Antitrust Law Daily Wrap Up, PRIVACY NEWS: Online advertiser settles New Jersey charges that it bypassed consumers’ web browser privacy settings, (Jul 26, 2013)

By Tobias J. Gillett, J.D., LL.M.

Digital media and online advertising company PulsePoint, Inc. has entered into a consent order with the New Jersey Division of Consumer Affairs to resolve the Division’s investigation into its alleged use of JavaScript code to circumvent the privacy settings of consumers’ web browsers without their knowledge or consent, the Division has announced.

According to the Division, the New York City-based company used JavaScript code to place cookies on Apple, Inc. Safari web browsers, even when consumers had set their privacy settings to block cookies from third-party advertisers. The code would tell the browser that a user had clicked on an ad when the consumer had not done so, causing the browser to treat the ad as if it was a website the user had visited, and to accept cookies from the ads. The advertising company failed to disclose this practice to consumers. New Jersey Acting Attorney General John J. Hoffman claimed the practice permitted PulsePoint to place as many as 215 million targeted ads on consumers’ web browsers between June 2009 and February 2012.

In the consent order, PulsePoint acknowledges that Context Web Inc., one of two companies that merged to form PulsePoint, began the practice in June 2009 prior to the merger, and PulsePoint continued it until February 2012, when the Wall Street Journal reported that independent researchers had determined that a number of companies had engaged in similar practices. Although PulsePoint acknowledged that such conduct occurred, the agreement notes that PulsePoint claimed its current directors and officers were unaware of it, and the agreement expressly denies any admission on PulsePoint’s part that its conduct was unfair or deceptive, or that it violated the New Jersey Consumer Fraud Act.

The agreement imposes a $1 million settlement payment on PulsePoint, divided into a $566,200 civil penalty, a $33,800 reimbursement for the state’s attorneys’ fees and investigative costs, a $150,000 payment to be used by the Attorney General for privacy protection programs, and $250,000 in in-kind advertising services that PulsePoint will provide to the Division.

The settlement terms also require PulsePoint to implement a privacy program and retain it for at least five years. The program must include the designation of employees responsible for the program; the preparation of an independent privacy assessment report; and the creation of “reasonable privacy controls and procedures in accordance with prevailing industry standards,” and regular monitoring of the effectiveness of those controls and procedures.

The privacy assessment report will be prepared within 180 days after the effective date, and every two years thereafter for five years. The report will identify privacy controls PulsePoint has implemented; explain how those controls adequately protect consumer information; “identify and require [PulsePoint] to implement methods to promote ‘just in time’ privacy disclosures”; identify standard types of consumer information collected by PulsePoint and measure their impacts on privacy; identify the monthly rate of consumers opting out of PulsePoint’s information collection; identify foreseeable risks that PulsePoint could collect, use , or disclose consumer information without authorization; and certify that PulsePoint’s privacy controls are operating with sufficient effectiveness to protect the privacy of consumer information.

In addition, PulsePoint must provide details on its website about the information it collects and how that information is used, including a list of standard types of consumer information it collects, a description of how each type of information is maintained and used and whether it is transferred to third parties, a description of what cookies are and how PulsePoint uses information derived from them, information about how consumers can manage PulsePoint’s cookies, and information about how consumers can control the information collected by PulsePoint.

Finally, PulsePoint must “maintain systems for two years configured to instruct Safari browsers to expire any cookie placed by [PulsePoint] through the effective date if those systems encounter such a cookie.”

"PulsePoint circumvented privacy settings designed to protect consumers," Acting Attorney General Hoffman said. "This settlement puts online advertisers on notice that they must respect consumers' privacy settings, or end up paying far more in penalties than any violations would generate in ad revenue."

"This action is part of the Division of Consumer Affairs' commitment to protect the privacy of consumers in an increasingly complex and sophisticated digital world," added Eric T. Kanefsky, Director of the Division of Consumer Affairs. "Online advertising is a multibillion-dollar business that is always seeking new and innovative ways to target consumers with ads that will entice them to visit retailers' sites and make purchases. We are here to remind advertisers and web developers that all advertising activities must respect the rights of consumers, and respect the law."

Companies: PulsePoint, Inc.

News: Advertising Privacy NewJerseyNews