On January 6, 2022, the Federal Trade Commission reached a $ 1.5 million settlement with loan application company ITMedia Solutions LLC (“ITMedia”) over alleged violations of the FTC Act and Fair Credit Reporting. Act (“FCRA”). The FTC alleged that ITMedia deceptively acquired and indiscriminately shared consumers’ sensitive personal information under the guise of connecting them to lenders.
Since 2012, ITMedia, operating under website names such as cashadvance.com, personalloans.com and badcreditloans.com, has reportedly solicited sensitive personal information from consumers, including social security numbers and bank account information, in the purpose of sharing them with the “network of trusted lenders. On some of these sites, ITMedia is said to have promised loans with no credit score requirement to people with bad credit history.
The FTC alleged that 84% of loan applications received by ITMedia since 2016 were sold as marketing leads to a variety of merchants, debt relief and credit repair vendors and other unauthorized parties, as opposed to lenders. In its complaint, the FTC alleged that ITMedia did not place use restrictions on the information sold and, in many cases, was unaware of the purposes for which companies were purchasing consumer information.
As a result of ITMedia’s alleged deceptive practices, the FTC accused ITMedia of violating Section 5 (a) of the FTC Act, 15 USC § 45 (a). The FTC complaint also alleged that ITMedia illegally obtained and resold the credit scores of consumers who submitted information, in violation of FCRA Sections 604 and 607, 15 USC §§ 1681b and 1681e. ITMedia neither admitted nor denied the allegations contained in the complaint, but agreed to settle the complaints.
Pursuant to the proposed settlement order, ITMedia will pay a civil fine of $ 1.5 million. The settlement order prohibits the business from engaging in various activities, including:
mislead consumers, in particular with regard to the purposes for which consumer information is collected and shared, and the entities with which the information is shared;
sell or disclose sensitive personal information of consumers, unless certain conditions are met, including obtaining express and informed consent;
use or obtain a consumption report for any unauthorized purpose; and
failing to comply with reasonable procedures to ensure the legitimate use of consumer reports or sensitive personal information collected or disclosed by ITMedia.
In addition, ITMedia will be required to destroy any sensitive personal information obtained in an unauthorized manner in its possession and will ask any recipient of such information to do the same. Within 90 days of the order and again one year after, ITMedia must submit a report verifying its compliance with the payment order. The order also states that ITMedia complies with certain record keeping and monitoring requirements.
Copyright © 2022, Hunton Andrews Kurth LLP. All rights reserved.National Law Review, