Guess?, Inc., et al.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF GUESS?, INC., ET AL.

CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4091; File No. 0223260 Complaint, July 30. 2003--Decision, July 30, 2003 This consent order, among other things, prohibits Respondents Guess?, Inc. and Guess.com, inc. (“Guess”) – together an international company that designs and produces men’s, women’s, and children’s clothing and accessory products that are marketed, distributed, and sold under various Guess brand names through its own stores, a limited number of independent retailers, and its online store – in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service, from misrepresenting the extent to which it maintains and protects the security, confidentiality, or integrity of any personal information collected from or about consumers. The order also requires Guess to establish and maintain a comprehensive information security program in writing that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. In addition, the order requires Guess to obtain – within one year, and on a biannual basis thereafter for twenty years – an assessment and report from a qualified, objective, independent third-party professional, certifying that (1) Guess has in place a security program that provides protections that meet or exceed the protections required by Part II of this order; and (2) Guess’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of consumer’s personal information has been protected.

Participants For the Commission: Jeffrey S. Davidson, Alain Sheer, Jessica L. Rich, Joel Winston, Louis Silversin, Gerard R. Butters, and Paul A. Pautler.

For the Respondents: Debra Valentine, O’Melveny & Myers, and Deborah Siegel, Guess.

VOLUME 136 Complaint COMPLAINT The Federal Trade Commission, having reason to believe that Guess?, Inc., a corporation, and Guess.com, inc., a corporation, (“Respondents”) have violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Guess?, Inc. is a Delaware corporation with its principal office or place of business at 1444 S. Alameda Street, Los Angeles, California 90021. Respondent Guess.com, inc. is a Delaware corporation and a whollyowned subsidiary of Respondent Guess?, Inc. Its principal office or place of business is at 1444 S. Alameda Street, Los Angeles, California 90021.

2. Respondent Guess?, Inc. designs and produces, or licenses others to produce, men’s, women’s, and children’s clothing and accessory products. These products are marketed, distributed and sold under various Guess? brand names through its own stores, independent retailers, and www.guess.com, a website owned and operated by Respondent Guess.com, inc.

3. The acts and practices of Respondents alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act.

4. Respondents have marketed and sold Guess-branded clothing and accessory products to consumers online at www.guess.com since June 1998. In order to make purchases from the website, consumers must pay using a credit or debit card. To complete these transactions, consumers must provide personal information, including, but not limited to, name, address, and credit or debit card number and expiration date. Respondents store this information in particular locations (called “tables”) within VOLUME 136 Complaint databases that support or connect to the website. For example, the credit card numbers received from purchasers on the website are stored in a single database table. Respondents also store product information, such as the sizes and colors in which a shirt is available, in other tables contained within the same databases.

5. Like most e-commerce websites, visitors interact with Respondents' website using a software program called an "application." Respondents' application was designed so that a visitor could use it to obtain product information from certain database tables, as well as to supply transaction information that was then stored in other tables in the databases. To facilitate communications between the website and a visitor, the application was designed to automatically present in clear readable text any information retrieved from or supplied to the databases. 6. Since June 1998, Respondents have disseminated or caused to be disseminated privacy policies on www.guess.com, including but not necessarily limited to that attached as Exhibit A, containing the following statements: Privacy Policy At GUESS.com, we are committed to protecting your privacy. We firmly believe that electronic security and privacy are necessary for the continued success of the Internet. In support of this, we only use the personal information that you provide to create a more personalized and entertaining experience for you, in accordance with the terms outlined below.

* * * Security This site has security measures in place to protect the loss, misuse and alteration of the information under our control. VOLUME 136 Complaint All orders are transmitted over secure Internet connections using SSL (Secure Sockets Layer) encryption technology. All of your personal information including your credit card information and sign-in password are stored in an unreadable, encrypted format at all times. This Website and more importantly all user information, is further protected by a multi-layer firewall based security system. Exhibit A: GUESS.com Privacy Policy, http://www.guess.com/section.asp?section=privacy (emphasis in original).

7. Respondents have disseminated or caused to be disseminated Frequently Asked Questions on www.guess.com, including but not necessarily limited to that attached as Exhibit B, containing the following statements:

Q: What is the Information Security Policy for GUESS? Online? A: Providing a safe and secure environment for your order information is our top priority. Taking advantage of Secure Sockets Layer (SSL) technology, GUESS? ensures the security of your online transaction. The GUESS? Online Store is powered by Microsoft and Verisign and uses Cybersource SSL technology - the industry standard for encryption technology to create a secure transaction environment for commerce on the Internet. SSL technology encrypts files allowing only GUESS? to decode your information.

Exhibit B: About Guess?, http://www.guess.com/section.asp?section=help (emphasis in original).

