Petco Animal Supplies, Inc

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF PETCO ANIMAL SUPPLIES, INC.

CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4133; File No. 0323221 Complaint, March 4, 2005--Decision, March 4, 2005 This consent order, among other things, prohibits the respondent -- in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service -- from misrepresenting the extent to which it maintains and protects the security of any personal information collected from or about consumers. The order also requires the respondent to create a written security policy reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. In addition, the order requires the respondent, for twenty years, to secure biennial assessments and reports from a qualified, objective, and independent third-party professional certifying that the respondent has a security program in place that operates with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of consumers’ personal information has been protected.

Participants For the Commission: Alain Sheer, Joel Winston, Jessica L. Rich, and Louis Silversin..

For the Respondent: Peter H. Benzian, Latham & Watkins. COMPLAINT The Federal Trade Commission, having reason to believe that Petco Animal Supplies, Inc. (“respondent”) has violated the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Petco Animal Supplies, Inc. is a Delaware corporation with its principal office or place of business at 9125 Rehco Road, San Diego, California 29121. PETCO ANIMAL SUPPLIES, INC. 103 Complaint 2. Respondent sells pet food, supplies, and services through more than 636 stores in 43 states and the District of Columbia. It also sells pet food and supplies through its website at www.PETCO.com.

3. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. 4. Respondent has marketed and sold pet food and supplies to consumers online at www.PETCO.com since February 5, 2001. Most consumers who make purchases through www.PETCO.com pay using a credit card. To complete these purchases, consumers must provide personal information, including, but not limited to, name, address, and credit card number and expiration date. Respondent stores this information in particular locations (called “tables”) in a database that supports or connects to its website. Respondent also stores product information about pet food and supplies in a database that supports or connects to its website. 5. Visitors to www.PETCO.com communicate with the website using a software program called a “web application.” Respondent’s application was designed so that visitors could use it to: (1) obtain product information from certain database tables, and (2) supply respondent with transaction information, such as credit card numbers and expiration dates, that respondent then stored in other tables in a database. To facilitate communication between the website and a visitor, respondent’s application was designed to automatically present any information retrieved from or supplied to a database in clear readable text on the visitor’s web browser. 6. Since at least February 5, 2001, respondent has disseminated or caused to be disseminated privacy policies and representations on www.PETCO.com, including, but not necessarily limited to, the attached Exhibit A containing the following statements VOLUME 139 Complaint regarding the privacy and confidentiality of personal information collected through respondent’s website: Privacy Concerns and Issues Your information is secure At PETCO.com our customers’ data is strictly protected against any unauthorized access. PETCO.com also provides a “100% Safeguard Your Shopping Experience Guarantee” so you never have to worry about the safety of your credit card information.

Payment Options PETCO.com accepts the following credit cards: Visa, Mastercard, American Express, and Discover. PETCO.com also redeems PETCO.com online gift certificates and PETCO gift cards as payment for purchases made at PETCO.com. We are unable to accept checks or money orders at this time.

Entering your credit card number via our secure server is completely safe. The server encrypts all of your information; no one except you can access it. Is my personal information secure? At PETCO.com, protecting your information is our number one priority, and your personal data is strictly shielded from unauthorized access. Our “100% Safeguard Your Shopping Experience Guarantee” means you never have to worry about the safety of your credit card information. Exhibit A (Petco webpages dated June 21, 2003)(emphasis in original) 7. Since at least February 5, 2001, respondent’s website and application have been vulnerable to commonly known or PETCO ANIMAL SUPPLIES, INC. 105 Complaint reasonably foreseeable attacks from third parties attempting to obtain access to personal information about consumers stored in respondent’s database. These attacks include, but are not limited to, web application attacks such as “Structured Query Language” (or “SQL”) injection attacks. Such an attack occurs when an attacker enters certain characters in the address (or URL) bar of a standard web browser to direct an application to obtain information from a database that supports or connects to a website. By such an attack, respondent’s application can be manipulated to gain access, in clear readable text, to tables in databases that support or connect to www.PETCO.com, including tables containing credit card information supplied by consumers.

8. Respondent created these vulnerabilities by failing to implement reasonable and appropriate measures to secure and protect databases that support or connect to the website. Among other things, respondent failed to: adopt policies and procedures adequate to protect sensitive consumer information collected through the website; or implement simple, readily available defenses to prevent website visitors from gaining access to database tables containing sensitive personal information about other consumers.

9. The risk of such web application attacks is well known in the information technology industry, as are simple, easy to implement, and publicly available measures to prevent such attacks. Security experts have been warning the industry about these vulnerabilities since at least 1997; in 1998, at least one security organization developed, and made publicly available at no charge, a security measure that could prevent such attacks, and in 2000 the industry began receiving reports of successful attacks on web applications.

10. In June 2003, a visitor to www.PETCO.com conducted an SQL injection attack and was able to read in clear text credit card numbers stored in respondent’s database. VOLUME 139 Complaint 11. Through the means described in Paragraph 6, respondent represented, expressly or by implication, that the personal information it obtained from consumers through www.PETCO.com was maintained in an encrypted format and therefore was inaccessible to anyone other than the consumer providing the information.

12. In truth and in fact, the personal information respondent obtained from consumers through www.PETCO.com was not maintained in an encrypted format and was accessible to persons other than the consumer providing the information. Instead, Petco encrypted credit card information only while it was being transmitted between a visitor’s web browser and the website’s server; once the information reached the server, it was decrypted and maintained in clear readable text. Using a standard web browser, a visitor could (and did) use a commonly known attack to manipulate respondent’s web application and obtain access, in clear readable text, to sensitive personal information about other consumers, including, but not limited to, consumer names and credit card numbers and expiration dates. Therefore, the representation set forth in Paragraph 11 was false or misleading.

13. Through the means described in Paragraph 6, respondent represented, expressly or by implication, that it implemented reasonable and appropriate measures to protect personal information it obtained from consumers through www.PETCO.com against unauthorized access. 14. In truth and in fact, respondent did not implement reasonable and appropriate measures to protect personal information it obtained from consumers through www.PETCO.com against unauthorized access. In particular, respondent failed to implement procedures that were reasonable and appropriate to: (1) detect reasonably foreseeable application vulnerabilities, and (2) prevent visitors from exploiting such vulnerabilities and obtaining PETCO ANIMAL SUPPLIES, INC. 107 Complaint unauthorized access to sensitive consumer information. Therefore, the representation set forth in Paragraph 13 was false or misleading.

15. The acts and practices of respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this fourth day of March, 2005, has issued this complaint against respondent.

oe PETCO ANIMAL SUPPLIES, INC.

PETCO. com - Privacy Concerns and Issues Page 1 of 3 | GF sHOpeInG CART + Your ActouNT V1 SHOPPING LEST © LOCATE & Petes PY HELP yo @ SRERIALTY stores pea Ses? 7 @ ENS REEEER Free Newsletters: Pet Care E Emai | ‘Tips, Discounts & More! [Enter Email 1 Privacy Concerns and Issues Security _ ‘Privacy Policy Surveys, Contests, and Other Special Programs Cookies and How We Use Them Chaice/ Opt-Out Effective as of 07/25/02 Your information is secure — At PETCO.com our customers’ data is strictly protected against any unauthorized access. PETCO.com also provides a "100% Safeguard Your Shopping Experience Guarantee" so you never have to worry about the safety of your credit card information. . , VeriSion click to verify Protecting your order information is a priority. PETCO.com makes every effort to protect your online order information by using Secure Sockets Layer (SSL) technology. SSL encrypts your order information to avoid the decoding of that information by anyone other than PETCO.com. To check the security of your connection, look at the bottom of your browser window after accessing the server. If you see dn unbroken key or a closed Jock (depending upon your browser),- then SSL is ‘active. You can also double-check by looking, at the URL line of your browser, When accessing a secure server, the first characters of the site address will change from "yittp" to "https.” Some versions of browsers and some firewalls don't.permit communication through secure servers. In-these cases, you'll be unable to connect to the server, so you won't have to worry about mistakenly placing an order through an unsecured connection. PETCO also supports the Verified by Visa Security Service. Learn more about this feature... VISA learn more Hoye »back to top Privacy Policy .

At PETCO.com we are concerned with protecting your privacy. We use the information we collect about you to provide a personalized shopping experience. We may also use it to tell you about special offers that we think you'd appreciate. You'll never have to worry about receiving a barrage of unexpected e-mail from us If you have not subscribed with us. We will not sell, rent or trade your information. We occasionally have third party agents, subsidiaries, affiliates and joint ventures that perform functions on our behalf. They have access to personal information needed to perform their functions, and are contractuaily obligated to maintain the confidentiality and security of the data. They are restricted from using this data for other purposes, and in any way other than to provide the requested services to PETCO.com, and may not alter or reseii the data. You may elect to opt-out of personally identifiable site tracking activity by following the Optout link below. Keep in mind that PETCO.com may continue to collect anonymous aggregate site’ behavior from our customers. Opt-out.

We may occasionally have third party agents, subsidiaries, affiliates or joint ventures offer promotions on PETCO.com. You have the option to specifically opt-in to participate in the promotion and share your personal data with these parties and PETCO.com. These promotions may be in the form of a survey or a separate area offering you the opportunity to enter your data for the specific purpose of participating in that program or promotion. Data collected by these third-parties will be covered under the third-party's Privacy Policy f HELP PETCO.com Help Your Account Help Shopping Help Bottomiess Bowl & Mc - Help Shipping Help Promotion Cades Helr Community Help ~ Affiliates Frequently £ Questions — Privacy Help Copyright, Disclaimer Technology Repair Shopping Cart ». Problems Le ~ ETCO:com - Where the pets go online | os | Page 3 of 4 To complete your order, fax your order form to us, toll-free, at 1-888-409-4567: Please remember not to fax your order after plaqing it online, or your order will be duplicated. ; . wwe Payment Options .

PETCO.com accepts the following credit cards: Visa, Mastercard, American Express, and Discover. PETCO.com also redeems PETCO.com online gift certificates and PETCO gift cards as payment for purchases made at PETCO.com. We are.unable to accept checks or money orders at this time. wo : a Entering your credit card number via. our secure server is completely safe. The server encrypts all of your information; no one except you can access it. (If you'd prefer, you are also welcome to place your order | entirely by fax.) . : ;

Sales Tax . "y. oo -Please Note: taxes apply for recipients in ail states EXCEPT HI, NC, OK, WV; WY, AK, DE, MT, NH, OR. ‘ Pricing Errors and Omissions .

Please be aware that prices and availability are subject to change without prior notice. We make every effort to insure the accuracy of the information on our site and when errors are discovered, we will correct them. Be advised that PETCO reserves the right to revoke any stated offer and to correct any errors, inaccuracies, or omissions including after an order has been submitted, after it has been confirmed, or after your credit card. has been charged. If we discover a pricing error after your credit card has been. charged and and your order is canceled as a result of the error, your credit card will be refunded back the full amount of your order. You will be notified via email if your order has been canceled and be given the opportunity to place the order at the correct price. Please note that individual bank policies vary when the amount is credited back to your account. Return Policy Our return policy is simple:

1. Contact PETCO at [email protected] or call 877-738-6742, indicating your name,. order. number. and reason for return. ; : .

2. All returns should be complete and placed in their original packaging. . 3. Attach the "Return Mailing Label" located on the front of the packing slip to ycur carton, and send the item(s). along with your packing slip back to PETCO.com for your refund. If your Return Mailing Label is missing, send the package to: Petco.com Returns (Your Order #) 3801 Rock Creek Road Joliet, IL 60431 If you choose to return an item because you or your pet decide it is not what you want, we'll refund the price of the item plus the applicable sales tax, but we will not refund the shipping charges to and from PETCO.com. If your purchase is defective or in error, we'll refund ail charges, including shipping. Your return will be processed at PETCO.com, and a refund will be issued at that time. . For your protection, return your item using a carrier who offers Package tracking such as UPS or Federal Express. , We will issue a refund to your credit card and notify you via email 24 hours after our warehouse has received your item. , :

If you return product purchased from PETCO.com that was bought using a Gift Card, the refund amount will be first credited back to the credit card used for the transaction, and any additional refund amount will be credited via a PETCO.com email gift certificate (we are currently unable to refund back to PETCO Gift Cards online).

