WASHINGTON (AP) -- The Federal Trade Commission said Monday that it has agreed to settle with a web analytics company that it claims illegally collected personal information — including credit card and social security numbers — without informing consumers.
The FTC also claims that Compete Inc. failed to keep promises it made to protect the data it collected.
Compete uses tracking software to collect data on the web browsing habits of millions of consumers, then uses it to generate reports, which it sells to clients who want to boost their website traffic, the FTC said.
Under the proposed settlement, Compete will be required to obtain the consent of consumers before collecting any data. It also will have to delete or make anonymous the data it already has collected and show consumers how to uninstall its software from their computers. In addition, the company must put in place an information security program with outside audits every two years for 20 years, the FTC said.
Compete released a statement saying that it's committed to preserving consumer privacy. It added that when it learned of the potential security issues it immediately disabled data collection from the affected versions of its software. It also deleted information that may have been inadvertently collected and put in place new data filters and security measures.
The FTC said Compete got consumers to download its tracking software in a variety of ways, including through advertisements that offered them rewards to join consumer input panels and through the download of a web toolbar that offered instant access to information about the websites they visited.
The FTC said that once installed, the software automatically collected information that consumers entered into websites, including usernames and passwords, credit card and financial account information, security codes and expiration dates, and Social Security numbers.
The FTC claims that Compete didn't tell consumers that it would collect that kind of information and falsely promised that any information collected would be stripped of consumers' identities. In addition, it failed to provide reasonable data security, the FTC said.
The FTC voted 4-0, with one commissioner abstaining, to accept the proposed consent order in the case for public comment. The order will be subject to public comment through Nov. 19, at which time the commission will decide whether to make the agreement final, the FTC said.