Sears Holdings Management Corporation

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF SEARS HOLDINGS MANAGEMENT CORPORATION Docket No. C-4264. Order, February 27, 2018 Order granting respondent’s petition to reopen and modify the Order by changing the definition of “Tracking Application” to exclude software applications that only engage in consumer-expected types of tracking. ORDER REOPENING AND MODIFYING ORDER On October 31, 2017, Sears Holdings Management Corporation (“Sears”) filed a petition pursuant to Section 5(b) of the Federal Trade Commission Act, 15 U.S.C. § 45(b), and Section 2.51 of the Commission’s Rules of Practice, 16 C.F.R. § 2.51, asking the Commission to reopen and modify the Order in Docket No. C-4264 (“Order”), issued by the Commission on August 31, 2009.

The Order requires Sears, among other things, to provide clear and prominent notice of the types of information it collects through any tracking software it distributes—defined as a “Tracking Application”—and get consumers’ express consent before they download or install the software. In its petition, Sears requests that the Commission modify the definition of Tracking Application as it relates to Sears’s mobile applications. Sears bases its petition on changed conditions of fact that it claims are sufficient to warrant reopening and modifying the Order. Sears asserts that neither it nor the Commission staff who negotiated the Order could have anticipated the tremendous growth of mobile applications, the consolidation in that market to very few platforms, or the importance to retailers such as Sears of being able to interact with customers through mobile applications. Sears argues that these changes have made the Order obsolete because of the significant control the platforms exercise over privacy and disclosures for mobile applications. Sears also argues that modifying the Order would be in the public interest because the current Order puts Sears at a competitive disadvantage in the mobile application market. Sears further contends that the SEARS HOLDINGS MANAGEMENT CORPORATION 1417 Interlocutory Orders, Etc.

Order’s disclosure requirements are not in consumers’ interest where the data collection by a mobile application is expected and benefits the application’s function.

Sears requests that the Commission modify the definition of “Tracking Application” to exclude software applications that only engage in consumer-expected types of tracking. For the reasons stated below, the Commission has determined to grant the petition.

Background On August 31, 2009, the Commission approved a final Complaint and Decision and Order against Sears. The Complaint states that, as part of a “MySHC Community” market research program, Sears offered $10 to consumers to install a software application on their desktop personal computers. The Complaint alleges that Sears deceptively failed to disclose the full extent of the software’s data collection. According to the Complaint, although Sears stated only that the software would track consumers’ “online browsing,” it in fact tracked nearly all internet activity on consumers’ computers; monitored their activity in online secure sessions with other websites; and collected sensitive personal information from those sessions. Part I of the Order requires Sears to provide clear and prominent notice to consumers of the full collection practices of any “Tracking Application” it offers, and obtain consumers’ express consent to that data collection before they download or install the software. “Tracking Application” includes any software “capable of installation on consumers’ computers” that is used to “monitor, record, or transmit information about activities occurring on computers on which it is installed, or about data that is stored on, created on, transmitted from, or transmitted to the computers on which it is installed.” The definition of “computers” encompasses mobile devices.

Parts II and III of the Order provide remediation to the consumers that downloaded Sears’s software before the Complaint. Part II requires Sears to notify consumers who downloaded any Tracking Application (including the MySHC VOLUME 165 Interlocutory Orders, Etc.

Community software) of the full extent of its tracking and collection, and provide them with instructions on how to uninstall it. Part III requires Sears to cease collecting any information through any Tracking Applications installed by consumers prior to service of the Order, and to delete any information Sears had previously collected through such software. The remaining Parts contain standard recordkeeping and reporting provisions. Standard to Reopen and Modify Section 5(b) of the Federal Trade Commission Act, 15 U.S.C. § 45(b), provides that the Commission shall reopen an order to consider whether it should be modified if the respondent “makes a satisfactory showing that changed conditions of law or fact” so require.1 A satisfactory showing sufficient to require reopening is made when a request to reopen identifies significant changes in law or fact and shows that the changes either eliminate the need for the order or make continued application of it inequitable or harmful to competition.2 Section 5(b) also provides that the Commission may reopen and modify an order when, although changed circumstances would not require reopening, the Commission determines that the public interest so requires. If, after determining that the requester has made the required showing, the Commission decides to reopen the order, the Commission will then consider and balance all of the reasons for and against modification. In no instance does a decision to reopen an order oblige the Commission to modify it,3 and the burden remains on the requester in all cases to demonstrate why the order 1 See Supplementary Information, Amendment to 16 CFR § 2.51(b), announced August 15, 2000 (“Amendment”), 65 Fed. Reg. 50636 (Aug. 21, 2000). 2 S. Rep. No. 96-500, 96th Cong., 2d Sess. 9 (1979) (significant changes or changes causing unfair disadvantage); Order Reopening and Modifying Order 3, Toys “R” Us Inc., Docket No. 9278 (FTC Apr. 11, 2014), https://www.ftc.gov/system/files/documents/cases/140415 toysrusorder.pdf. See also United States v. Louisiana-Pacific Corp., 967 F.2d 1372, 1376-77 (9th Cir. 1992) (holding that, even after reopening, FTC is not required to make requested modification unless changed circumstances compel it). 3 United States v. Louisiana-Pacific Corp., 967 F.2d 1372, 1376-77 (9th Cir. 1992) (reopening and modification are independent determinations). SEARS HOLDINGS MANAGEMENT CORPORATION 1419 Interlocutory Orders, Etc.

