From the FTC:
Following a public comment period, the Federal Trade Commission has approved a final order settling charges thatAaron’s Inc., a national rent-to-own retailer, knowingly played a direct and vital role in its franchisees’ installation and use of software on rental computers that secretly monitored consumers, including taking webcam pictures of them in their homes.
Under the terms of a consent agreement, first announced in October 2013, Aaron’s is prohibited from using monitoring technology to gather consumers’ information from rental computers, or receiving, storing or communicating such information, except to provide technical support at a consumer’s request. The terms of the settlement also bar the company from gathering information from any consumer product via geophysical location tracking technology without clearly notifying and obtaining express consent from consumers at the time of rental. Aaron’s is further prohibited from installing or activating such technology on rental computers that does not clearly notify consumers of its presence immediately before each use, including via a prominent icon on the computer.
The order further bars Aaron’s from deceptively gathering information about consumers, and from using improperly obtained information to collect debt, money or property as part of a rent-to-own transaction. The company must delete or destroy any information it has collected improperly, and can transmit information obtained via monitoring or location tracking only if it is encrypted. In addition, the order requires Aaron’s to conduct annual monitoring and oversight of its franchisees for compliance with the terms of the agreement, act immediately to ensure compliance, and terminate any franchisee that fails to comply.
Looking at the comments submitted during the public comment period, there are a few themes: (1) customers who wanted to know how they could determine whether the spyware had been installed on their computer, (2) customers who asked if they could be part of the FTC settlement, (3) those who wanted the Commission to prosecute Aaron’s criminally, and (4) those who wanted the Commission to impose a heavy monetary penalty. One correspondent objected to the “no admission of liability” clause in the settlement.
In response to the commenters, the FTC responded that it did not have the authority to impose monetary penalties, nor was there any monetary settlement for consumers to participate in. They also explained that they did not have the authority to prosecute Aaron’s criminally. They somewhat side-stepped the question of determining if the consumer had been spied on by saying that Aaron’s agreed to delete all files.
No privacy advocacy or consumer groups commented on the settlement.