8. Since at least October 2000, Respondents’ application and website have been vulnerable to commonly known or reasonably foreseeable attacks from third parties attempting VOLUME 136 Complaint to obtain access to customer information stored in Respondents’ databases. These attacks include, but are not limited to, web-based application attacks such as “Structured Query Language” (“SQL”) injection attacks. Such attacks occur when an attacker enters certain characters in the address (or URL) bar of a standard web browser to direct the application to obtain information from the databases that support or connect to the website. Through such an attack, the application could be manipulated to gain access, in clear text, to every table in the www.guess.com databases, including the tables containing the credit card information supplied by purchasers.

9. Respondents created these vulnerabilities by failing to implement reasonable and appropriate measures to secure and protect the databases that support or connect to the website. Among other things, Respondents failed to: adopt policies and procedures adequate to protect sensitive consumer information collected though the website; test or otherwise assess the website’s or the application’s vulnerability to attacks; and implement reasonable measures to prevent website visitors from gaining access to database tables containing sensitive personal information about other consumers.

10. The risk of web-based application attacks is commonly known in the information technology industry, as are simple, publicly available measures to prevent such attacks. Security experts have been warning the industry about these vulnerabilities since at least 1997; in 1998, at least one security organization developed, and made available to the public at no charge, security measures which could prevent such attacks; and in 2000, the industry began receiving reports of successful attacks on web-based applications.

VOLUME 136 Complaint 11. In February, 2002, a visitor to the website, using an SQL injection attack, was able to read in clear text credit card numbers stored in Respondents’ databases. 12. Through the means described in Paragraphs 6 and 7, Respondents have represented, expressly or by implication, that the personal information they obtained from consumers through www.guess.com was stored in an unreadable, encrypted format at all times. 13. In truth and in fact, the personal information Respondents obtained from consumers through www.guess.com was not stored in an unreadable, encrypted format at all times. Using a standard web browser, a commonly known attack could be employed to manipulate the web application and gain access, in clear readable text, to sensitive personal information about other consumers, including but not limited to, consumer names and credit card numbers and expiration dates. Therefore, the representation set forth in Paragraph 12 was false or misleading.

14. Through the means described in Paragraphs 6 and 7, Respondents have represented, expressly or by implication, that they implemented reasonable and appropriate measures to protect the personal information they obtained from consumers through www.guess.com against loss, misuse, or alteration.

15. In truth and in fact, Respondents did not implement reasonable and appropriate measures to protect the personal information they obtained from consumers through www.guess.com against loss, misuse, or alteration. In particular, Respondents failed to implement procedures that were reasonable and appropriate to: (1) detect reasonably foreseeable vulnerabilities of their website and application and (2) prevent visitors to the website from exploiting such vulnerabilities and gaining access to sensitive consumer data. Therefore, the VOLUME 136 Complaint representation set forth in Paragraph 14 was false or misleading.

16. The acts and practices of Respondents as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this thirtieth day of July, 2003, has issued this complaint against Respondents. By the Commission.

EXHIBIT A GUESS? Page 1 of 2 MODELS & MORE © A Second Decade Of GUESS Coffee Table Bunk GUESS Baa MEN GIRLS BOYS BABY GIRLS BABY BOYS Gl BY MAR GLANG VWishor: a Privacy Policy At GUESS.com, we are committed to protecting your privacy. We firmly believe that electronic security and privacy are necessary for the continued success of the Internet. In support of this, we only use the personal information that you provide to create a more personalized and entertaining experience for you, in accordance with the terms outlined below.

Kid's policy (individuals under 13 years of age). GUESS.com is committed to protecting the safety of children online. In compliance with the Children's Privacy Protection Act of 1998, GUESS.com will never knowingly request or use personal information from children under 13 years of age without prior parental consent. If GUESS.com receives actual knowledge that a subscriber is under 13 years of age, GUESS.com will eliminate all personal information relating. to this subscriber from our files...

Information We Gather We use all information provided during registration and personalization to provide personalized content and services. Any account information you supply will be used only to process requested commerce transactions or to contact you regarding a specific transaction. GUESS.com may also use this information in order to generate aggregate reports that help us determine how to improve our users’ experience. This data is anonymous and does not contain any personally identifiable information. GUESS.com will not disclose your user information to any. outside organization without your consent. However, GUESS.com may disclose user information to the government and/or third parties when we have reason to believe that disclosure of such information is necessary to identify or bring legal action against someone who may be violating our Terms and Conditions or otherwise causing harm to GUESS.com or anyone who could be victimized by such activities, and where otherwise required by. law or by legal process.

We may also use your contact information to e-mail you newsletters that inform you of new products and special features at GUESS.com. We may also offer you special promotions from our site or our sponsors. If you prefer not to receive such communications, you may contact us at [email protected]. GUESS.com also derives user information through some simple technical methods. We may use data-tracking software that lets us know what areas of the site you visit most often. This helps us present you with the information and features in which you are most interested.

