Unrollme Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF UNROLLME INC.

CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4692; File No. 172 3139 Complaint, December 16, 2019 Decision, December 16, 2019 This consent order addresses Unrollme Inc.' s email management service. The complaint alleges that when consumers initially declined to grant permission to their email account(s), Unrollme violated Section 5 of the FTC Act by making false and deceptive statements designed to encourage the consumer to change his or her mind and grant Unrollme access to his or her email account(s) and continue the sign-up process. The consent order prohibits misrepresentations about the extent to which Unrollme accesses, collects, uses, stores or shares covered information in connection with any product, service or software operated, owned or distributed by Unrollme that requires access to consumer emails.

Participants For the Commission: Linda Holleran Kopp and Amanda Koulousias. For the Respondents: Emilio W. Cividanes and Stuart P. Ingis, Venable LLP. COMPLAINT The Federal Trade Commission, having reason to believe that Unrollme Inc., a corporation, has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Unrollme Inc. ("Unrollme") is a Delaware corporation with its principal office or place of business at 222 Broadway, 19th Floor, New York, NY 10038. Unrollme is a wholly­ owned subsidiary of Slice Technologies, Inc. ("Slice"). 2. The acts and practices of Respondent alleged in this complaint have been in or affecting commerce, as "commerce" is defined in Section 4 of the Federal Trade Commission Act.

Unrollme's Business Practices 3. Unrollme provides two services to consumers to help them manage subscription emails, such as newsletters or marketing emails from retailers. First, Unrollme helps users unsubscribe from unwanted subscription emails, and second, Unrollme consolidates wanted subscription emails into one daily email called the "Rollup" that helps consumers minimize the clutter in their inboxes.

VOLUME 168 Complaint 4. Unrollme has offered its services to consumers through its website, https://unroll.me/, since at least June 2012. It has also offered its services through the Unrollme ios app since November 2015, and through the Unrollme Android app since October 2017. 5. During the sign-up process, Unrollme requires consumers to grant Unrollme full access to the email accounts that they wish to enroll in its services. This permission allows Unrollme to access and scan users' inboxes for subscription emails and to provide its services. 6. Unrollme then provides access to its users' email accounts to its parent company, Slice. Slice, a market research company, accesses Unrollme users' inboxes in order to collect information from the users' e-receipts, i.e., emailed receipts from businesses following an order or purchase.

7. Specifically, Slice uses an automated crawler to identify an Unrollme user's e ­ receipts. Once the e-receipt is identified, the crawler captures and copies the entire body of the message, which Slice then stores until the user deletes his or her Unrollme account. Slice does not remove any personal or sensitive information from the body of the e-receipt before it is stored. This personal information can include, among other things, the user's n ame, billing and shipping addresses, credit card information, and information about sensitive health-related products or services or other products and services purchased by the consumer. Slice then uses a "parser" to extract data from the e-receipts and creates a separate database of anonymous purchase information that it stores in its Data Warehouse for use in its market research analytics products.

8. Prior to May 2017, Unrollme did not state anywhere on its homepage, in its "frequently asked questions" we bpage, or on any screen displayed to consumers during the signup process (either via the unroll.me website or Unrollme's ios app) that Unrollme or its parent company, Slice, would collect, maintain, or sell information from users' e -receipts. 9. Unrollme's privacy policy has disclosed that it may collect, use, transfer, sell, and disclose "data from and about [users'] 'commercial electronic mail messages' and 'transactional or relationship messages' (as such terms are defined in the CAN-SPAM Act (15 U.S.C. 7702 et. seq.)." While consumers were generally required to click a box and agree to Unrollme's terms of service and privacy policy during the sign up process, they were not required to view the privacy policy. Some of those who did view the privacy policy reported that they found it confusing.

Unrollme's Deceptive Statements About Its Email Access 10. After learning that Unrollme requires access to their email account(s) during the sign-up process, some consumers declined to grant that permission. When that happened, Unrollme made false and deceptive statements designed to encourage the consumer to grant Unrollme access to his or her email account(s) and continue the sign-up process. These statements changed over time.

