Case study: Learning To Live Up To Privacy Promises & The 2004 Gateway Corp Consent Decree
By: Lydia F De La Torre
Tags: FTC, Case Study, Consent Decree, Unfair

Factual background

In 2014, Gateway Learning Corporation (Gateway) marketed and sold products under the “Hooked on Phonics” brand name and was based in Santa Ana, California.

Since 2000, Gateway Learning marketed its “Hooked on Phonics” products on the Internet at www.hop.com(link is external).

The site’s privacy policy stated, “We do not sell, rent or loan any personally identifiable information regarding our consumers with any third party unless we receive customer’s explicit consent.” Another statement said, “We do not provide any personally identifiable information about children under 13 years of age to any third party for any purpose whatsoever.”

The policy also said that if Gateway Learning changed its policy, it would give consumers the chance to “opt-out” of having their information shared.

According to the FTC, in April 2003, despite these promises, Gateway Learning started renting personal information provided by consumers — including their names, addresses, phone numbers, and age ranges and gender of their children — to target marketers to send mailings and make telemarketing calls.

In June 2003, Gateway revised the privacy policy on its Web site to say that “from time to time” Gateway would provide consumers’ personal information to “reputable companies” whose products or services consumers might find of interest, the FTC complaint says. However, according to the FTC, Gateway continued to rent information collected under the earlier policy.

The FTC alleged that Gateway did not contact consumers who had already provided their information to say that it had revised its privacy policy, nor did it highlight on its Web site the fact that the privacy policy had changed.

On July 1, 2003, Gateway Learning halted its rentals of consumer data collected online.

Settlement

The FTC charged Gateway with violating federal law when it rented consumers’ personal information to target marketers contrary to explicit promises made in its privacy policy. The FTC also alleged that, after collecting consumers’ information, Gateway Learning changed its privacy policy to allow it to share the information with third parties without notifying consumers or getting their consent.

The FTC charged that: (1) Gateway Learning’s claims that it would not sell, rent, or loan to third parties consumers’ personal information unless it received the consumers’ consent, and that it would never share information about children, were false; (2) Gateway Learning’s retroactive application of a materially changed privacy policy to information it had previously collected from consumers was an unfair practice; and (3) Gateway Learning’s failure to notify consumers of the changes to its privacy policy and practices, as promised in the original policy, was a deceptive practice. The agency charged that the practices violated Section 5 of the FTC Act.

Gateway entered into a consent decree with the FTC in 2004. The settlement:

Bars misrepresentations about how Gateway will use data it collects from consumers.

Prohibits Gateway from sharing any personal information collected from consumers on its Web site under the earlier privacy policy unless it first obtains express affirmative (“opt-in”) consent from consumers.

Gateway from any personal information collected from consumers on its Web site under the earlier privacy policy Prohibits it from applying future material changes to its privacy policy retroactively without consumers’ consent .

. Requires that the company give up $4,600 it earned from renting the data.

The order contains standard record keeping provisions.