## Facts

- Sears Holdings Management Corporation operated sears.com and kmart.com and ran an online program called “My SHC Community” from about April 2007 to January 2008.
- Some website visitors were invited to join and were offered $10 if they kept installed “research software” running for at least one month.
- The invitation and initial communications emphasized participation in an online community and did not clearly highlight that enrollment required installation of software that broadly monitored computer internet activity.
- Enrollment required assent to a Privacy Statement and User License Agreement presented in a small scroll box; fuller disclosure of the monitoring appeared only deep in the text.
- After installation, the software ran in the background and transmitted to Sears information reflecting nearly all internet activity on the computer, including activity during secure sessions and potentially sensitive financial or health-related information.
- The FTC investigated and issued a draft administrative complaint alleging deceptive acts or practices under § 5(a) of the FTC Act; the matter was resolved by a negotiated consent order without an admission of liability.

## Issues

1. Whether deploying software that monitors and transmits nearly all internet activity, including secure-session and sensitive data, is a deceptive practice under § 5 of the FTC Act when material details are not disclosed clearly and prominently before installation.
2. Whether burying key privacy disclosures within lengthy license terms can render the overall net impression misleading to reasonable consumers.

## Decision

- The FTC accepted an agreement containing a consent order and issued a final decision and order on September 9, 2009, ending the administrative proceeding.
- Sears agreed, for settlement purposes and without admitting the substantive allegations, to be bound by injunctive and remedial provisions addressing notice, consent, and data handling.
- The order required clear and prominent disclosures before installing any application that monitors or transmits users’ online activity data, including disclosures about the scope and types of data collected and whether secure sessions are affected.
- The order required affirmative express consent after such disclosures and before installation.
- The order required destruction of information previously collected through the My SHC Community software and imposed compliance reporting and recordkeeping obligations.
- Sears waived further procedural steps and the right to judicial review of the order.

## Legal Principles

- Under § 5 of the FTC Act, a practice may be deceptive when the overall net impression of representations and omissions is likely to mislead reasonable consumers about material facts.
- Disclosures of material data-collection practices must be clear and prominent; placement solely within dense or hard-to-notice license terms may be insufficient when the practice is extensive or sensitive.
- Where software collects broad browsing data and captures secure-session content, the breadth and sensitivity of collection are material to consumers’ installation decisions and must be disclosed before collection begins.
- Effective consent for invasive tracking requires affirmative express agreement obtained after meaningful disclosure, not consent inferred from inconspicuous or buried terms.

## Conclusion

The FTC resolved the matter through a consent order that treated Sears’s limited, non-prominent disclosure of expansive tracking software as deceptive under § 5, and required clear pre-installation notice, affirmative express consent, destruction of collected data, and ongoing compliance controls.


In re Sears Holdings Mgmt. Corp., 2009 WL 2979770 (F.T.C. 2009)