UNROLLME INC. 749 Complaint 11. From at least January 2015 through November 2015, Unrollme's message to consumers who declined to grant Unrollme access to their email stated, "It looks like you clicked No thanks. In order to use Unroll.me, you need to tell Google to allow us to monitor your emails. Don't worry, we won't touch your personal stuff. "

(Emphasis added). The user was presented with an option to "CLICK HERE TO CONTINUE," and if the user clicked that button, he or she was redirected back to the sign-up process and asked again to grant Unrollme access to his or her email account. 12. From November 2015 through October 26, 2016, Unrollme's message to consumers who declined to grant Unrollme access to their email stated, "Authorization Declined In order to use Unroll.me, you need to authorize us to access your emails. Don't worry, this is just to watch for those pesky newsletters, we'll never touch your personal stuff."

(Emphasis added). Beneath this statement was a button stating, "Retry." If the user clicked "Retry," the user was redirected back to the sign-up process and asked again to grant Unrollme access to his or her email account.

13. From October 27, 2016 through at least September 2018, Unrollme stated, "Oops! Looks like you declined access" "Unroll.Me requires access to your inbox so we can scan for subscriptions and allow you to begin clearing out your inbox." Beneath this text was a button stating, "Retry Signup," and beneath the "Retry Signup" button was the statement, "Unroll.Me takes your privacy & security seriously." If a user clicked "Retry Signup," the user was redirected back to the sign-up process and asked again to grant Unrollme access to his or her email account.

14. Unrollme's data collection practices with respect to its users' email accounts were material to consumers and their decision whether or not to use Unrollme's services. Over 20,000 consumers changed their minds and decided to complete the sign-up process after viewing the messages in Paragraphs 11 and 12 above, and over 35,000 consumers decided to complete the sign-up process after viewing the message in Paragraph 13 above. 15. In addition, some consumers who were worried about the privacy implications of granting Unrollme access to their email inbox contacted Unrollme's customer support. In multiple instances, Unrollme responded to these concerns, which included questions about the meaning of Unrollme's privacy policy, by representing to these consu mers that Unrollme would only access the consumer's email so that it could provide its subscription -related services even though Unrollme's parent company, Slice, was actually accessing and collecting the entire body of consumers' e-receipts for the purpose of selling purchase information contained therein. For VOLUME 168 Complaint example, consumers received the following responses, in relevant part, that Unrollme was only looking at users' subscription emails:

" we are not reading your personal emails or those that are sent to/by individuals. Our service only looks at the subscription emails that are associated with your account .... "

" ... Without being granted access into your account, there is no way for Unroll.Me to be able to rid your inbox of pesky emails you are looking to eliminate. With that being said, our algorithm only looks for subscription emails and does not touch your private emails "

" ... Your privacy is our utmost concern. Our algorithm accesses your inbox to scan for subscription emails only .... "

" ... Unroll.Me is not ab le to see emails that do not fit our algorithm's criteria, which scans for a subscription-based emails only. "

" ... It sounds like you're concerned about privacy --Well, rest assured! Unroll.Me holds our users' privacy to the highest regard. We are not able to see the content of your emails and the only emails we filter are subscription- based emails .... " Count I 16. As described in Paragraphs 11 and 12, Unrollme represented, directly or indirectly, expressly or by implication, that it would not touch users' personal emails. 17. In fact, as set forth in Paragraphs 6­ 7, Unrollme grants access to its users' inboxes, including personal emails in the form of e-receipts, which is then used to collect and sell purchase information contained therein to third parties. Therefore, the representation set forth in Paragraph 16 is false or misleading.

18. The acts and practices of Respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a).

Count II 19. As described in Paragraph 13, Unrollme represented, directly or indirectly, expressly or by implicatio n, that Unrollme required access to users' inboxes in order to scan for subscription emails.

