FTC Settles Claims Against Lead Generation Business for Allegedly Sharing and Selling Consumers’ Sensitive Data

The FTC settled charges against a lead generation business (“business”) who allegedly misled consumers into filling out loan applications, which included sensitive consumer information, and then sold the applications to anyone willing to pay for the lead, regardless of the benefit or harm to consumers.

The FTC’s complaint alleged that the business opened at least 38 internet domains, through which it solicited consumers to apply for a variety a loans, including payday, personal and installment, and auto loans.  The websites warranted to consumers that the information collected would be used to get loans with the lowest interest rate and most favorable terms, among other things.  Despite this representation, the business was allegedly selling exclusive rights to the loan applications to any buyers willing to purchase them without regard to the cost, quality, or terms that the buyer would offer to consumers.  In some situations, the business allegedly sold application information to buyers that were not loan providers.

The FTC further alleged that the business claimed to impose restrictions or conditions to protect against the unauthorized access, use, modification, destruction, or disclosure of consumers’ sensitive personal and financial information such as social security and bank account numbers, but the financial information was actually shared and sold indiscriminately without consumers’ knowledge or consent, and without regard for how the information would be used.

The settlement includes a judgment for more than $104 million, which represents the revenue the business received from selling consumers’ loan applications as leads.  The judgment also prohibits the business from misrepresenting that it can assist in providing loans on favorable rates and terms, that it will protect and secure personal information collected from consumers, and from misrepresenting the types of businesses with which it shares consumers’ personal information.  Moving forward, the business is also required to investigate and verify the identity of businesses to which it discloses consumers’ sensitive information, and obtain consumers’ express, informed consent for such disclosure.

For more information, the settlement can be found here: https://www.ftc.gov/system/files/documents/cases/ftc_v_blue_global_de04_1.pdf.