On October 22, 2013, the Federal Trade Commission (FTC) announced a proposed settlement of a case against Aaron’s, Inc., a national rent-to-own retailer with more than 1,800 locations in 48 states, having alleged that Aaron’s knowingly played a direct and vital role in its franchisees’ installation and use of software on rental computers that secretly monitored consumers.

The FTC alleged, among other things, that the software used by Aaron’s franchisees¹ was used on rented computers to surreptitiously track consumers’ locations, use computers’ webcams to take photographs of consumers inside their homes, take screen shots of computer users’ activities on the computers, use false registration screens to collect personal information, and record keystrokes on the computers in order to capture login credentials for email, financial, and social media accounts. In many instances, Aaron’s franchisees did not obtain consent from their rental customers and did not disclose to them or the rental computers’ users that the software was installed and could be used to track consumers’ locations and to remotely spy on their activities.

The FTC brought the enforcement action against Aaron’s, a franchisor, despite the alleged violations being committed by its franchisees, for several reasons. According to the FTC:²

• Aaron’s facilitated its franchisees’ installation and use of the software and provided its franchisees with the technical capacity to access and use the software. To use and activate the software, franchisees were required to obtain corporate email accounts provided by Aaron’s. Email messages were routed through Aaron’s corporate headquarters and stored on servers owned, controlled, and maintained by Aaron’s. Aaron’s also gave franchisees instructions on how to install and use the software, and in many instances gave franchisees permission to access the software vendor’s website using Aaron’s network.
• Aaron’s senior management and personnel responsible for the franchisees knew that the franchisees were using the spying software without notifying consumers.
• Aaron’s IT personnel were aware that the company’s server space was being used to store email messages sent using the software, as well as of the contents of those email messages.

The FTC alleged that the actions of Aaron’s in permitting and participating in the gathering and storage of private and confidential information about consumers caused or was likely to cause substantial harm to consumers, and that this injury could not reasonably be avoided and was not outweighed by countervailing benefits to consumers or competition. Accordingly, the FTC alleged that the company’s practices constituted unfair acts or practices in violation of Section 5 of the FTC Act.

Settlement

Aaron’s agreed to the terms of a proposed settlement, including numerous remedies. As part of the proposed settlement, which would remain in effect for at least 20 years, Aaron’s must:

• not use monitoring technology on computers rented to consumers to collect data from or about consumers (other than with notice to and consent from a consumer, or in connection with a request for technical support initiated by a consumer, where Aaron’s uses the data for no other purpose);³
• not use geolocation tracking technology in any rented consumer product without providing clear and prominent notice to, and obtaining affirmative consent from, the consumer at the time the product is rented, including the installation of a clear and prominent icon on the computer on which the technology is installed that, when clicked, provides specified categories of disclosures about the geophysical location tracking technology and how collected information is used and disclosed (with exceptions only for (i) activating monitoring technology in response to the potential theft of a rented item, and (ii) in connection with a request for technical support initiated by a consumer, where Aaron’s uses the data for no other purpose);
• refrain from engaging in any false representations to consumers or deception regarding the collection of personal information through a rented computer by way of any notice, prompt screen, or other software application appearing on the screen of any computer;
• refrain from any misrepresentations regarding the extent to which Aaron’s maintains and protects the security, privacy, or confidentiality of any data or information from or about a consumer;
  not use data gathered by practices prohibited by the settlement to collect consumer debts;
• delete or destroy data collected using practices prohibited by the settlement;
• require its franchisees to refrain from using, and to destroy, any data collected using methods that do not comply with the settlement;
• prohibit its franchisees from engaging in various other actions that would be inconsistent with those practices Aaron’s agreed to abstain from in the settlement, and to monitor and enforce franchisees’ compliance; and
• engage in related recordkeeping, reporting, and notification obligations.

Implications

The Aaron’s settlement has significant implications. First, it illustrates the need for companies that use technologies that monitor consumers’ activities, including those that capture geolocation information, to evaluate carefully the means by which they notify affected consumers of their practices and obtain consent.

Second, the settlement has significant implications for franchisors, franchisees, and others doing business under similar arrangements. The FTC did not allege that Aaron’s itself used the accused software in any of its company-owned stores, and it appears that no such use occurred. The company’s practices still were challenged, though, due to it knowing about its franchisees’ practices and, in some cases, facilitating those franchisees’ use of the invasive technology. The FTC’s pursuit of Aaron’s in these circumstances, along with the settlement obligating Aaron’s to engage in monitoring and oversight of its franchisees, may be instructive for franchisors and similarly situated companies.

Aaron’s and certain of its franchisees also face multiple putative class action lawsuits in numerous jurisdictions relating to the conduct challenged by the FTC. These lawsuits, pending as of this writing, further underscore the potential risks presented by such conduct.

¹ The software was the subject of related FTC actions earlier in 2013 against the software’s manufacturer, Designerware LLC, as well as several rent-to-own stores, including Aaron’s franchisees, that used it. Information regarding those related FTC actions is available at http://www.ftc.gov/news-events/press-releases/2013/04/ftc-approves-final-order-settling-charges-against-software-and.

² The FTC’s complaint against Aaron’s is available at http://www.ftc.gov/sites/default/files/documents/cases/131022aaronscmpt.pdf.¹

³ These, along with most obligations in the settlement, are limited to the actions of Aaron’s and its franchisees in connection with “covered rent-to-own transactions,” defined as any transaction where a consumer enters into an agreement for the purchase or rental of any consumer product where the consumer’s contract or rental agreement provides for payments over time with options to purchase the product.