should be reopened and modified. The petitioner’s burden is not a light one in view of the public interest in repose and the finality of Commission orders.4 All information and material that the requester wishes the Commission to consider shall be contained in the request at the time of filing.5 Changed Conditions of Fact Justify Reopening the Order The Commission has determined that changed conditions of fact require that the Order be reopened.6 The Commission finds that, although the Order’s terms and definitions apply to mobile applications, neither the Commission nor Sears anticipated the changes to the mobile application marketplace that would occur in the years since the Order was issued. At the time the Order was issued in 2009, the Android and Apple ios app stores had both launched a year before. And the mobile application market was just beginning a transition from being dominated by primarily simple or novelty mobile applications to an ecosystem that businesses across the board would leverage. The Commission finds that, at the time, companies like Sears were focused on creating mobile-optimized versions of their websites. The Commission further finds that the changes in the mobile marketplace since the Order have made it critical for retailers like Sears to be able to distribute interactive mobile applications. Today’s mobile applications typically require the collection and transmission of many different types of data to support the services and features for which consumers have downloaded them, as Sears argues, and the Commission agrees that consumers expect this type of data collection.

4 See Federated Department Stores, Inc. v. Moitie, 452 U.S. 394, 401 (1981) (strong public interest considerations support repose and finality). 5 16 C.F.R. § 2.51(b).

6 Sears has asserted both changed conditions of fact and public interest grounds in support of its petition. Because the Commission has determined that Sears has demonstrated that changed conditions of fact support reopening, the Commission need not consider whether the public interest also justifies reopening the Order.

VOLUME 165 Interlocutory Orders, Etc.

Sears has demonstrated that these changed conditions make application of the current Order unnecessary as it relates to Sears’s suite of mobile applications. The Order’s mandated disclosures are intended to place notice and consent obligations on Tracking Applications such as the MySHC Community software, which engaged in broad and unexpected monitoring of consumers’ activity across the internet, or similar software. Significantly, the Order does not require heightened notice and consent for first-party tracking on Sears’s websites through technologies such as cookies, which were common and expected at the time the Order was entered. However, there is no comparable exception in the Order for the same type of data collection when carried out by a mobile application. Thus, the heightened notice and consent requirements apply even to the most mundane mobile application engaged in first-party tracking only. For example, the Order requires prominent disclosures and express consent for an application that remembers the items a user places in the shopping cart when shopping within the application, or an application that collects the consumer’s address when a consumer enters it in order to have a purchase shipped. In the context of mobile applications that engage in the types of information collection that consumers expect, the Commission believes that the notice and consent requirements contemplated by the Order are burdensome and counterproductive, for both consumers and Sears.

From the consumer point of view, for the limited types of data collection that Sears proposes to exclude from the Order, the disclosure and consent requirements are counterproductive because they are unnecessary. Since issuing the Order, the Commission has recognized that some data collection is likely intrinsic to many internet-related business practices, and has advocated that companies provide consumers with choices about data collection and usage only when those practices are not consistent with the consumer’s relationship with the company.7 7 See FTC Report, Protecting Consumer Privacy in an Era of Rapid Change 36-44 (Mar. 2012), https://www ftc.gov/sites/default/files/documents/reports /federal-trade-commission-report-protecting-consumer-privacy-era-rapidchange-recommendations/120326privacyreport.pdf (“2012 Privacy Report”) SEARS HOLDINGS MANAGEMENT CORPORATION 1421 Interlocutory Orders, Etc.

Likewise, the Commission has pushed for affirmative express consent—like that which the Order requires for software that collects any data—only for the collection and use of sensitive information.8 Under that framework, a mobile application that collects only data consistent with the context of consumers’ interactions—for which the Commission has said no disclosure or choice are required—is not benefiting consumers by providing the Ordermandated disclosure and affirmative, express consent.9 And it may be confusing to some consumers. Some consumers may view Sears’s very prominent disclosure and consent requirement as a positive indication of Sears’s transparency. But others may take the request for express consent, in particular, as a signal that the types of data collected by Sears apps are unusual, or are used or shared in unusual ways or for unusual purposes that the consumer may not want or expect.10 As to Sears, the Commission credits that having to provide heightened disclosures and seek consumers’ affirmative express consent for any and all information collection through a mobile application—when competitors need not do so—is disruptive to the initial application install flow, without providing a corresponding benefit to consumers.11 The Commission concludes that these changed conditions of fact justify reopening the Order.

(indicating that data collection and use consistent with consumers’ interaction with a first party may not require notice and choice). 8 See id. at 47-48, 58-60. The Commission also recognized the need for affirmative express consent when companies make material retroactive changes to privacy representations. Id. at 57- 58. 9 See id. at 38-39 (noting that the benefits of providing choice are reduced for data collection consistent with the context of a company’s interaction with consumers).

10 See Petition at 11.

11 See Petition at 15-18.

VOLUME 165 Interlocutory Orders, Etc.

Comments on Reopening In making this determination, the Commission has considered the fact that many of the twelve public comments filed in this proceeding oppose reopening the Order. The comments raise two areas of concern related to reopening. First, two comments argue that Sears has not made a satisfactory showing that changed circumstances warrant reopening. The World Privacy Forum argues that Sears failed to provide sufficient evidence that the Order-mandated disclosures caused it to lose customers. However, the Commission does not agree that such evidence is necessarily required to find that changed circumstances justify reopening: As noted above, we credit Sears’s argument that the heightened disclosure and consent requirement is unnecessary for the particular types of collection Sears proposes to be excluded from the Order, and in some cases even disruptive to consumers onboarding its mobile applications.12 Indeed, on the policy front, the Commission has moved since the Order toward less disclosure for expected information collection, not heightened requirements.13 Similarly, commenter Chris Hoofnagle argues that Sears has not met the standard because mobile applications behave fundamentally the same as they did at the time the Order was issued. But Sears’s argument, and the Commission’s finding, is not based on changes to the capabilities of mobile applications. It is based on changes in the mobile marketplace that have made it much more important for retailers to be able to provide mobile applications to interact with their customers, including applications that collect information in order to provide consumers with features.

Second, several commenters raise general concerns about data collection by Sears or businesses in general. Some of these comments also stress the importance of transparency and clarity in companies’ disclosures. The Commission understands the commenters’ concerns about maintaining the Order’s strong 12 See id.; Affidavit ¶¶ 9-12.

13 See 2012 Privacy Report at 36-44.

SEARS HOLDINGS MANAGEMENT CORPORATION 1423 Interlocutory Orders, Etc.

protections for consumer privacy. It agrees that the Order should continue to require heightened disclosure and consent requirements for broad, unexpected information collection, whether through personal computer software or mobile applications. Indeed, if Sears distributes software that monitors consumers’ activities across mobile applications, the modified Order would still require Sears to provide a clear and prominent notice and obtain consumers’ express consent. However, the limited modifications to the Order described in the following section will continue to fulfill the goal of maintaining strong protections for privacy, without unduly burdening consumers or Sears.

The Order Should Be Modified After considering and balancing all of the reasons for and against modification, the Commission has determined that the Order should be modified to alter the definition of “Tracking Application.” Sears proposes the Commission add an exception to the definition. The modified definition would exclude from the heightened notice and consent requirements any software that tracks only “(a) the configuration of the software program or application itself; (b) information regarding whether the software program or application is functioning as represented; or (c) information regarding consumers’ use of the program or application itself.” The Commission finds that Sears’s proposed modification is an effective means of addressing the changed conditions of fact discussed above.