At this time, we are unable to process online order returns in PETCO stores. Requesting Products ;

If you'd like to suggest that we carry a particular product at PETCO.com, please email your suggestion to [email protected] or phone us at 1-877-738-6742, Were PETCO ANIMAL SUPPLIES, INC.

wy tsetse ETCO. com - Where the pets go online address is a house or an apartment and whether deliveries can be left outdoors. FedEx, UPS or USPS policies for your area may dictate that your package be held at a iocal office until you pick it up in person. Call yper local FedEx, UPS or post office directly to learn the delivery policy for your area. my Do you offer Gift Certifi cates? Yes. You can send a pet (and pet lover) in your life an email gift certificate valid on PETCO. com. This allows you to customize a message and choose an amount of $5, $10, $15, $20, $25, $50, $75, or $100. These email gift certificates are sent on the day you specify too! Please note that these are valid only on PETCO.COM but we also sell PETCO Gift Cards which can be redeemed either online or in our stores. _ More information or to purchase either a PETCO.com or a PETCO Store Gift Certificate, Do you offer Gift Cards? . .

Yes. You can purchase or redeem gift cards on PETCO.com of in our stores. Yqu can also easily check your gift card balance, At checkout you will be able to enter up to four PETCO gift cards and they will be applied to your balance due. ;

‘ More information on Gift Cards. © Is my personal information secure? At PETCO.com, protecting your information is our number one priority, and your personal data Is. strictly shielded from unauthorized access. Our "100% Safeguard Your Shopping Experience Guarantee” means you never have to worry about the safety of your credit card information. We protect your online order information using the latest in Secure Sockets Layer (SSL) technology. SSL encrypts your order information to prevent the decoding of that information by anyone other than PETCO.com. To check the security of your connection, look at the bottom of your browser window after accessing the server. If you see an unbroken key or a closed lock (depending upon your browser), then SSL is active. You can also doubie-check by looking at the URL line of your browser. When accessing a secure server, the first characters of the site address will change from "http" to "https." . Some versions of browsers and some firewalls don’t permit. communication through secure servers. In these cases, you'll be unable to connect to the server, so you won't have to worry about mistakenly placing an order through an unsecured connection.

What's your privacy policy? At PETCO.com, protecting your privacy is a priority. We use the information we collect about you-to process orders and to provide a personalized shopping experience. We may also use it to tell you about special offers we think you'd appreciate. When you register with PETCO.com, we ask for some contact information, such as your name and email address. We will use the contact information from the registration form to send you information about our company and promotional material from some of our partners. . Click on "Your Account" at the top right corner of any page. Log in, using your email address and password. Under "In This Section", click on the "Update Your Newsletter Subscriptions" link. Follow the instructions you see. when you arrive at the “Newsletters” page. You can easily subscribe, to or unsubscribe from multiple newsletters. aeNe Once you've completed these steps, you will no longer receive special offers or promotions from PETCO.com. »Home - »Locate a PETCO ~ » Privacy & Security » Shopping Cart »Help »PETCO P.A.L.S. »>PETCO Foundation »Site Map » Contact Us ” »Bottomless Bowl » Donations » Message Boards »Jobs » Affiliate Program ~ »Tips & Talk » Articles »Qur Stores » About PETCO » What's Hot ©2003, PETCO Animal Supplies, Inc. All rights reserved. PETCO.com is a trademark of PETCO Animal Supplies, Inc. Page 5 of 5 ' » Specialty Stores __» Gift Cards & Certificates >» E-cards »Online Specials VOLUME 139 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the Respondent named in the caption hereof, and the Respondent having been furnished thereafter with a copy of a draft Complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the Respondent with violation of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq; The Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by the Respondent of all the jurisdictional facts set forth in the aforesaid draft Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by Respondent that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission's Rules; and The Commission having thereafter considered the matter and having determined that it has reason to believe that the Respondent has violated the said Act, and that a Complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days, and having duly considered the comments filed thereafter by interested persons pursuant to Section 2.34 of its Rules, now in further conformity with the procedure described in Section 2.34 of its Rules, the Commission hereby issues its Complaint, makes the following jurisdictional findings and enters the following Order: 1. Respondent Petco Animal Supplies, Inc. is a Delaware corporation with its principal office or place of business at 9125 Rehco Road, San Diego, California 92121. PETCO ANIMAL SUPPLIES, INC. 113 Decision and Order 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions shall apply:

1. “Personal information” shall mean individually identifiable information from or about an individual consumer including, but not limited to: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name that reveals an individual’s email address; (d) a telephone number; (e) a Social Security number; (f) credit and/or debit card information, including credit and/or debit card number and expiration date; (g) a persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual consumer; or (h) any other information from or about an individual consumer that is combined with (a) through (g) above.

