FTC Settlement with Aaron's Prohibits Use of Monitoring Technology on Computers

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

Oct. 22 --National rent-to-own retailer Aaron's Inc. has settled Federal Trade Commission charges that it knowingly played a role in its franchisees' use of software on rental computers that allowed the secret monitoring of consumers in their homes, according to a proposed FTC consent order released Oct. 22 by the commission (In re Aaron's, Inc. , FTC, File No. 1323156, proposed consent order released 10/22/13).

The consent order would prohibit the use of such monitoring technology and would require the Atlanta-based company to obtain consumer consent before using location-tracking software.

Jessica Rich, director of the FTC Bureau of Consumer Protection, said in the FTC's Oct. 22 statement that consumers “have a right to rent computers free of cyberspying and to know when and how they are being tracked by a company.”

Rich added: “By enabling their franchisees to use this invasive software, Aaron's facilitated a violation of many consumers' privacy.”

PC Rental Agent

The FTC's draft administrative complaint alleged that the challenged conduct violated Section 5 of the FTC Act, 15 U.S.C. §45.

The FTC staff claimed that, between at least 2009 and January 2012, some of Aaron's franchisees licensed a software product known as PC Rental Agent from DesignerWare LLC and installed it on computers rented to consumers. DesignerWare separately settled FTC charges in September 2012 .

In addition to enabling Aaron's franchisees to disable a computer remotely, the complaint said, PC Rental Agent also enabled them to remotely install and activate an add-on program called Detective Mode. The complaint said:

Using Detective Mode, Aaron's franchisees could--and did--surreptitiously monitor the activities of computer users, including by logging keystrokes, capturing screenshots, and using the computer's webcam. Through Detective Mode, Aaron's franchisees could--and did--secretly gather consumers' personal information using fake software registration windows. In addition, using a different PC Rental Agent feature, Aaron's franchisees tracked the physical location of rented computers using WiFi hotspot location information. Aaron's franchisees used this illicitly gathered data to assist in collecting past-due payments and recovering computers after default.  

The complaint said the Detective Mode data sent to Aaron's franchisees included:

• user names and passwords for access to e-mail accounts, social media websites and financial institutions from keystroke logs;

• medical information, applications containing Social Security numbers and bank and credit card statements from screenshots; and

• photographs of computer users and anyone else within view of the camera from webcams operating secretly inside computer users' homes.

The webcams, the staff alleged, also captured “images of minor children as well as individuals not fully clothed and engaged in intimate conduct.”

PC Rental Agent wasn't detectable to computer users, and computer renters were unable to uninstall it. “In numerous instances, Aaron's franchisees did not obtain consent from their rental customers and did not disclose to them or the rental computers' users that PC Rental Agent was installed and could be used to track consumers' physical locations and remotely spy on their activities,” the complaint said.

Aaron's is a also defendant in an action brought by a proposed class of consumers who alleged that the company's actions violated the Wiretap Act and the Computer Fraud and Abuse Act . In July 2011, the court denied the plaintiffs' motion for preliminary injunction, finding that the speculative possibility of harm to the plaintiffs fell short of the irreparable harm required to obtain a preliminary injunction . On Oct. 2, the plaintiffs filed a third amended complaint (Byrd v. Aaron's Inc., W.D. Pa., No. 1:11-cv-00101, third amended complaint filed 10/2/13).

Proposed Settlement

The proposed consent order would:

• prohibit Aaron's from using monitoring technology that captures keystrokes or screenshots, or activates the camera or microphone on a consumer's computer, except to provide technical support requested by the consumer;

• require the company to give clear notice and obtain express consent from consumers at the time of rental in order to install technology that allows location tracking of a rented product;

• prohibit Aaron's from deceptively gathering consumer information;

• prevent the company from using any information obtained through improper means in connection with the collection of any debt, money or property as part of a rent-to-own transaction;

• require Aaron's to delete or destroy any information improperly collected and to transmit in an encrypted format any location or tracking data collected properly;

• require the company to conduct annual monitoring and oversight of its franchisees and hold them to the requirements in the consent order that apply to Aaron's and its corporate stores; and

• require Aaron's to terminate the franchise agreements of franchises that don't meet the requirements of the consent order.

Aaron's would have to give notice to consumers not only when it initially rented computers but also at the time the tracking technology was activated, unless the product was reported as lost or stolen.

Comments on the proposed consent order are due by Nov. 21. The FTC also released an analysis of the proposed settlement to assist the public in furnishing comments.

Tracy S. Thorleifson and Julie K. Mayer, of the FTC, in Seattle, represented the commission. Kristine McAlister Brown, of Alston & Bird LLP, in Atlanta, represented Aaron's.

The proposed consent order is available at http://www.ftc.gov/os/caselist/1223264/131022aaronsorder.pdf.

The draft administrative complaint is available at http://www.ftc.gov/os/caselist/1223264/131022aaronscmpt.pdf.

An analysis of the proposed settlement is available at http://www.ftc.gov/os/caselist/1223264/131022aaronsanal.pdf.

Request Bloomberg Law: Privacy & Data Security