Federal Trade Commission

Privacy Impact Assessment

for:

Publication Bulk Order 

Updated April 2019 

Reviewed February 2023
1

Introduction

The Federal Trade Commission’s (FTC) Division of Consumer and Business Education (DCBE) produces 

print materials that offer practical advice to help consumers avoid scams and make informed buying 

decisions and to help businesses comply with the law. The FTC provides these materials – free of charge – 

to individuals and organizations who request copies.

The FTC distributes over 16 million publications each year to a variety of customers. These include 

libraries, credit counseling services, police departments, Congressional offices, community-based 

organizations, trade associations, corporations, and federal, state, and local government offices and other 

institutions.

The Publication Bulk Order System provides an online resource for customers to order FTC publications 

quickly and efficiently. The web-based order system allows customers to select publications from a 

catalog, add them to their “shopping cart,” and “check out” by providing their shipping information. The 

order system is hosted by the FTC’s contractor and/or subcontractor. The Federal Citizen Information 

Center (FCIC) Publication Distribution Center in Pueblo, CO, handles order fulfillment. This facility pulls, 

packs, and ships the publications.

When customers fill out the bulk order form, they can also choose to receive future similar publications 

and communications from the FTC about consumer and business education by checking a box to “opt in” 

to future FTC communications. These FTC communications may include notices about new materials, 

requests for feedback about FTC materials, and other announcements. All FTC communications include 

information about how the customer can unsubscribe from future communications.

System Overview

The Publication Bulk Order System is a contractor-hosted, custom-designed FTC website that collects, 

stores, and manages customer order and shipping information in a secure database. The FTC uses 

information gathered from customers to process their orders and to contact customers if there are any 

problems. The FTC also uses this information to provide updates and other FTC communications to 

customers who request them.

Analysis

1. The Information That Will Be Collected (Nature and Source)

The web-based order system gathers information from customers who wish to order educational 

publications from the FTC. The information collected and maintained may include the customer’s name, 

mailing address, email address, telephone number, business affiliation, titles and quantities of 

publications ordered, whether the customer wishes to receive future FTC communications, and whether 

the customer agrees to be contacted to provide feedback about FTC materials. The customer provides 

this information directly and voluntarily.
2

Customers who wish to receive additional information from the FTC can opt-in by checking a box at the 

bottom of the order form. That check box, which is not pre-checked, contains the following text:

Check here if you would like to receive communications from the FTC, including: 

• notices about new publications like the ones you’ve ordered 

• requests for your feedback 

• the FTC’s monthly e-newsletter.

1

Servers managed by the FTC’s web hosting contractor automatically collect the following information 

from visitors: IP address, date and time of visit, referrer, entry page, exit page, browser, and operating 

system. The system also collects an email address for those customers who choose to receive additional 

information from the FTC. As explained in Section 8 below, the system also uses “cookies” that 

temporarily collect and keep track of the user’s “shopping cart” items until checkout and other cookies 

that maintain data for other general analytic and performance purposes (e.g., remembering the user’s 

preferences). The system does not collect IP addresses related to form submissions and instead uses 

captchas as a spam prevention tool.

2. Why the Information Is Being Collected (Purpose)

The FTC bulk order site helps the agency accomplish its consumer and business education mission by 

allowing customers to request free publications. The FTC collects shipping information to send consumer 

and business education publications to customers who request them. In addition, the FTC collects the 

consumer’s opt-in preference so that the FTC knows whether to send additional FTC communications to 

the customer. As noted above, cookie data are collected and used for order processing and other analytic 

and performance purposes.

In addition, the FTC may contact customers who choose to receive future FTC communications to ask for 

their feedback on its materials. This feedback would be optional and voluntary. Such requests will be 

conducted in compliance with the Paperwork Reduction Act and applicable OMB guidance.

3. The Opportunities Individuals Will Have To Decline To Provide Information Or To 

Consent To Particular Uses Of The Information And How Individuals Grant Consent

Individuals may decline to provide customer information, but customer orders for FTC publications 

cannot be processed without accurate personal information required for shipping and for shipmentrelated communications. The same publications are available online, so individuals may obtain the 

information through the website.

1 Customers who opt in are added to the FTC’s GovDelivery email subscription service and will receive the monthly 

e-newsletter, Penn Corner. For more information, see the GovDelivery PIA.
3

Customers who choose to receive FTC communications but then later decide that they no longer wish to 

receive FTC communications may request to be removed from FTC contact lists. All FTC communications 

sent to customers include instructions for opting out of future communications.

In addition, the FTC collects basic weblog and analytics information from all visitors to FTC websites, 

including the Bulk Order page, in compliance with applicable federal guidance and OMB requirements 

and as described in the FTC Privacy Policy and the PIA for FTC Websites2 . Users’ options for declining the 

system’s use of cookies are explained in the FTC’s privacy policy.4

4. Intended Uses Of The Information Collected

The FTC collects the customers’ name, organization, mailing address, phone number, and email address in 

order to send them the publications they request, and to contact them in the event of delivery or 

fulfillment problems. Additionally, the FTC uses contact information to send communications to 

individuals, organizations, and agencies that “opt-in” to receive additional communications. The FTC uses 

information about customer orders to determine whether to send communications to a particular 

customer. 