We may use your IP (Internet protocol) address to help diagnose problems with our server, and to administer our Web site. Your IP address is used to help identify you and your shopping cart and to gather broad demographic information. Our site uses cookies to keep track of your shopping cart. We use cookies to deliver content specific to your interests and to save your password so you don't have to reenter it each time you visit our site.

http://www.guess.com/section.asp?section=privacy 1/23/2003 GUESS? Page 2 of 2 Security.

This site has security measures in place to protect the loss, misuse and alteration of the information under our control. All orders are transmitted over secure Internet connections using SSL (Secure Sockets Layer) encryption technology. All of your personal information including your credit card information and sign-in password are stored in an unreadable, encrypted format at all times. This Website and more importantly all user information, is further protected by a multi-layer firewall based security system.

Contact Us If you have any questions about this privacy statement, the practices of this site, or your dealings with GUESS.com, you can contact us: Customer Service GUESS.com 1444 Alameda St.

Los Angeles, CA 90021 [email protected] GIFT CARDS. SIGN IN. YOUR SHOPPING BAG CHECKOUT SITE MAP SIZE CHART STORE LOCA We can accept orders within the 48 continental United States, Alaska, and Hawaii. We cannot accept orders in Canada at this time. http://www.guess.com/section.asp?section=privacy 1/23/2003 EXHIBIT B GUESS? Page 1 of 9 MODELS & GUESS WOMEN MEN GIRLS BOYS BABY GIRLS BABY BOYS MORE BY BAR GIANG i S A Second Decade 0f GUESS Cols About GUESS? Order Info Billing Out-Of-Stock Items Care Instructions. Phone Orders Customer Service Postcards Gifts Privacy & Security The GUESS? Foundation Retail Stores Investor’s Info Returns & Exchanges Jobs Shipping Licensing Size Charts Modeling Opportunities Technical Questions Watches Your Profile About GUESS? Q: How do I contact GUESS? A:Depending on the nature of your question, you may reach GUESS one of the following ways.

For assistance in locating a specific item in a retail store, please call: GUESS? Retail 1-800-39-GUESS For help locating an employee or specific department, questions regarding retail stores, and information about advertising or licensing, please call: GUESS? Corporate 1-800-22-GUESS For online help, information about online ordering and returns, reporting website errors, or receiving assistance in placing a GUESS.com order, please call: GUESS? Online Monday through Friday from 8:30 a.m. to 6:00 p.m. (EST) 1-877-44-GUESS receive a response within 24 hours.

Q: Where is the GUESS? corporate office located? A: GUESS? corporate headquarters are located in Los Angeles, California. GUESS? also has showroom locations in New York City, Dallas and Atlanta. If you would like to. send correspondence to our corporate office, please address it to: GUESS?, Inc.

http://www.guess.com/section.asp?section=help 1/23/2003 GUESS? Page 2 of 9 1444 South Alameda. Street Los Angeles, CA 90021 U.S.A.

Q: Iam doing a report for school, where can I find information about GUESS? A: Most of the information you need can be found within this website. For information on the history of the company, store locations, financial articles, and recent news items, visit the GUESS, Inc. section. Information on our models and advertising campaigns can be found within the Models & More section of the site. Documents filed with the Securities & Exchange Commission, such as proxy statements, 10-K's, 10-Q's, annual reports, and others, may be found at http://www.sec.gov. Choose Search5 1 5 1 3 4 996 950 66 32 96.118484 For5 1 5 1 3 5 1077 949 193 42 95.251038 Company5 1 5 1 3 6 1289 949 144 42 79.684097 Filings under Filings & Forms (EDGAR). Select Search5 1 5 1 4 4 734 999 79 34 95.689857 Thes 1 5 1 4 5 829 1000 146 33 96.174187 EDGAR5 1 5 1 4 6 990 1000 197 33 73.405418 Archives under General Purpose Searches. Then, enter the search keyword: guess.

To obtain a printed copy of an annual report, please submit a written request along with your complete mailing address to:

GUESS?, Inc.

Investors Relations Department 1444 South Alameda Street Los Angeles, CA 90021 U.S.A...

We are not able to provide detailed answers to specific questions about our advertising or marketing programs, strategic planning, internal systems, policies or. other confidential topics.

Q: What is the GUESS? Mission Statement? A: MISSION STATEMENT:

At GUESS?, we are committed to being a worldwide leader in the fashion industry. We will deliver products and services of uncompromising quality and integrity consistent with our brand and our image. We are committed to listening and responding to the needs of our customers, associates and business partners and honor their individual value.