Sears’s proposed exception to the “Tracking Application” definition would make it very similar to comparable definitions in subsequent, similar FTC orders against Compete, Inc. and Upromise, Inc.14 These matters also involved software that allegedly deceptively collected information about consumers’ 14 See Decision and Order 3, Compete, Inc., FTC Docket No. C-4384 (Feb. 20, 2013) (definition of “Data Collection Agent”), https://www ftc.gov/sites/ default/files/documents/cases/2013/02/130222competedo.pdf; Decision and Order 3-4, Upromise, Inc., FTC Docket No. C-4351 (Mar. 27, 2012) (definition of “Targeting Tool”), https://www.ftc.gov/sites/default/files/documents/cases/ 2012/04/120403upromisedo.pdf.

VOLUME 165 Interlocutory Orders, Etc.

online activity. Similar to the complaint against Sears, the Commission alleged that Compete and Upromise each represented that their browser toolbars would collect basic information about consumers’ internet browsing, but failed to disclose that their toolbars would in fact comprehensively track users’ online behavior.15 The exceptions in those orders, like the one that Sears proposes, exclude software that conducts types of data collection that consumers would expect.16 Comments on Proposed Modification Two of the comments received by the Commission provide input on the proposed modification. Although these commenters do not broadly oppose the first two exceptions from the notice and consent requirements, which would allow Sears to use tracking software for configuration and testing purposes,17 they do oppose the third exception, which would allow Sears to track “information regarding consumers’ use of the program or application itself.” Generally, the objections fall into three categories.

15 The Compete, Inc. complaint alleges that the company represented that its Toolbar would collect “aspects of [consumers’] browsing behavior” and “the addresses of the web pages you visit online.” Complaint at 2-3, Compete, Inc., FTC Docket No. C-4384 (Feb. 20, 2013), https://www ftc.gov/sites/default /files/documents/cases/2013/02/130222competecmpt.pdf. Similarly, the Upromise, Inc. complaint alleges that the company represented that its Toolbar collected “information about the web sites you visit.” Complaint 2-3, Upromise, Inc., FTC Docket No. C-4351 (Mar. 27, 2012), https://www.ftc.gov/sites/default/files/documents/cases/2012/04/120403upromi secmpt.pdf. But in both cases, the companies allegedly collected extensive information from the websites consumers visited, including information from secure sessions on third-party websites. 16 See Note 14, supra.

17 The World Privacy Forum expresses concern in its comment that the first two exceptions could enable technologies such as browser fingerprinting, or presumably, in the context of mobile applications, device fingerprinting. Comment of World Privacy Forum at 4. The Commission does not agree that identifying a consumer’s device through fingerprinting relates to the application’s configuration or functionality, and thus does not agree that fingerprinting is excepted under one of the first two exceptions. SEARS HOLDINGS MANAGEMENT CORPORATION 1425 Interlocutory Orders, Etc.

First, Consumers Union, Consumer Federation of America, and the Center for Digital Democracy argue in their joint comment that the proposed exception would allow for a greater degree of information collection than prior FTC orders.18 For example, they argue that the recent FTC order against Vizio, Inc. does not contain any exceptions to the notice and consent requirements. But the Vizio order applies only to the narrow category of “Viewing Data.”19 The Sears Order, by contrast, applies to a broad scope of information: “information about activities occurring on computers on which [a tracking application] is installed, or about data that is stored on, created on, transmitted from, or transmitted to the computers on which [the tracking application] is installed.” Because the Vizio order applies only to a narrow category of information, unlike Sears, an exception was not necessary.

Likewise, Consumers Union et al. assert that an analogous exception in the Upromise, Inc. order is narrower than the one proposed by Sears.20 Accordingly, the commenter recommends that the Commission add a further limitation to the third exception modeled on Upromise, restricting the third exception to instances when “the data collection is reasonably expected and necessary 18 Comment of Consumers Union, Consumer Federation of America, and the Center for Digital Democracy at 7-11.

19 See Stipulated Order for Perm. Inj. and Monetary J. 3-4, FTC v. Vizio, Inc., No. 2:17-cv-00758 (D.N.J. Feb. 6, 2017), https://www.ftc.gov/system/files/ documents/cases/170206 vizio stipulated proposed order.pdf. 20 Comment of Consumers Union et al. at 10. The Commission disagrees that the exception proposed by Sears is broader than the analogous Upromise exception. Both limit the collection of data to that which stems from the purpose for which the consumer uses the application. In Upromise, the exception encompassed data collection across multiple sources of potential consumer data—“respondent’s websites, services, applications, and/or forms”—provided the collection stem from provision of “reward service benefits.” Decision and Order 3-4, Upromise, Inc., FTC Docket No. C-4351 (Mar. 27, 2012) (definition of “Targeting Tool”), https://www.ftc.gov/sites/ default/files/documents/cases/2012/04/120403upromisedo.pdf. Whereas Sears’s proposed exception is limited to data collection regarding only one source: the consumer’s use of the data-collecting application itself. In both cases, the exceptions are tailored to ensure that only expected types of data collection are excluded from the order.