The FTC processes the customers’ mailing address through an address verification system to verify the 

accuracy of the provided address. Only the street address, city, state and zip code are processed. No 

information about the customers’ name, telephone number, email address, business affiliation, titles and 

quantities of publications ordered, or “opt in” status is transmitted. Customers are given the opportunity 

to correct any address issues that are noted, or they can proceed to checkout with the address as 

provided. No information about the customers’ address is stored by the verification system.

The FTC collects anonymous web log files to analyze overall traffic to the site and better serve visitors. 

The use of cookie data is explained above and in Section 8 below.

5. With Whom The Information Will Be Shared (Disclosures)

The FTC securely shares customer order information with the FCIC fulfillment center in Pueblo, CO. Staff 

at the fulfillment center use the information to ship orders. 

Customer information may also be shared in accordance with routine uses permitted by the Privacy Act, 

including in response to Freedom of Information Act requests from private individuals or companies, 

requests from Congress, or in litigation.

2 For more information, please see the FTC Public Informational Websites PIA.

4 https://www.ftc.gov/site-information/privacy-policy/internet-cookies.
4

DCBE staff may use opt-in information to provide customers with additional information that may be of 

interest to them, or to solicit their feedback on FTC materials.

A limited number of authorized FTC staff who provide internal reports on visits to FTC websites has access 

to the web log information.

Cookie data are not shared, although the contractor may make site analytics data available in aggregate 

form (not identifiable by individual user) to the FTC.

6. Security (Administrative and Technological Controls, Including Maintenance and 

Disposal)

Personal information collected by the Publication Bulk Order System is safeguarded in several ways. The 

FTC uses a secure website to collect customer information, and stores the information on a secure server. 

Order information is compiled and provided to the Pueblo fulfillment center through secure web-based 

access. Access to the order information is restricted by IP address to only FTC or FCIC (at Pueblo) systems. 

The information on the collecting server is stored for not more than two years on a first-in, first-out (FIFO) 

basis.

Once received by FCIC fulfillment center, data is decrypted strictly for purposes of processing customer 

orders. It is stored on a secure system for one year and deleted on a FIFO basis.

Technical information – including IP address, date and time of visit, referrer, entry page, exit page, 

browser, and operating system – is recorded in web server log files and retained on servers for 90 days 

and on tape for six months. This information is collected for security and internal operations purposes 

only.

FTC staff stores information from customers who choose to receive future FTC communications on FTC 

systems until the individual requests deletion or the FTC no longer anticipates sending information to that 

individual. Typically, this information is stored for no more than two years.

The FTC and its contractors follow applicable federal IT security requirements and FTC policy and 

procedures to ensure that personal information is secured appropriately. The FTC has conducted a risk 

assessment to identify appropriate security controls to protect against risks, and those controls are 

implemented. Monitoring, testing, and evaluation occurs on a regular basis to ensure that controls 

continue to work properly and that information is safeguarded. The FTC's Chief Information Security 

Officer is the point of contact for any security questions relating to this project.

The FTC will maintain and dispose of PII and other information collected by Bulk Order in accordance with 

FTC regulations, policies, and procedures and with FTC records retention schedule N1-122-09-1 approved 

by the National Archives and Records Administration (NARA).
5

All data will be securely disposed of in accordance with OMB, NARA, and NIST regulations and guidelines 

and with FTC policies and procedures.

7. Privacy Act

The customer information maintained in the Publication Bulk Order system is covered by an existing 

Privacy Act System of Records Notice (SORN), FTC VI-I, Mailing Lists.

5

8. Other Privacy Considerations and Analysis

To protect individuals’ privacy, the FTC made the following decisions in configuring the Publication Bulk 

Order System. The FTC limits access to the information to those individuals who have a business purpose 

for seeing the data. Second, the FTC ensures that appropriate safeguards are in place to protect the 

information from internal misuse or external threats, such as hacking. The online order form includes a 

Privacy Act Statement and a link to the FTC’s privacy policy, so customers can make an informed decision 

about sharing their information with us. Lastly, the FTC requires that all outgoing communications include 

opt-out instructions for consumers who no longer wish to receive communications from the FTC.

The FTC’s contractor and/or subcontractor has instituted appropriate safeguards for the information 

collected (see section 1), including physical security of data resources, limited employee access to the 

data, data encryption, and secure data archive storage.

The website is not intended to collect information from children age 13 or under within the meaning of 

the Children's Online Privacy Protection Act (COPPA).

The site makes limited use of persistent and session cookies to provide analysis of site use and to improve 

the website experience for site visitors. Session cookies keep track of items in the “shopping cart” until 

checkout, and persistent cookies allow the FTC to analyze site traffic and remember when a site visitor 

has declined the FTC’s customer satisfaction survey. Use of these cookies is discussed in the relevant PIAs, 

including Web Customer Satisfaction Surveys. Information on the FTC’s use of cookies is also available 

online, including options for users who wish to decline such cookies.

5 All of the FTC’s SORNs are available at www.ftc.gov/about-ftc/foia/foia-reading-rooms/privacy-act-systems.