We are dedicated to personal and professional enrichment through an environment of open communication, creativity, teamwork, trust and. respect. We continue to give back to the community, support humanity and protect the environment as part of our responsibility. We remain committed to an entrepreneurial spirit that fuels the growth of our Company and achieves increased shareholder value. Through principled leadership we will embrace diversity, cultivate strength, pride and. passion to align our personal life and our professional life.

http://www.guess.com/section.asp?section=help 1/23/2003 GUESS? Page 3. of 9 Q: Where does GUESS? purchase its fabrics? A: The fabrics used by GUESS? come from vendors in California or are imported from. Sri Lanka, Bahrain, India, Korea, Taipan, India, Mexico, Hong Kong, Taiwan, Peru or Brazil.

Q: How did GUESS? get its name? A: One morning, as the Marciano brothers were driving to work,. Georges Marciano saw a McDonald's billboard that read GUESS5 1 3 2 2 8 1167 712 163 34 96.478966 WHAT'S5 1 3 2 2 9 1347 715 43 31 96.251694 IN5 1 3 2 2 10 1408 715 82 31 95.829750 THES 1 3 2 2 11 1509 715 95 31 95.829750 NEWS 1 3 2 2 12 1623 715 73 32 96.508171 BIG5 1 3 2 2 13 1716 714 129 33 95.131195 MAC? The biggest word in the entire phrase was GUESS. It caught Georges‘ eye and the name of the company was born. Maurice Marciano added the triangle, and. a family friend designed a question mark to complete the logo. Billing Q: How can I pay for purchases made at GUESS? Online? A: GUESS? Online accepts the following major credit cards: VISA MASTERCARD AMERICAN EXPRESS DISCOVER GUESS? GIFT. CARD Q: When is my credit card billed? A: Your credit card will only be billed when your order is. shipped. Q: Why do I have to pay sales tax on my order? A: GUESS? is required by law to charge sales tax to orders shipped to California and Kentucky. Sales tax does not apply to orders shipped to addresses in other states. Care Instructions Q: How should I care for my GUESS? products? A: To fully enjoy your new GUESS? products, make sure you read the item's label and follow the care instructions. Here are a few more tips for keeping your items looking their very. best:

For Dark Denim (Raw & Rinse): Add 1/2 cup of white vinegar to the water when you wash your jeans the very first time. This helps to set the dark dye in the fabric. Always wash denim inside out, zipper up, to prevent excess wear and tear and delay fading.

For Ribbed Knits: To maintain an item's shape, wash it in cold water and dry flat. To maximize shrinkage, wash in warm water and dry in hot air. For Silk Screened Items: Wash items inside out, and lay flat to dry or dry using cool air. Use fabric softener to keep the items soft. For Items With Rhinestones Or Glitter: Follow the instructions for Silk Screened items.

Customer Service http://www.guess.com/section.asp?section=help 1/23/2003 GUESS? Page 4 of 9 Q: How can I reach Customer Service? A: Please email any questions or concerns to a Customer Service Representative by clicking here. You may. also call GUESS? Online Customer Service toll-free at 1-877- 44-GUESS (or 48377). Monday through Friday from 8:30 a.m. to 6:00 p.m. (EST). If you have questions regarding retails stores, licensing, advertising, or need assistance in locating an employee or department, please call 1-800-22-GUESS. Gifts Q: How do I place a gift order? . J A: When placing your order, please select Sends 1 3 2 2 9 1248 838 97 34 95.613403 This5 1 3 2 2 10 1360 841 58 31 95.617516 As5 1 3 2 2 11 1431 841 32 31 95.622009 A5 1 3 2 2 12 1479 839 105 34 93.883247 Gift on the Checkout page. Any price tags will be removed and a gift receipt will be included within the order box. You may also include a brief message that will be printed on the gift receipt...

The GUESS? Foundation Q: How does The GUESS? Foundation select an organization to support? Is my organization eligible? A: IFor an organization to be considered by The GUESS? Foundation, a written request must be submitted detailing the organization's functions with documentation supporting a tax-exempt status. Please direct all inquiries to: The GUESS? Foundation 1444 South Alameda Street Los Angeles, California 90021 U.S.A.

Investor's Info Q: Where can I learn more about GUESS? stock? A: To find the latest stock quotes, learn about analyst coverage, or read past and present press releases, please visit the Investor’s Page located in the GUESS?, Inc. section of the site.

Jobs Q: I am interested in working for GUESS?. Where can I send my resume? A: Please send your scanner friendly resume and cover letter to: GUESS?, Inc.

Department of Human Resources 1444 South Alameda Street Los Angeles, CA 90021 U.S.A.

