The Federal Trade Commission announced yesterday that it had settled its consumer protection case against Toysmart.com, a failed Web site that had tried to sell its customer records in bankruptcy after having promised never to share such data with third parties.
Under the agreement, the company will still be allowed to sell the customer lists, but only to a "qualified buyer"--a business in the family-oriented market that agrees to restrictions on how the data is used. The list cannot be sold as a single asset, the FTC said.
The commission also added a new charge to the complaint it initially filed against Toysmart, alleging that the Massachusetts-based company collected personal information from children without parental consent, in violation of the Children's Online Privacy Protection Act of 1998 (COPPA), which went into effect on April 21. It is the first COPPA charge filed by the FTC.
"Customer data collected under a privacy agreement should not be auctioned off to the highest bidder," said Jodie Bernstein, director of the FTC's Bureau of Consumer Protection, in a statement.
Toysmart was one of the better-known sites on the World Wide Web to buy "smart toys"; it specialized in educational and nonviolent playthings. The company's privacy statement pledged: "When you register with Toysmart.com, you can rest assured that your information will never be shared with a third party." But in June, after the company had suspended operations, Toysmart advertised the sale of assets including "databases" and "customer files."
The prospect of personal information on about 200,000 people--including the names and gift wish lists of children--raised alarms among regulators and privacy advocates. Attorneys general from 38 states filed court papers in Boston objecting to the sale, and Sens. Patrick J. Leahy (D-Vt.) and Robert G. Torricelli (D-N.J.) have introduced legislation to bar the sale of personal information by a failed company that would violate the site's privacy policies.
The settlement will now be submitted to the U.S. Bankruptcy Court for the District of Massachusetts in Boston, which has been accepting bids for the failed company's assets.
"We hope the court would approve the settlement--we think it's in everybody's best interests, said Alex Rodolakis, an attorney for Waltham, Mass.-based Toysmart. Rodolakis said the company will destroy all customer records that it had acquired after April 21 to comply with COPPA.
The controversy presented a headache to the Walt Disney Co., which owns 60 percent of Toysmart and which has made its adherence to strong privacy policies a priority. Last Wednesday Disney said it would buy Toysmart's lists to ensure their confidentiality. "We are pleased that the FTC and Toysmart agreed upon a strategy to protect the privacy of those included on the Toysmart customer list," Disney spokeswoman Michelle Bergman said.
The five FTC commissioners were split on the decision 3 to 2, but the ruling did not break cleanly along party lines, with two Democrats and one Republican in the majority and one Democrat and one Republican in the minority.
In his dissent, Republican Commissioner Orson Swindle said the sale should not be allowed to go through at all, "because 'never' really means never."
Online companies have argued that they can best protect consumer privacy through self-regulation. But James E. Tierney, a consultant to state attorneys general who follows privacy closely, said the Toysmart case reveals "the dark underside of e-commerce. . . . It kind of takes your breath away."