2. Unless otherwise specified, “respondent” shall mean Petco Animal Supplies, Inc. and its successors and assigns, officers, agents, representatives, and employees.

3. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, VOLUME 139 Decision and Order shall not misrepresent in any manner, expressly or by implication, the extent to which respondent maintains and protects the privacy, confidentiality, security, or integrity of any personal information collected from or about consumers.

II.

IT IS FURTHER ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the online advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall, no later than the date of service of this order, establish and implement, and thereafter maintain, a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. Such program, the content and implementation of which must be fully documented in writing, shall contain administrative, technical, and physical safeguards appropriate to respondent’s size and complexity, the nature and scope of respondent’s activities, and the sensitivity of the personal information collected from or about consumers, including:

A. the designation of an employee or employees to coordinate and be accountable for the information security program.

B. the identification of material internal and external risks to the security, confidentiality, and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assessment of the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include consideration of risks in each area of relevant operation, including, but not limited to: (1) employee training and management; (2) information systems, including network and software design, information processing, storage, transmission, and disposal; PETCO ANIMAL SUPPLIES, INC. 115 Decision and Order and (3) prevention, detection, and response to attacks, intrusions, or other systems failures.

C. the design and implementation of reasonable safeguards to control the risks identified through risk assessment, and regular testing or monitoring of the effectiveness of the safeguards’ key controls, systems, and procedures. D. the evaluation and adjustment of respondent’s information security program in light of the results of the testing and monitoring required by subparagraph C, any material changes to respondent’s operations or business arrangements, or any other circumstances that respondent knows or has reason to know may have a material impact on the effectiveness of its information security program. III.

IT IS FURTHER ORDERED that respondent obtain an assessment and report (an “Assessment”) from a qualified, objective, independent third-party professional, using procedures and standards generally accepted in the profession, within one hundred and eighty (180) days after service of the order, and biennially thereafter for twenty (20) years after service of the order that:

A. sets forth the specific administrative, technical, and physical safeguards that respondent has implemented and maintained during the reporting period;

B. explains how such safeguards are appropriate to respondent’s size and complexity, the nature and scope of respondent’s activities, and the sensitivity of the personal information collected from or about consumers; C. explains how the safeguards that have been implemented meet or exceed the protections required by Paragraph II of this order; and VOLUME 139 Decision and Order D. certifies that respondent’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of personal information is protected and, for biennial reports, has so operated throughout the reporting period. Each Assessment shall be prepared by a person qualified as a Certified Information System Security Professional (CISSP) or as a Certified Information Systems Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the SysAdmin, Audit, Network, Security (SANS) Institute; or a qualified person or organization approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission.

Respondent shall provide the first Assessment, as well as all: plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, whether prepared by or on behalf of respondent, relied upon to prepare such Assessment to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580, within ten (10) days after the Assessment has been prepared. All subsequent biennial Assessments shall be retained by respondent until the order is terminated and provided to the Associate Director of Enforcement within ten (10) days of request. IV.

IT IS FURTHER ORDERED that respondent shall maintain, and upon request make available to the Federal Trade Commission for inspection and copying, a print or electronic copy of each document relating to compliance, including but not limited to:

A. for a period of five (5) years:

1. a sample copy of each different print, broadcast, cable, or Internet advertisement, promotion, information collection PETCO ANIMAL SUPPLIES, INC. 117 Decision and Order form, Web page, screen, email message, or other document containing any representation regarding respondent’s online collection, use, and security of personal information from or about consumers. Each Web page copy shall be dated and contain the full URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting the information on the Web. Provided, however, that after creation of any Web page or screen in compliance with this order, respondent shall not be required to retain a print or electronic copy of: (1) any amended Web page or screen to the extent that the amendment does not affect respondent’s compliance obligations under this order; or (2) any Web page or screen that contains a hypertext link to respondent’s privacy policy, but otherwise does not relate to respondent’s compliance obligations under this order. 2. any documents, whether prepared by or on behalf of respondent, that contradict, qualify, or call into question respondent’s compliance with this order; and B. for a period of three (3) years after the date of preparation of each biennial Assessment required under Paragraph III of this order: all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, whether prepared by or on behalf of respondent, relating to respondent’s compliance with Paragraphs II and III of this order for the compliance period covered by such biennial Assessment.

V.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having managerial responsibilities relating to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days VOLUME 139 Decision and Order after service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities.