For more information, please visit the GUESS? Work section of the site. If you are within the United States and would like access to an automated listing of specific http://www. guess.com/section.asp?section=help 1/23/2003 GUESS? Page 5 of 9 employment opportunities, please call 1-800-22-GUESS and enter extension 5988. Licensing.

Q: Can I open a GUESS? store? Can I sell GUESS? products in my store? A: Please submit a written inquiry, along with your company's profile to: GUESS?, Inc.

Licensing Department 1444 South Alameda Street Los Angeles, CA 90021.

USA .

Modeling Opportunities Q: How can I become a GUESS? model? A: GUESS? selects models from around the world who represent the image of a particular campaign. We typically select models already signed with professional agencies. If you are interested in modeling for GUESS?, we suggest you contact a professional modeling agency in your area and have them forward your portfolio to: GUESS?, Inc.

Advertising. Department 1444 South Alameda Street Los Angeles, CA 90021 U.S.A.

Order Info Q: How will I know if my order is confirmed? oo A: If you provided a valid email address during the Checkout process, you will receive two emails after your order is placed. The first will confirm the details of your order. The second email will arrive when your order has shipped and include your order tracking number.

Q: Where does GUESS? Online accept orders from? A: We are able to accept orders within the 48 continental United States as well as Alaska and Hawaii...

Out-Of-Stock Items Q: What happens if I place an order and GUESS? does not have the item in stock? A: While we make every effort to maintain an ample supply of our stock, occasionally we run out of certain items. Out-of-stock items will be removed from your original order total and a revised total will appear in your shipping confirmation email. Unfortunately, we are unable to accept back orders at this time. http://www. guess.com/section.asp?section=help 1/23/2003 GUESS? Phone Orders Q: Can I place my order by phone instead of online? A: If you would prefer to. place your order by phone, please call Customer Service tollfree at 1-877-44-GUESS (or 48377), Monday through Friday, 8:30 a.m. to 6:00 p.m. (EST).

Postcards Q: I can’t view my GUESS? postcard! Help! A: The directions for opening your postcard are contained in the email you received with your postcard. Simply click on the URL address in the body of the email or cut and paste the URL into your browser window. Privacy & Security Q: What is the Customer Information Policy for GUESS? Online? A: GUESS? compiles customer information in an effort to improve and enhance our. customers’ online shopping experience. We may use this information for marketing and promotional purposes. At this time, we do NOT provide or sell online customer information to any outside companies or third parties. If at any time you wish to remove Your Profile information, please email us at [email protected] and type Removes 1 8 1 2 5 1221 1650 125 33 96.148560 Profiles 1 8 1 2 6 1364 1650 260 33 94.680161 Information in the Subject line of your email.

Q: What is the Information Security Policy for GUESS? Online? C4 A: Providing a safe and secure environment for your order information is our top priority. Taking advantage of Secure Sockets Layer (SSL) technology, GUESS? ensures the security of your online transaction. The GUESS? Online Store is powered by Microsoft and Verisign and uses Cybersource SSL technology. - the industry standard for encryption technology to create a secure transaction environment for commerce on the Internet. SSL technology encrypts files allowing only GUESS? to decode your information.

Retail Stores Q: Where can I find the closest GUESS? retail store? A: : If you are within the United States, please shop in the GUESS? Online Store. For worldwide GUESS? retail locations, please use the Store Locator or call 1-800-39- GUESS (within the United States only).

Q: I saw an item in a GUESS? retail store a while ago, how can I find it? A: If you need help locating a retail store item, please call 1-800-39-GUESS. Returns & Exchanges http://www. guess.com/section.asp?section=help Page 6 of 9 1/23/2003 _ GUESS? Q: How can I return or exchange merchandise ordered from GUESS? Online? A: At GUESS? Online, we want you to be 100% satisfied with your purchases. We'll happily accept the return or exchange of unworn, unwashed or defective items. Need a different size? Color? Style? We'll send it to you! Simply choose one of the following convenient options to make a return or exchange: Return To A Store Please bring the item(s) along with your original receipt, photo ID, and the credit card you used when you placed your order, to the closest GUESS? retail store. Please use our Store Locator to find the closest GUESS? store. Express Exchange Need it in a hurry? Simply call toll-free 1-877-44-GUESS and order your replacement merchandise. In-stock merchandise will be shipped within approximately 24 hours at no charge for shipping and handling. We will charge your credit card for new merchandise and refund your credit card for returned merchandise as soon as we receive it.

