FTC Consent Order Addresses Allegedly Deceptive Acts by Online Email Subscription Management Service

The FTC recently entered a Consent Order with a company that provides online email subscription management to consumers, including assistance with helping consumer users unsubscribe from unwanted emails, and managing and consolidating users’ subscriptions to emails they wished to receive.

The company neither admitted nor denied the allegations in an accompanying Complaint that it 1) misrepresented to consumers that it would not access their personal emails, and 2) engaged in a deceptive act or practice by failing to disclose to consumers that it accessed personal emails to collect and sell purchase information contained therein to third parties, both in violation of the FTC Act.

When consumers signed up for the company’s email monitoring service, they were required to grant the company access to email accounts to be scanned for both wanted and unwanted email subscriptions.  This permitted the company to freely scan users’ email inboxes.  Prior to May 2017, service subscribers were not informed that the parent company of the monitoring service was a marketing company that could collect, maintain, and sell information derived from scanning users’ email inboxes.  While a privacy policy accompanying the service sign-up process disclosed that data from and about users emails could be collected, used, transferred, sold, or disclosed, users were generally only required to click a box and agree to the company’s terms of service, and not specifically required to view the privacy policy in order to register.

The Complaint further alleges the company made false and deceptive statements during the registration process to reassure consumers who initially declined to proceed with signing up for the service that the company’s access to their personal email was for the limited purpose of monitoring their accounts for wanted or unwanted emails, and not for further marketing or other uses.

The Consent Order bars the company from misrepresenting its collection, use, storage and sharing of consumer information, and requires notification to affected consumers about how the company collects and shares information by accessing consumers’ personal emails.  The company is also required by the Order to delete previously collected and stored consumer information unless it obtains consumer permission to maintain it.