20. Unrollme failed to disclose, or failed to disclose adequately, that Unrollme also grants access to its users' inboxes, including personal emails in the form of e -receipts, which is then used to collect and sell purchase information contained therein to third parties. This fact would be material to consumers in their decision to use Unrollme's services. UNROLLME INC. 751 Decision and Order 21. Unrollme's failure to disclose or disclose adequately the material information described in Paragraph 20, in light of the representation set forth in Paragraph 19, is a deceptive act or practice.

22. The acts and practices of Respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this sixteenth day of December, 2019, has issued this Complaint against Respondent.

By the Commission. Commissioner Chopra abstaining.

DECISION The Federal Trade Commission ("Commission") initiated an investigation of certain acts and practices of the Respondent named in the caption. The Commission's Bureau of Consumer Protection ("BCP") prepared and furnished to Respondent a draft Complaint. BCP proposed to present the draft Complaint to the Commission for its consideration. If issued by the Commission, the draft Complaint would charge the Respondent with violations of the Federal Trade Commission Act.

Respondent and BCP thereafter executed an Agreement Containing Consent Order ("Consent Agreement"). The Consent Agreement includes: 1) statements by Respondent that it neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Decision and Order, and that only for purposes of this action, it admits the facts necessary to establish jurisdiction; and 2) waivers and other provisions as required by the Commission's Rules.

The Commission considered the matter and determined that it had reason to believe that Respondent has violated the Federal Trade Commission Act, and that a Complaint should issue stating its charges in that respect. The Commission accepted the executed Consent Agreement and placed it on the public record for a period of 30 days for the receipt and consideration of public comments. The Commission duly considered any comments received from interested persons pursuant to Section 2.34 of its Rules, 16 C.F.R. § 2.34. Now, in further conformity with the procedure prescribed in Rule 2.34, the Commission issues its Complaint, makes the following Findings, and issues the following Order:

VOLUME 168 Decision and Order Findings 1. The Respondent is Unrollme Inc., a Delaware corporation, with its principal office or place of business at 215 Park Avenue South, 3rd Floor, New York, New York 10038.

2. The Commission has jurisdiction over the subject matter of this proceeding and over Respondent, and the proceeding is in the public interest. ORDER Definitions For purposes of this Order, the following definitions apply: A. "Consumer Email" means any message to or from a consumer that is sent electronically via a network to a unique email address, and includes any subpart thereof and the content of the communication.

B. "Covered Consumer" means all consumers known to Respondent, as of the effective date of this Order, who enrolled in a Covered Product after initially declining to grant Respondent access to their email accounts. C. "Covered Product" means any product, service o r software operated, owned or distributed by Respondent that requires access to Consumer Emails. D. "Covered Information" means personally identifiable information from or about an individual consumer, including: (a) a first and last name; (b) a physical address or precise geolocation; (c) an email address or other online contact information, such as an instant messaging user identifier or an individual's screen name; (d) a telephone number; (e) a Social Security number; (f) a driver's license or other governm ent-issued identification number; (g) a financial institution account number; (h) credit or debit card number; or (i) a persistent identifier, such as a unique customer number held in a "cookie," a static Internet Protocol ("IP") address, a mobile device I D, or processor serial number.

E. "Inactive User" means a Covered Consumer who cannot access a Covered Product without first re-enrolling in the Covered Product and whose email accounts are not accessible to Respondent.

F. "Respondent" means Unrollme Inc., and its successors and assigns. UNROLLME INC. 753 Decision and Order Provisions I. Prohibition against Misrepresentations about Covered Information and Consumer Emails IT IS ORDERED that Respondent, and Respondent's officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any Covered Product must not misrepresent in any manner, expressly or by implication, the extent to which it accesses, collects, uses, stores, or shares Covered Information or Consumer Emails.

II. Required Notification About Respondent's Consumer Email Access IT IS FURTHER ORDERED that Respondent must directly notify all Covered Consumers, who are not Inactive Users, and from whom Respondent or its parent access or collect email purchase receipts for use in market research products of the fact that Respondent or its parent access or collect email purchase receipts for use in market research products that are sold to third parties. Notification must be made by an email, consisting solely of the information contained in Exhibit A, sent within ten (10) days of the entry of this Order, with the subject line "Update: How We Use and Share Your Information" and without any other materials accompanying the email.