Return Or Exchange By Mail Complete the Return/ Exchange Form included in your original shipment and enclose it with the item in its original packaging (when possible). Affix the enclosed shipping label to ensure correct delivery. When exchanging items, be sure to indicate the replacement item, including the style number, color, and size. Packages must be shipped pre-paid. We cannot accept C.O.D. deliveries. If you have misplaced your GUESS? Return/Exchange label, please send your prepaid, insured package to:

GUESS.com E-Commerce Returns 10610 Freeport Drive Louisville, KY 40258 Refunds and exchanges are processed when item(s) are received. GUESS? will pay the shipping charges for orders processed as exchanges. Refunds are given for the price indicated on the original receipt. Credits for returned or exchanged merchandise will be issued to the original credit card only. Please allow 1 to 2 billing cycles for the credit to appear on your statement...

Returns Without An Original Receipt If you no longer have a copy of your original receipt, a refund will be issued for the item's current or most recent sale price. If you have further questions or require additional assistance, please email our Online Customer Service Department by clicking here.

Gift Returns If you would like to return an item you received as a gift, please follow. the for returns or exchanges. Gift returns will be refunded via check to the gift recipient. . Q: What is your return policy? A: GUESS? will gladly accept returns and exchanges with the original receipt and tags attached for up to 60 days after the original purchase. Sale merchandise may be exchanged only. Returns will be refunded in the method of original payment.. Gift recipients may receive a refund check or exchange for equal or lesser value. http://www. guess.com/section.asp?section=help Page 7 of 9 1/23/2003 _ GUESS? Page 8 of 9 Shipping Q: What are my shipping options and rates? A: GUESS? Online orders may be shipped one of the following ways: UPS Next Day Air ® UPS 2nd Day Air ® UPS Ground Q: How long does it take before my order is shipped? A: Orders placed during regular business hours (Monday through Friday, 8:00 a.m. to 4:00 p.m. EST) are typically shipped within 24 hours. Q: Can I have my order shipped to multiple addresses? A: If you would like to send a shipment to more than one address, you will have to place separate online orders for each destination, or place your order by phone at 1- 877-44-GUESS (or 48377).

Q: Once my order is shipped, how can I track it? A: Your shipment confirmation email will contain your GUESS? order tracking number. If you are registered with GUESS? Online, sign in using your Username and Password and go directly to the Order History section. Inside, you'll find a link directly. to the UPS site where you will be prompted to enter your order tracking number. Please note: it may take up to 24 hours before your tracking information appears online. Size Charts Q: How do I know what size to order? Cc A: Please visit the Size Chart section which contains information on sizing and the proper way to take your measurements.

If you have further size or fit questions, please email our Customer Service Department by clicking here. Or call us toll-free at 1-877-44-GUESS (or 48377) Monday through Friday from 8:30 a.m. to 6:00 p.m. (EST). Technical Questions Q: What browser works best with the GUESS.com site? A: Our technical team makes every effort to ensure the site will be compatible with every browser, but the GUESS.com site is optimized for Netscape and Internet Explorer 4.0 browsers and above, with a screen resolution set to 800X600. Javascript and Cookies must be enabled. Please see your browser's help section for more information.

Watches Q: Who do I contact with service questions about my GUESS? watch? A: Please contact the GUESS? watch manufacturer, Callanen International, directly by emailing them at [email protected]. You may also reach them by calling 1http://www. guess.com/section.asp?section=help 1/23/2003 GUESS? Page 9 of 9 800-248-3775 or sending a written inquiry to: Callanen International 165 Water Street Norwalk, CT. 06854 U.S.A.

Your Profile Q: Why should I save a profile? Cc A: By saving Your Profile with a Username and Password, you'll cut your Checkout time in half. Sign in when you make a purchase and we'll automatically fill in the forms with all of your billing and shipping information. You'll also be the first to hear about sales, new merchandise and contests... GIFT CARDS SIGN IN YOUR SHOPPING BAG CHECKOUT SITE MAP SIZE CHART STORE LOCA We can accept orders within the 48 continental United States, Alaska, and Hawaii. We cannot accept orders in Canada at this time. http://www. guess.com/section.asp?section=help 1/23/2003 VOLUME 136 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the Respondents named in the caption hereof, and the Respondents having been furnished thereafter with a copy of a draft complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondents with violation of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq; and The Respondents, their attorney, and counsel for the Commission having thereafter executed an agreement containing a consent order, an admission by the Respondents of all the jurisdictional facts set forth in the aforesaid draft complaint, a statement that the signing of said agreement is for settlement purposes only and does not constitute an admission by Respondents that the law has been violated as alleged in such complaint, or that the facts as alleged in such complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission's Rules.