VI.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in either corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondent learns less than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Paragraph shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VII.

IT IS FURTHER ORDERED that respondent shall, within one hundred and eighty (180) days after service of this order, and at such other times as the Commission may require, file with the Commission an initial report, in writing, setting forth in detail the manner and form in which it has complied with this order. VIII.

This order will terminate on March 4, 2025, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any PETCO ANIMAL SUPPLIES, INC. 119 Decision and Order violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. any Paragraph in this order that terminates in less than twenty (20) years;

B. this order’s application to any respondent that is not named as a defendant in such complaint; and C. this order if such complaint is filed after the order has terminated pursuant to this Paragraph.

Provided, further, that if such complaint is dismissed or a federal court rules that respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Paragraph as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. VOLUME 139 Analysis Analysis of Proposed Consent Order to Aid Public Comment The Federal Trade Commission has accepted, subject to final approval, a consent agreement from Petco Animal Supplies, Inc. (“Petco”).

The consent agreement has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. Petco is a national retailer that sells pet food, pet supplies, and pet services from over 600 stores throughout the United States. It also sells pet food and supplies through its online store at www.PETCO.com. This matter concerns alleged false or misleading representations Petco made to consumers about the security of personal information collected through its online store. The Commission’s proposed complaint alleges that Petco represented that personal information it obtained from consumers through www.PETCO.com was stored in an encrypted format and therefore was not accessible to anyone except the consumer that provided the information. The complaint alleges this representation was false because a commonly known attack on its website could and was used to gain access in clear readable text to personal information, including credit card numbers and expiration dates, that Petco obtained from consumers. The proposed complaint also alleges that Petco represented that it implemented reasonable and appropriate measures to protect the personal information it obtained through the website against unauthorized access. The complaint alleges this representation was false because Petco did not implement reasonable and appropriate measures to detect common vulnerabilities and prevent them from being exploited.

PETCO ANIMAL SUPPLIES, INC. 121 Analysis The proposed order applies to Petco’s collection and storage of personal information from or about consumers in connection with its online business. It contains provisions designed to prevent Petco from engaging in the future in practices similar to those alleged in the complaint.

Specifically, Part I of the proposed order prohibits Petco, in connection with online advertising, marketing, promotion, offering for sale, or sale of any product or service, from misrepresenting the extent to which it maintains and protects the security, confidentiality, or integrity of any personal information collected from or about consumers.

Part II of the proposed order requires Petco to establish and maintain a comprehensive information security program in writing that is reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. The security program must contain administrative, technical, and physical safeguards appropriate to Petco’s size and complexity, the nature and scope of its activities, and the sensitivity of the personal information collected from or about consumers. Specifically, the order requires Petco to: • Designate an employee or employees to coordinate and be accountable for the information security program. • Identify material internal and external risks to the security, confidentiality, and integrity of consumer information that could result in unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, this risk assessment should include consideration of the risks in each area of relevant operation.

• Design and implement reasonable safeguards to control the risks identified through risk assessment, and regularly test or monitor the effectiveness of the safeguards’ key controls, systems, and procedures.

VOLUME 139 Analysis • Evaluate and adjust its information security program in light of the results of testing and monitoring, any material changes to its operations or business arrangements, or any other circumstances that Petco knows or has to reason to know may have a material impact on the effectiveness of its information security program.

Part III of the proposed order requires that Petco obtain within 180 days after being served with the final order approved by the Commission, and on a biennial basis thereafter, an assessment and report from a qualified, objective, independent third-party professional, certifying, among other things, that: (1) Petco has in place a security program that provides protections that meet or exceed the protections required by Part II of the proposed order, and (2) Petco’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of consumers’ personal information has been protected.

Parts IV through VII of the proposed order are reporting and compliance provisions. Part IV requires Petco to retain documents relating to compliance. It requires Petco to retain most documents for a five-year period; assessments and supporting documents, however, must be retained for three years after the date when each assessment is prepared. Part V requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the proposed order. Part VI requires Petco to notify the Commission of changes in Petco’s corporate status. Part VII mandates that Petco submit compliance reports to the FTC. Part VIII is a provision “sunsetting” the order after twenty (20 ) years, with certain exceptions.

The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order to modify its terms in any way.

CEMEX S.A. DE C.V. 123 Complaint