The Federal Trade Commission's proposed settlement with the online advertiser ScanScout, announced recently, offers a timely reminder of the importance of ensuring that your company's stated privacy practices align with how your company actually collects and uses information.
ScanScout is a video advertising network that places advertisements on websites and, in the process, tracks online browsing behavior via cookies. This tracking enables ScanScout to serve advertisements that correspond to users' interests. According to the FTC complaint, ScanScout's website privacy policy included some disclosure about the use of cookies to track users' behavior. Notably, for several years, ScanScout's privacy policy stated: "You can opt out of receiving a cookie by changing your browser settings to prevent the receipt of cookies."
The problem, according to the FTC, is that during the period this disclosure was provided in ScanScout's privacy policy, ScanScout actually used Flash local shared objects (a/k/a "Flash Cookies") to track user behavior, and changing browser settings did not remove or block the Flash cookies used by ScanScout. As a result, even if people followed the information provided in ScanScout's privacy policy, and changed their browsers' privacy settings to delete or block cookies, ScanScout's Flash cookies were unaffected, and ScanScout could still collect browsing data and serve targeted ads.
Under the terms of the proposed settlement, ScanScout is (i) barred from making further misrepresentations about its information practices and (ii) required to take steps to improve disclosure of its data collection practices and to provide a user-friendly mechanism to allow consumers to opt-out of being tracked.
If your business has an online presence, it is advisable to periodically revisit your published privacy statements to ensure that they remain accurate and up-to-date, including disclosures regarding Flash Cookies.
This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.