III. Required Deletion of Data IT IS FURTHER ORDERED that Respondent, and its officers, agents, and employees who receive actual notice of this Order must, within ten (10) days from the date of entry of this Order, delete from Respondent and Respondent's parent's commercial production systems all stored email purchase receipts, and Covered Information or other content obtained from these receipts, that was collected from Covered Consumers who enrolled in a Covered Product prior to June 1, 2017, unless such consumer provides affirmative, express consent to such storage.

IV. Acknowledgments of the Order IT IS FURTHER ORDERED that Respondent obtain acknowledgments of the receipt of this Order:

A. Respondent, within 10 days after the effective date of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.

B. For 10 years after the issuance date of this Order, Respondent must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees having managerial responsibilities for conduct related to the subject matter of the Order, and all agents and representatives who VOLUME 168 Decision and Order participate in conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Report and Notices. Delivery must occur within 10 days after the effective date of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities. C. From each individual or entity to which Respondent delivered a copy of this Order, Respondent must obtain, within 30 days, a signed and dated acknowledgment of receipt of this Order.

V. Compliance Report and Notices IT IS FURTHER ORDERED that Respondent make timely submissions to the Commission:

A. One year after the issuance date of this Order, Respondent must submit a compliance report, sworn under penalty of perjury, in which Respondent must: (1) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission, may use to communicate with Respondent; (2) identify all of Respondent's businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (3) describe the activities of each business, including the goods and services offered; (4) describe in detail whether and how Respondent is in compliance with each Provision of this Order; and (5) provide a copy of each Acknowledgment of the Order obtained pursuant to this Order, unless previously submitted to the Commission. B. Respondent must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following: (1) any designated point of contact; or (2) the structure of Respondent or any entity that Respondent has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.

C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against Respondent within 14 days of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by con eluding: "I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: ______" and supplying the date, signatory's full name, title (if applicable), and signature.

UNROLLME INC. 755 Decision and Order E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to [email protected] or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: In re Unrollme Inc., 1723139. VI. Recordkeeping IT IS FURTHER ORDERED that Respondent must create certain records for 10 years after the issuance date of the Order, and retain each such record for 5 years, unless otherwise specified below. Specifically, Respondent must create and retain the following records: A. accounting records showing the revenues from all goods or services sold, the costs incurred in generating those revenues, and resulting net profit or loss;

B. personnel records showing, for each person providing services in relation to any aspect of the Order, whether as an employee or otherwis e, that person's: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;

C. copies or records of all consumer complaints, whether received directly or indirectly, such as through a third party, and any response; D. A copy of each unique screenshot, screencast or equivalent record of the (1) online and mobile user interface for the enrollment process of a Covered Product; and of (2) each part of Respondent's website that makes a representation subject to this Order, including screenshots, screencasts or equivalent records that show how the user navigated to access the statement or representation (e.g., a screenshot showing the link to the statement, and a screenshot of the statement itself);

E. all records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission. VII. Compliance Monitoring IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent's compliance with this Order:

A. Within 10 days of receipt of a written request from a representative of the Commission, Respondent must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury, and produce records for inspection and copying.

VOLUME 168 Decision and Order B. For matters concerning this Order, representatives of the Commission are authorized to communicate directly with Respondent. Respondent must permit representatives of the Commission to interview anyone affiliated with Respondent who has agreed to such an interview. The interviewee may have counsel present.

C. The Commission may use all other lawful means, including posing through its representatives as consumers, suppliers, or other individuals or entities, to Respondent or any individual or entity affiliated with Respondent, without the necessity of identification or prior notice. Nothing in this Order limits the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.

VIII. Order Effective Dates IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission's website (fie.gov) as a f inal order. This Order will terminate 20 years from the date of its issuance (which date may be stated at the end of this Order, near the Commission's seal), or 20 years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of:

A. Any Provision in this Order that terminates in less than 20 years; B. This Order's application to any Respondent that 1s not named as a defendant in such complaint; and C. This Order if such complaint is filed after the Order has terminated pursuant to this Provision.

