of bytes of data using a particular Internet enabled gaming application). Please note: Our application does not examine the text of your instant messages or e-mail messages. We may, however, review select e-mail header information from web-based e-mails as a way to verify your contact information and online usage information. The PSULA went on to describe how the information the Application would collect was transmitted to respondent’s servers, how it might be used, and how it was maintained. It also described how consumers could stop participating in the online community and remove the Application from their computers. Respondent stated in the PSULA that it reserved the right to continue to use information collected prior to a consumer’s “resignation.”

9. Below the scroll box on the registration page was a link that consumers could click to access a printable version of the PSULA, and a blank checkbox next to the statement: “I am the authorized user of this computer and I have read, agree to, and have obtained the agreement of all computer users to the terms and conditions of the Privacy Statement and User License Agreement.” To continue with the registration process, consumers needed to check the box and click the “Next” button at the bottom of the registration page.

10. Consumers who completed the required information, checked the box, and clicked the “Next” button on the registration page, were directed to an installation page (Exhibit F) that explained the Application download and installation process. Consumers were required to click a “Next” button to begin the download, and then click an “Install” or “Yes” button in a “security warning” dialog box to install the Application. Nothing on the installation page provided information on the Application. 11. When installed, the Application functioned and transmitted information substantially as described in the PSULA. The Application, when installed, would run in the background at all times on consumers’ computers. Although the Application SEARS HOLDINGS MANAGEMENT CORPORATION 89 Complaint would be listed (as “mySHC Community”) in the “All Programs” menu and “Add/Remove” utilities of those computers, and the Application’s executable file name (“srhc.exe”) would be listed as a running process in Windows Task Manager, the Application would display to users of those computers no visible indication, such as a desktop or system tray icon, that it was running. 12. The Application transmitted, in real time, tracked information to servers maintained on behalf of respondent. The tracked information included not only information about websites consumers visited and links that they clicked, but also the text of secure pages, such as online banking statements, video rental transactions, library borrowing histories, online drug prescription records, and select header fields that could show the sender, recipient, subject, and size of web-based email messages. 13. Through the means described in paragraphs 3-12, respondent has represented, expressly or by implication, that the Application would track consumers’ “online browsing.” Respondent failed to disclose adequately that the software application, when installed, would: monitor nearly all of the Internet behavior that occurs on consumers’ computers, including information exchanged between consumers and websites other than those owned, operated, or affiliated with respondent, information provided in secure sessions when interacting with third-party websites, shopping carts, and online accounts, and headers of web-based email; track certain non-Internet-related activities taking place on those computers; and transmit nearly all of the monitored information (excluding selected categories of filtered information) to respondent’s remote computer servers. These facts would be material to consumers in deciding to install the software. Respondent’s failure to disclose these facts, in light of the representations made, was, and is, a deceptive practice. 14. The acts and practices of respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this thirtyfirst day of August, 2009, has issued this complaint against respondent.

VOLUME 148 Complaint By the Commission.

EXHIBIT A Redacted as CONFIDENTIAL SEARS HOLDINGS MANAGEMENT CORPORATION 91 Complaint Exhibit B

SEARS HOLDINGS MANAGEMENT CORPORATION 93 Decision and Order Exhibits C, D, E, and F Redacted as CONFIDENTIAL DECISION AND ORDER The Federal Trade Commission (“Commission”) having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondent with violation of the Federal Trade Commission Act, 15 U.S.C § 45 et seq.; and The Respondent, its attorney, and counsel for the Commission having thereafter executed an agreement containing a consent order (“consent agreement”), an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of said consent agreement is for settlement purposes only and does not constitute an admission by the Respondent that the law has been violated as alleged in the complaint, or that the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it has reason to believe that the Respondent has violated the said Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such consent agreement on the public record for a period of thirty (30) days, and having duly considered the comments filed thereafter by interested persons pursuant to Section 2.34 of its Rules, now in VOLUME 148 Decision and Order further conformity with the procedure prescribed in Section 2.34 of its Rules, the Commission hereby issues its complaint, makes the following jurisdictional findings and enters the following order:

1. Respondent Sears Holdings Management Corporation is a Delaware corporation with its principal office or place of business at 3333 Beverly Road, Hoffman Estates, Illinois 60179.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply:

A. Unless otherwise specified, “respondent” shall mean Sears Holdings Management Corporation, its successors and assigns, and its officers, agents, representatives, and employees.

B. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. C. “Computer” shall mean any desktop or laptop computer, handheld device, telephone, or other electronic product or device that has a platform on which to download, install, or run any software program, code, script, or other content and to play any digital audio, visual, or audiovisual content. D. “Tracking Application” shall mean any software program or application disseminated by or on behalf of respondent, its subsidiaries or affiliated companies, that is capable of being installed on consumers’ computers and used by or on behalf of respondent to SEARS HOLDINGS MANAGEMENT CORPORATION 95 Decision and Order monitor, record, or transmit information about activities occurring on computers on which it is installed, or about data that is stored on, created on, transmitted from, or transmitted to the computers on which it is installed.

