FTC Settles With Online Advertising Network for Tracking Consumer Browser History

The FTC announced that it has settled claims against Epic Marketplace, Inc., an online advertising network, and its wholly owned subsidiary, Epic Media LLC (collectively, “Epic”) for tracking consumers’ browser history without their knowledge and without disclosing the practice in Epic’s privacy policy. According to the FTC’s complaint, Epic serves ads to approximately 45,000 websites and millions of users, In connection with serving online ads, Epic used a process called “history sniffing” -- through which it collected users’ browser history to determine which websites they had visited.  This practice allegedly allowed Epic to infer certain information, including sensitive information such as financial and medical related data, which was used to target advertisements.

The FTC alleged that Epic’s privacy policy informed users that it only tracked visits made to web sites in its network, but instead Epic tracked consumers’ visits to other web sites through its use of history sniffing.  It is interesting to note that the FTC’s complaint alleges that Epic’s disclosures regarding the information collected give an impression, either explicitly or by implication, that the collection was limited to sites within Epic’s network.  In addition, the FTC charged in its complaint that failure to disclose the history sniffing practices was, in and of itself, deceptive because it is a material fact that may influence a consumer’s decision whether or not to take advantage of Epic’s opt-out mechanism.

In the consent order the FTC requires Epic to: (1) change its privacy policy to reflect its actual data use and collection practices; (2) immediately cease using “history sniffing” as a way to collect information about users; (3) permanently delete and destroy all user data collected through “history sniffing”; and (4) record all consumer complaints and any other documentation relating to Epic’s data use and collection practices for a period of 3 years.

This action is one more example of the FTC’s interest in online behavioral tracking and advertising, as well as a reminder that all organizations should ensure their privacy policies are fully accurate and include all material disclosures.  Failure to disclose a key material fact can create liability equal to providing inaccurate disclosures to consumers.