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent did not violate any provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

UNROLLME INC. 757 Concurring Statement Exhibit A [To appear with the Unrollme logo] Dear [Customer]:

Below is an update on how we use and share your information. We collect information from transaction-related emails that you receive. These include: receipts for things you bought • receipts for things you sold • confirmation notifications for deliveries and returns • confirmation emails when you register or cancel your registration • summaries of your transactions • We remove your personal information from the transaction-related emails and use that information to develop market research reports. We share the reports with Fortune 500 companies, household name brands, investment companies and other businesses. These companies may use the reports to learn about customer trends in their industries or for other business purposes.

You can learn more about how we collect and use your information by reading our privacy policy. Please contact us at [email protected] if:

you have any questions or comments about this privacy policy • • you'd like us to update your information • you'd like us to update your preferences If you want to delete your Unroll.me account, see our FAQ for instructions. SEPARATE STATEMENT OF COMMISSIONER NOAH JOSHUA PHILLIPS I join my colleagues in supporting this settlement, but write separately to highlight the surrounding circumstances, which are relevant to the current privacy debate. VOLUME 168 Concurring Statement As the complaint alleges, Unroll.me offered a free service that helped consumers organize their email inboxes. It supported this free service by allowing its parent company to scan consumers' emails for purchase -related information, which the parent collected for the anonymized market research it sells. Until around September 2018, the complaint alleges that, in a number of instances, Unroll.me failed adequately to disclose these collection practices, which failure violated the law.

Unrelated to the allegations in the complaint, in late 2018, Google announced it would limit third-party apps (like Unroll.me) from using the information in Gmail accounts of consumers for purposes such as market research or advertising.1 Promoted as means to enhance consumer privacy, that decision may also limit consumer choice and competition. Many millions of consumers see value in Unroll.me's service, which helps them manage the barrage of daily emails crowding their inboxes. Unroll.me has since removed the allegedly deceptive statements and updated its disclosures consumers may now be better aware of the privacy trade-offs, and continue to use the service. For these consumers, granting access for the collection of purchase data may be a choice worth making. Google's new privacy restrictions threaten to take that option away from consumers. That may be good for privacy, but not for consumer choice.

While Google will retain control of and access to the valuable purchase and other information about consumers contained in their Gmail accounts, other market actors like Unroll.me and its parent, Rakuten Intelligence, a market research firm may no longer have access. Google's restrictions thus potentially "imperil the business models of some popular email extensions", 2 like Unroll.me. That may be good for privacy, but not for competition. I am not suggesting that Google sought to limit consumer choice or competition, or that it is violating the law. Consumers are focusing increasingly on privacy, and firms like Google may be responding to that demand. But this situation highlights an important aspect of the privacy debate, i.e., the impact that privacy-enhancing decisions may have on consumer choice and competition.

There is no right answer, and we as a society may very well choose limitations on consumer choice and competition to protect privacy. Privacy is important. Consumers and policymakers alike must recognize, however, that it comes with tradeoffs. And competition enforcers must be vigilant, recognizing the potential of privacy efforts negatively to impact competition.

1 Ben Smith, Project Strobe: Protecting your data, improving our third-party APIs, and sunsetting consumer Google+, GOOGLE SAFETY AND SECURITY (Oct. 8, 2018), https://www.blog.google/technology/safety­ security/project-strobe/.

2 Cat Zakrzewski, A small privacy change for Google leads to big disruptions for start-ups, WASHINGTON POST (Oct. 15, 2018), https://www.washingtonpost.com/technology/2018/10/15/small-privacy-change-google-leads-big­ disruptions-startups/.