E. “Affected Consumers” shall mean persons who, prior to the date of issuance of this order, downloaded and installed a Tracking Application on a computer in connection with the My SHC Community program or “on-line community.”

F. “Collected Information” shall mean any information or data transmitted from a computer by a Tracking Application, installed prior to the date of issuance of this order, to any computer server owned by, operated by, or operated for the benefit of, Sears Holdings Management Corporation, its subsidiaries, or affiliated companies.

G. “Clearly and prominently” shall mean: 1. In textual communications (e.g., printed publications or words displayed on the screen of a computer), the required disclosures are of a type, size, and location sufficiently noticeable for an ordinary consumer to read and comprehend them, in print that contrasts with the background on which they appear;

2. In communications disseminated orally or through audible means (e.g., radio or streaming audio), the required disclosures are delivered in a volume and cadence sufficient for an ordinary consumer to hear and comprehend them;

3. In communications disseminated through video means (e.g., television or streaming video), the required disclosures are in writing in a form consistent with subparagraph (A) of this definition and shall appear on the screen for a duration sufficient for an ordinary consumer to read and VOLUME 148 Decision and Order comprehend them, and in the same language as the predominant language that is used in the communication;

4. In communications made through interactive media, such as the Internet, online services, and software, the required disclosures are unavoidable and presented in a form consistent with subparagraph (A) of this definition, in addition to any audio or video presentation of them; and 5. In all instances, the required disclosures are presented in an understandable language and syntax, and with nothing contrary to, inconsistent with, or in mitigation of the disclosures used in any communication of them.

I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the advertising, promotion, offering for sale, sale, or dissemination of any Tracking Application, in or affecting commerce, shall, prior to the consumer downloading or installing it:

A. Clearly and prominently, and prior to the display of, and on a separate screen from, any final “end user license agreement,” “privacy policy,” “terms of use” page, or similar document, disclose: (1) all the types of data that the Tracking Application will monitor, record, or transmit, including but not limited to whether the data may include information from the consumer’s interactions with a specific set of websites or from a broader range of Internet interaction, whether the data may include transactions or information exchanged between the consumer and third parties in secure sessions, interactions with shopping baskets, application forms, or online accounts, and whether the information may include personal financial or health information; (2) how the SEARS HOLDINGS MANAGEMENT CORPORATION 97 Decision and Order data may be used; and (3) whether the data may be used by a third party; and B. Obtain express consent from the consumer to the download or installation of the Tracking Application and the collection of data by having the consumer indicate assent to those processes by clicking on a button or link that is not pre-selected as the default option and that is clearly labeled or otherwise clearly represented to convey that it will initiate those processes, or by taking a substantially similar action. II.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, shall:

A. Within thirty (30) days after the date of service of this order, notify Affected Consumers that they have installed respondent’s Tracking Application on their computers, that the Tracking Application collects and transmits to respondent and others the data described in the My SHC Community “Privacy Statement & User License Agreement,” and notify them how to uninstall the Tracking Application. Notification shall be by the following means:

1. For two (2) years after the date of service of this order, posting of a clear and prominent notice on the www.myshccommunity.com website; and 2. For three (3) years after the date of service of this order, informing Affected Consumers who complain or inquire about any Tracking Application; and B. Provide prompt, toll-free, telephonic and electronic mail support to help Affected Consumers uninstall any Tracking Application.

VOLUME 148 Decision and Order III.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, shall:

A. Within three (3) days after the date of service of this order, cease collecting any data transmitted by any Tracking Application installed before the date of service of this Order; and B. Within five (5) days after the date of service of this order, destroy any Collected Information. IV.

IT IS FURTHER ORDERED that respondent, Sears Holdings Management Corporation, and its successors and assigns, shall maintain, and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of each document relating to compliance with the terms and provisions of this order, including but not limited to: A. For a period of four (4) years, any documents, whether prepared by or on behalf of respondent, that: 1. Comprise or relate to complaints or inquiries, whether received directly, indirectly, or through any third party, concerning a Tracking Application, and any responses to those complaints or inquiries; 2. Are reasonably necessary to demonstrate full compliance with each provision of this order, including but not limited to, all documents obtained, created, generated, or which in any way relate to the requirements, provisions, terms of this order, and all reports submitted to the Commission pursuant to this order; and 3. Contradict, qualify, or call into question respondent’s compliance with this order; and SEARS HOLDINGS MANAGEMENT CORPORATION 99 Decision and Order B. For a period of four (4) years after the last public dissemination thereof, all advertisements, terms of use, end-user license agreements, frequently asked questions, privacy policies, and similar documents relating to respondent’s dissemination of any Tracking Application.

V.

