The Tech - Online EditionMIT's oldest and largest
newspaper & the first
newspaper published
on the web
Boston Weather: 33.0°F | A Few Clouds

FTC Sues Troubled Web Merchant to Block Selling of Customer Database

By John Schwartz
THE WASHINGTON POST -- WASHINGTON

The Federal Trade Commission Monday sued a financially troubled Internet toy store to keep it from selling off detailed information it had promised customers it would never, ever sell.

The agency sued Massachusetts-based Toysmart.com, an online toy retailer largely owned by Walt Disney Co., which asked families to provide their children’s names, birthdays and even wish lists as it invited them to register for contests and giveaways.

“When you register with Toysmart.com, you can rest assured that your information will never be shared with a third party,” the company said in its privacy policy.

Then, in June, the company advertised the sale of assets including “databases” and “customer files” in the Wall Street Journal after suspending operations.

The prospect of such sensitive personal information being available to the highest bidder horrified privacy advocates and regulators alike -- and raised questions about how companies that operate on Internet time interpret the word “never.”

But the FTC’s action to halt the sale of information also drew concern from creditors who consider customer data to be one of the few valuable assets many Internet companies possess. Two other failed Internet retailers, Boo.com and CraftShop.com, also have recently tried to sell off their customer databases despite strong statements on company Web sites that they would never do so.

“The Toysmart case is a bellwether to the future state of privacy online,” said David Steer, a spokesman for Truste, a San Jose-based online privacy self-regulation group.

Making the names, ages and birthdays and preferences of children available to any buyer made it possible to envision nightmare scenarios, Steer said: “If you are a predator, a child predator, that wants to find out detailed sensitive information about a child, here is a list that apparently anyone can get,” he said.

The FTC filed its suit, accusing Toysmart of deceptive trade practices, in U.S. District Court for the District of Massachusetts. The FTC also regulates the privacy of children’s personal information on financial Internet sites under the Children’s Online Privacy Protection Act of 1998.

“This case is critical to send a message: You’ve got to make a promise that’s trustworthy today and tomorrow,” said David Medine, the FTC’s associate director for financial practices.

An attorney for Toysmart, Alex Rodolakis, said the company is negotiating a settlement of the issue with the FTC and “we think we can resolve it.” In the meantime, he insisted, “there’s no buyer.