UNROLLME INC. 759 Analysis to Aid Public Comment ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission ("Commission") has accepted, subject to final approval, an agreement containing a consent order from Unrollme Inc. ("Unrollme"). The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After 30 days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement's proposed order. This matter involves Unrollme's email management service, which Unrollme has offered to consumers since at least June 2012. Unrollme provides services to consumers to help them manage subscription emails, such as newsletters or marketing emails from retailers. During the sign-up process, Unrollme requires consumers to grant Unrollme full access to the email accounts that they wish to enroll in its services. This permission allows Unrollme to access and scan users' inboxes for subscription emails to provide its services. Unrollme also provides access to its users' email accounts to its parent company, Slice Technologies, Inc. ("Slice"). Slice, a market research company, acces ses Unrollme users' inboxes in order to collect information from the users' e-receipts, i.e., emailed receipts from businesses following an order or purchase. Slice retains this information, and creates a separate database of anonymous purchase information that it uses in its market research analytics products. After learning that Unrollme requires access to their email account(s) during the sign-up process, some consumers declined to grant that permission. The proposed complaint alleges that when consumers initially declined to grant permission to their email account(s), Unrollme violated Section 5 of the FTC Act by making false and deceptive statements designed to encourage the consumer to change his or her mind and grant Unrollme access to his or her email account(s) and continue the sign-up process.

Count I of the proposed complaint alleges that Unrollme represented, directly or indirectly, expressly or by implication, that it would not touch users' "personal emails." From at least January 2015 through November 2015, Unrollme's message to consumers who declined to grant Unrollme access to their email stated, "It looks like you clicked No thanks. In order to use Unroll.me, you need to tell [your email service provider] to allow us to monitor your emails. Don't worry, we won't touch your personal stuff. "(Emphasis added). From November 2015 through October 26, 2016, Unrollme's message to consumers who declined to grant Unrollme access to their email stated, "Authorization Declined In order to use Unroll.me, you need to authorize us to access your emails. Don't worry, this is just to watch for those pesky newsletters, we'll never touch your personal stuff." (Emphasis added). The proposed complaint alleges that these representations were false or misleading because Unrollme grants Slice access to its users' inboxes, including personal emails in the form of e -receipts, which is then used to collect and sell purchase information contained therein to third parties. Count II of the proposed complaint alleges that Unrollme represented, directly or indirectly, expressly or by implication, that Unrollme required access to users' inboxes in order VOLUME 168 Analysis to Aid Public Comment to scan for subscription emails. From October 27, 2016 through at least September 2018, Unrollme's message to consumers who declined to grant Unrollme access to their email has stated, "Oops! Looks like you declined access" "Unroll.Me requires access to you r inbox so we can scan for subscriptions and allow you to begin clearing out your inbox." The complaint alleges that Unrollme failed to disclose, or failed to disclose adequately, that Unrollme also grants Slice access to its users' inboxes, which Slice t hen used to collect and sell purchase information contained in users' personal emails in the form of e -receipts and that this fact would be material to consumers in their decision to use Unrollme's services. The proposed order contains injunctive provisions addressing the alleged deceptive conduct. Part I of the proposed order prohibits misrepresentations about the extent to which Unrollme accesses, collects, uses, stores or shares covered information in connection with any product, service or software operated, owned or distributed by Unrollme that requires access to consumer emails.

Part II of the proposed order requires Unrollme to send an email notification to all known current users who enrolled in Unrollme's services after viewing the challenged state ments that explains that Unrollme or its parent access or collect email purchase receipts for use in market research products that are sold to third parties. The required notification is contained in Exhibit A of the proposed order. Part III of the proposed order requires Unrollme to delete within 10 days of the entry of the Order all stored email purchase receipts, and all personally identifiable information obtained from those receipts, for all known users who enrolled m Unrollme's services after viewing the challenged statements.

Parts IV through VII of the proposed order are reporting and compliance provisions, which include recordkeeping requirements and provisions requiring Unrollme to provide information or documents necessary for the Commission to monitor compliance. Part VIII states that the proposed order will remain in effect for 20 years, with certain exceptions.

The purpose of this analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or proposed order, or to modify in any way the proposed order's terms.

KOGAN, ALEKSANDR 761 Complaint