Online Advertiser Settles CAN-SPAM Charges for $2.9 Million
Company, subsidiaries accused of not protecting customers' account information.
By: Justin Bourne
Posted: 03/19/2008
WASHINGTON - Under
a settlement reached Wednesday with the Federal Trade Commission, online advertiser
ValueClick and its subsidiary Hi-Speed Media will pay $2.9 million in civil
penalties for violations of the CAN-SPAM Act.
The settlement, which the FTC said is the largest related to
the CAN-SPAM Act, bars the companies from future violations.
The companies were charged with failing to safeguard
customers' account information.
ValueClick, High-Speed Media and another subsidiary,
E-Babylon, assured customers that their information would be encrypted in all
transactions. The FTC said the companies either didn't make an effort to
encrypt the information entirely or chose to use substandard and insecure encryption
forms.
"The agency also charged that several of the companies'
e-commerce websites were vulnerable to SQL injection, a commonly known form of
hacker attack, contrary to claims that the companies implemented reasonable
security measure," the FTC said.
The FTC said the companies also used several dishonest
banner ads, pop-ups and emails that promised free gifts such as iPods, gift
cards, Sony PlayStation 3 consoles, laptop computers and plasma TVs. After clicking
through, users were prompted to sign up for third-party offers to receive their
gifts. By not informing users that signing up for the offers would cost them
money, the FTC said, ValueClick violated the CAN-SPAM Act and the FTC Act.
The FTC has ordered the companies to use a "comprehensive security program"
with third-party evaluations until 2028 and stop misleading users about their
use of encryption security measures.
The companies also must provide users a full list of requirements, pointing
out that free gifts require expenditures on their part.
The FTC said the case is the 18th in which it has challenged a company's
data security practices and the third case that targeted the use of deceptive
promises since the CAN-SPAM Act was introduced in 2003.