VOLUME 165 Interlocutory Orders, Etc.

for the software to perform the function or service that the consumer requests, and that information is only collected, retained, or used as is necessary for those purposes.”21 The Commission believes that, here, such a limitation would restrict Sears from providing valuable product offerings without a commensurate benefit to consumers. If Sears could only satisfy the exception when collecting data for functions a consumer requests, Sears would be unable to provide some anticipatory services to consumers—like making product recommendations based on a consumer’s past shopping within the application— without providing notice and obtaining express consent. The Commission believes that Sears’s proposed exception better aligns with consumers’ expectations by requiring the data collection to stem from a consumer’s “use” of the application, rather than only functions a consumer requests. Second, the World Privacy Forum and Consumers Union et al. argue in their comments that the exception may allow Sears to engage in unexpected methods of tracking or data collection in mobile applications, such as keystroke logging, third-party tracking, collection of information outside of an application, or collection of information through links contained in an application.22 The Commission does not believe that the proposed exception would allow any of these activities. The exception is limited to the consumer’s “use” of the program or application itself, and would not allow for the type of passive tracking, crossapplication tracking, or third- party tracking contemplated by the commenters. In order for the exception to apply, any information a Sears application accesses or collects must relate to some functionality the application is providing to the consumer in performing a service the consumer expects. Third, Consumers Union et al. argues that the proposed exception might enable Sears to evade the mobile operating systems’ built-in notice and consent system (permissions) when accessing device data like geolocation.23 The Commission does 21 Comment of Consumers Union et al. at 13. 22 See id. at 7, 12; Comment of World Privacy Forum at 4. 23 Comment of Consumers Union et al. at 12. SEARS HOLDINGS MANAGEMENT CORPORATION 1427 Interlocutory Orders, Etc.

not see how this could occur. The Order cannot provide a technical means for Sears to get around the mobile operating systems’ controls, and it does not impose conditions on the operating system developers.

Finally, the World Privacy Forum advises that the Commission should not rely on the mobile application platforms to protect consumers, as Sears suggests they do. The Commission does not rely on this argument, however, and does not believe the proposed exception rests on the existence of those controls. Instead of excluding all mobile applications from the Order, the proposed modification draws a distinction between software that tracks information that consumers would expect and software that engages in unexpected tracking—like the MySHC Community software—and thus warrants increased transparency. The modified Order’s disclosure and consent requirement would still apply to the latter, including mobile applications.24 Considering all the reasons for and against the modification, the Commission concludes that Sears’s proposed modification is the best means to address the changed conditions of fact discussed above.

Conclusion For the reasons explained above, the Commission has determined to reopen and modify the Order. Accordingly, IT IS ORDERED that this matter be, and it hereby is, reopened; and IT IS FURTHER ORDERED that the definition of “Tracking Application” be, and it hereby is, revised to read: 24 Commenter Chris Hoofnagle appears to express concern about modifying the Order to exclude mobile applications completely. The Commission agrees with this concern, but believes the proposed modifications are a technology-neutral way to ensure that the Order’s requirements apply similarly to websites and mobile applications. The modified Order would still apply to mobile applications that tracked consumers in unexpected ways. VOLUME 165 Interlocutory Orders, Etc.

4. “Tracking Application” shall mean any software program or application disseminated by or on behalf of respondent, its subsidiaries or affiliated companies, that is capable of being installed on consumers’ computers and used by or on behalf of respondent to monitor, record, or transmit information about activities occurring on computers on which it is installed, or about data that is stored on, created on, transmitted from, or transmitted to the computers on which it is installed, unless the information monitored, recorded, or transmitted is limited solely to the following: (a) the configuration of the software program or application itself; (b) information regarding whether the software program or application is functioning as represented; or (c) information regarding consumers’ use of the program or application itself.

By the Commission.

LOUISIANA REAL ESTATE APPRAISERS BOARD 1429 Interlocutory Orders, Etc.