The Commission having thereafter considered the matter and having determined that it has reason to believe that the Respondents have violated the said Act, and that a complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the public record for a period of thirty (30) days, now in further conformity with the procedure described in § 2.34 of its Rules, the Commission hereby issues its complaint, makes the following jurisdictional findings and enters the following order:

1. Respondent Guess?, Inc. is a Delaware corporation with its principal office or place of business at 1444 S. Alameda Street, Los Angeles, California 90021. Respondent Guess.com, inc. is a Delaware corporation and a wholly-owned subsidiary of VOLUME 136 Decision and Order Respondent Guess?, Inc. Its principal office or place of business is at 1444 S. Alameda Street, Los Angeles, California 90021. 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondents, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions shall apply: 1. “Personal information” shall mean individually identifiable information from or about an individual consumer including, but not limited to: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name that reveals an individual’s email address; (d) a telephone number; (e) a social security number; (f) credit and/or debit card information, including credit and/or debit card number and expiration date; (g) a persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual consumer; or (h) any other information from or about an individual consumer that is combined with (a) through (g) above.

2. Unless otherwise specified, “Respondents” shall mean Guess?, Inc. and its successors and assigns, officers, agents, representatives, and employees, Guess.com, inc. and its successors and assigns, officers, agents, representatives, and employees, and both of them and their successors and assigns, officers, agents, representatives, and employees.

3. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

VOLUME 136 Decision and Order I.

IT IS ORDERED that Respondents, directly or through any corporation, subsidiary, division, or other device, in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication, the extent to which Respondents maintain and protect the security, confidentiality, or integrity of any personal information collected from or about consumers.

II.

IT IS FURTHER ORDERED that Respondents, directly or through any corporation, subsidiary, division, or other device, in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall establish and maintain a comprehensive information security program in writing that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. Such program shall contain administrative, technical, and physical safeguards appropriate to Respondents’ size and complexity, the nature and scope of Respondents’ activities, and the sensitivity of the personal information collected from or about consumers, including:

A. the designation of an employee or employees to coordinate and be accountable for the information security program.

B. the identification of material internal and external risks to the security, confidentiality, and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include VOLUME 136 Decision and Order consideration of risks in each area of relevant operation, including, but not limited to: (1) employee training and management; (2) information systems, including network and software design, information processing, storage, transmission, and disposal; and (3) prevention, detection, and response to attacks, intrusions, or other systems failures.

C. the design and implementation of reasonable safeguards to control the risks identified through risk assessment, and regular testing or monitoring of the effectiveness of the safeguards’ key controls, systems, and procedures. D. the evaluation and adjustment of Respondents’ information security program in light of the results of the testing and monitoring required by subparagraph C, any material changes to Respondents’ operations or business arrangements, or any other circumstances that Respondents know or have reason to know may have a material impact on the effectiveness of their information security program.

III.

IT IS FURTHER ORDERED that Respondents obtain an assessment and report from a qualified, objective, independent third-party professional, using procedures and standards generally accepted in the profession, within one (1) year after service of the order, and biannually thereafter, that:

A. sets forth the specific administrative, technical, and physical safeguards that Respondents have implemented and maintained during the reporting period; B. explains how such safeguards are appropriate to Respondents’ size and complexity, the nature and scope of Respondents’ activities, and the sensitivity of the personal information collected from or about consumers; VOLUME 136 Decision and Order C. explains how the safeguards that have been implemented meet or exceed the protections required by Paragraph II of this order; and D. certifies that Respondents’ security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of personal information is protected and, for biannual reports, has so operated throughout the reporting period. Each assessment and report required by this Paragraph shall be prepared by a person qualified as a Certified Information System Security Professional (CISSP) or holding Global Information Assurance Certification from the SysAdmin, Audit, Network, Security Institute; or by a similarly qualified person or organization approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission. Respondents shall provide the first assessment and report to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580, within ten (10) days after it is prepared. All subsequent biannual reports shall be retained in accordance with Paragraph IV. B. of this order and provided to the Associate Director of Enforcement upon request.

IV.

IT IS FURTHER ORDERED that Respondents shall maintain, and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of each document relating to compliance, including but not limited to:

A. for a period of five (5) years:

1. a sample copy of each different print, broadcast, cable, or Internet advertisement, promotion, information collection form, Web page, screen, email message, or other VOLUME 136 Decision and Order document containing any representation regarding Respondents’ online collection, use, and security of personal information from or about consumers. Each Web page copy shall be dated and contain the full URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting the information on the Web. Provided, however, that after creation of any Web page or screen in compliance with this order, Respondents shall not be required to retain a print or electronic copy of any amended Web page or screen to the extent that the amendment does not affect Respondents’ compliance obligations under this order, and 2. any documents, whether prepared by or on behalf of Respondents, that contradict, qualify, or call into question Respondents’ compliance with this order; and B. for a period of three (3) years after the date of preparation of each previous assessment and report required under Paragraph III of this order, and for the initial assessment and report, from the date the order is entered until two years following preparation of the assessment and report: all reports, studies, reviews, audits, audit trails, security assessments, risk assessments, policies, training materials, logs (from devices that detect or prevent attacks such as firewalls and intrusion detection systems), and plans (including the assessments and reports required under Paragraph III), whether prepared by or on behalf of Respondents, relating to Respondents’ compliance with Paragraphs II and III of this order.

