Antitrust Law Daily Wrap Up, PRIVACY NEWS: Rent-to-own franchisor agrees to settle FTC charges over franchisees’ use of software that monitored consumers, (Oct 22, 2013)

By Tobias J. Gillett, J.D., LL.M.

Rent-to-own retailer Aaron’s, Inc. has agreed to settle FTC charges that it allowed its franchisees to access and use software the franchisees installed on their rental computers that secretly monitored customers (In the Matter of Aaron’s, Inc., FTC File No. 1323156).

According to the FTC’s complaint, filed in an administrative action against the company, from at least 2009 until January 2012 some of Aaron’s franchisees licensed a software product called PC Rental Agent from DesignerWare, LLC, and installed it on computers rented to customers. The software would allow the franchisees to remotely disable a computer, or to activate an add-on program called Detective Mode. Detective Mode would allow the franchisees to monitor the customers by logging keystrokes, capturing screenshots, using the computer’s webcam, and gathering personal information using fake software registration windows. A different PC Rental Agent feature also permitted the franchisees to track the physical location of rented computers using WiFi hotspot location information. The franchisees used this data to assist in collecting past-due payments and recovering computers after default.

However, the data gathered by franchisees also revealed private, confidential, and personal details about the customers, including usernames and passwords for access to email accounts, social media websites, and financial institutions; medical information; applications containing Social Security numbers; and bank and credit card statements. The webcams took photographs of computer users and anyone else within view of the camera, including minor children and individuals not fully clothed and engaged in intimate conduct. The presence of the software was not detectable by computer users and could not be uninstalled by them. The franchisees often did not obtain consent from the customers and did not disclose to them or the rental computers’ users that PC Rental Agent was installed or could be used to track their activities and physical locations.

Aaron’s agreements with its franchisees required them to have e-mail addresses supplied by Aaron’s that used space on Aaron’s servers, and Aaron’s could terminate the franchisees for practices that breached federal or state law, or Aaron’s computer and Internet use polices. Senior management at Aaron’s approved franchisees’ requests to access the DesignerWare website through Aaron’s network, and Aaron’s provided technical advice for installing and using the PC Rental Agent software. Aaron’s stored e-mails containing information from Detective Mode since at least 2009, despite knowing the personal and confidential information that they contained. Aaron’s also knew from its representatives responsible for overseeing the franchisees that the franchisees were installing the software without notice to consumers, and that the software had privacy-invasive features, including the ability to view consumers through webcams. Despite knowing of the features from these sources, as well as its management’s analysis of the software and a lawsuit against the company, Aaron’s did not halt its franchisees’ use of the software until January 2012.

The FTC alleged that Aaron’s conduct violated Section 5 of the FTC Act. In April 2013, the FTC approved nine final orders settling its charges against seven rent-to-own stores, DesignerWare, and two of DesignerWare’s principals.

Under the terms of the proposed settlement agreement and consent order, Aaron’s would be prohibited from (1) “[u]sing any monitoring technology to gather data or information from or about a consumer from any computer rented to a consumer” and (2) “[r]eceiving, storing, or communicating any data or information from or about a consumer that was gathered from a computer rented to a consumer using any monitoring technology,” except in connection with a request from a customer for technical assistance.

In addition, Aaron’s must provide clear, express notice of its use of geophysical location tracking technology to customers, and must obtain their affirmative consent before using it. For computer rentals, the notice would have to be given both at the time of rental and at the time the tracking technology was activated, unless the customer reported the computer as lost or stolen. Aaron’s would also be prohibited from deceptively gathering customer information through software, from misrepresenting the amount to which it protects its customers’ privacy, and from using any improperly gathered data in connection with its collection efforts. Aaron’s must also delete or destroy any information it has improperly collected and transmit in an encrypted for many location or tracking data it collects properly. Aaron’s would also be required to conduct annual monitoring and oversight of its franchisees and to hold them to the requirements in the agreement that apply to Aaron’s and its corporate stores, and to terminate the franchise agreements of franchises that do not meet those requirements.

The FTC will accept public comments on the proposed consent agreement package until November 21, after which the Commission will decide whether to make the order final. Comments can be sent to: Federal Trade Commission, Office of the Secretary, Room H-113 (Annex D), 600 Pennsylvania Avenue, N.E., Washington, D.C. 20580, or submitted online here.

Companies: Aaron’s, Inc.

News: Privacy ConsumerProtection FranchisingDistribution FederalTradeCommissionNews