IT IS FURTHER ORDERED that respondent, Sears Holdings Management Corporation, and its successors and assigns, shall deliver a copy of this order to all current and future principals, officers, directors, managers, employees, agents, and representatives having responsibilities with respect to the subject matter of this order. Respondent, Sears Holdings Management Corporation, and its successors and assigns, shall deliver this order to current personnel within thirty (30) days after the date of service of the order, and to future personnel within thirty (30) days after the person assumes such position or responsibilities. VI.

IT IS FURTHER ORDERED that respondent, Sears Holdings Management Corporation, and its successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in the entity that may affect compliance obligations arising under this order, including but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor entity; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the entity name or address. Provided, however, that with respect to any proposed change in the entity about which respondent, Sears Holdings Management Corporation, and its successors and assigns, learns less than thirty (30) days prior to the date such action is to take place, respondent, Sears Holdings Management Corporation, and its successors and assigns, shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Ave., N.W., Washington, D.C. 20580. VOLUME 148 Decision and Order VII.

IT IS FURTHER ORDERED that respondent, Sears Holdings Management Corporation, and its successors and assigns, shall, within sixty (60) days after service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth the manner and form in which respondent has complied with this order.

VIII.

This order will terminate on August 31, 2029, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part of this order that terminates in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such a complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that this order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

SEARS HOLDINGS MANAGEMENT CORPORATION 101 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (“FTC” or “Commission”) has accepted, subject to final approval, an agreement containing a consent order from Sears Holdings Management Corporation (“Respondent”).

The proposed consent order (“proposed order”) has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order.

This matter involves the advertising and dissemination from April 2007 through January 2008 of a software application (the “Application”) that tracked nearly all of the Internet activities that took place on the computers of consumers who installed it as part of Respondent’s “My SHC Community” market research program. According to the FTC complaint, Respondent represented, in the process of soliciting consumers to download and install the Application, that the Application would track consumers’ “online browsing.” The complaint alleges that this claim is deceptive because Respondent failed to disclose adequately that the Application, when installed, would do much more. Only in a lengthy user license agreement did Respondent disclose that the Application would: monitor nearly all of the Internet behavior that occurs on consumers’ computers, including information exchanged between consumers and websites other than those owned, operated, or affiliated with Respondent, information provided in secure sessions when interacting with third-party websites, shopping carts, and online accounts, and headers of web-based email; track certain non-Internet-related activities taking place on those computers; and transmit nearly all of the monitored information (excluding selected categories of filtered information) to Respondent’s remote computer servers. The proposed order contains provisions designed to prevent Respondent from engaging in similar acts and practices in the VOLUME 148 Analysis to Aid Public Comment future. The proposed consent order defines a “Tracking Application” as “any software program or application . . . that is capable of being installed on consumers’ computers and used by or on behalf of respondent to monitor, record, or transmit information about activities occurring on computers on which it is installed, or about data that is stored on, created on, transmitted from, or transmitted to the computers on which it is installed.” Part I requires that Respondent, in advertising or disseminating any Tracking Application, disclose certain information clearly and prominently, prior to the downloading or installing of the application, and on a separate screen from any final “end user license agreement” or similar document. That information would include all the types of data that the Tracking Application will monitor, record, or transmit; how the data may be used; and whether the data may be used by a third party. In describing the types of data, Respondent would be required specifically to disclose: whether the data may include information from the consumer’s interactions with a specific set of websites or from a broader range of Internet interaction; whether the data may include transactions or information exchanged between the consumer and third parties in secure sessions, interactions with shopping baskets, application forms, or online accounts; and whether the information may include personal financial or health information. Respondent must also obtain express consent from consumers prior to downloading or installing a Tracking Application.

Part II of the proposed order requires Respondent to post a clear and prominent notice on the myshccommunity.com website advising consumers that the types of information the Application actually collected and transmitted to Sears and advising them how to uninstall the Application. It also requires Sears to provide prompt, toll-free, telephonic and email support to help affected consumers uninstall the Application.

Part III of the proposed order requires that Respondent, to the extent it has not already done so, cease collecting any data transmitted by any previously installed Tracking Application and to destroy any previously collected data. Parts IV through VII of the proposed order require Respondent: to keep copies of relevant consumer complaints and SEARS HOLDINGS MANAGEMENT CORPORATION 103 Analysis to Aid Public Comment inquiries, documents demonstrating order compliance, and advertisements and other documents relating to dissemination of any Tracking Application; to provide copies of the order to certain of their personnel; to notify the Commission of changes in corporate structure that might affect compliance obligations under the order; and to file compliance reports with the Commission. Part VIII provides that the order will terminate after twenty (20) years, with certain exceptions.

The purpose of this analysis is to facilitate public comment on the proposed order, and it is not intended to constitute an official interpretation of the agreement and proposed order or to modify in any way their terms.

VOLUME 148 Complaint