V.

IT IS FURTHER ORDERED that Respondents shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, VOLUME 136 Decision and Order agents, and representatives having managerial responsibilities relating to the subject matter of this order. Respondents shall deliver this order to such current personnel within thirty (30) days after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities.

VI.

IT IS FURTHER ORDERED that Respondents shall notify the Commission at least thirty (30) days prior to any change in either corporation that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in either corporate name or address. Provided, however, that, with respect to any proposed change in either corporation about which either Respondent learns less than thirty (30) days prior to the date such action is to take place, Respondents shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Paragraph shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580. VII.

IT IS FURTHER ORDERED that Respondents shall, within one hundred and twenty (120) days after service of this order, and at such other times as the Commission may require, file with the Commission an initial report, in writing, setting forth in detail the manner and form in which they have complied with this order. VOLUME 136 Decision and Order VIII.

This order will terminate on July 30, 2023, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Paragraph in this order that terminates in less than twenty (20) years;

B. this order’s application to any Respondent that is not named as a defendant in such complaint; and C. this order if such complaint is filed after the order has terminated pursuant to this Paragraph.

Provided, further, that if such complaint is dismissed or a federal court rules that the Respondents did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Paragraph as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

VOLUME 136 Analysis Analysis of Proposed Consent Order to Aid Public Comment The Federal Trade Commission has accepted, subject to final approval, a consent agreement from Guess?, Inc. and Guess.com, inc. (“Guess”).

The consent agreement has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement's proposed order. Guess is an international company that designs and produces men’s, women’s, and children’s clothing and accessory products. The company’s products are marketed, distributed, and sold under various Guess brand names through its own stores, a limited number of independent retailers, and, its online store at www.guess.com. This matter concerns alleged false or misleading representations Guess made to consumers about the security of personal information collected online through www.guess.com, Guess’ online store. The Commission’s proposed complaint alleges that Guess misrepresented that the personal information it obtained from consumers through www.guess.com was stored in an unreadable, encrypted format at all times. The complaint alleges that this representation was false because a commonly known attack could and was used to gain access in clear readable text to sensitive personal information, including credit card numbers, that Guess obtained from consumers.

The proposed complaint also alleges that Guess represented that it implemented reasonable and appropriate measures to protect the personal information it obtained from consumers through www.guess.com against loss, misuse, or alteration. The complaint alleges this representation was false because Guess did not employ VOLUME 136 Analysis appropriate measurestodetectreasonablyforeseeable vulnerabilities and prevent their exploitation.

The proposed order applies to Guess’ collection and storage of personal information from or about consumers in connection with its online business. It contains provisions designed to prevent Guess from engaging in practices similar to those alleged in the complaint in the future.

Specifically, Part I of the proposed order prohibits Guess, in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service, from misrepresenting the extent to which it maintains and protects the security, confidentiality, or integrity of any personal information collected from or about consumers.

Part II of the proposed order requires Guess to establish and maintain a comprehensive information security program in writing that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. The security program must contain administrative, technical, and physical safeguards appropriate to Guess’s size and complexity, the nature and scope of its activities, and the sensitivity of the personal information collected from or about consumers. Specifically, the order requires Guess to: • Designate an employee or employees to coordinate and be accountable for the information security program; • Identify material internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment must include consideration of risks in each area of relevant operation.

VOLUME 136 Analysis • Design and implement reasonable safeguards to control the risks identified through risk assessment, and regularly test or monitor the effectiveness of the safeguards’ key controls, systems, and procedures.

• Evaluate and adjust its information security program in light of the results of testing and monitoring, any material changes to its operations or business arrangements, or any other circumstances that Guess knows or has reason to know may have a material impact on its information security program. Part III of the proposed order requires that Guess obtain within one year, and on a biannual basis thereafter, an assessment and report from a qualified, objective, independent third-party professional, certifying that: (1) Guess has in place a security program that provides protections that meet or exceed the protections required by Part II of this order; and (2) Guess’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of consumer’s personal information has been protected. Parts IV through VII of the proposed order are reporting and compliance provisions. Part IV requires Guess's to retain documents relating to compliance. For most records, the order requires that the documents be retained for a five-year period. For the assessments and supporting documents, Guess must retain the documents for three years after the date that each assessment is prepared. Part V requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part VI ensures notification to the FTC of changes in corporate status. Part VII mandates that Guess submit compliance reports to the FTC. Part VIII is a provision "sunsetting" the order after twenty (20) years, with certain exceptions.

The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order or to modify their terms in any way.

VOLUME 136 Complaint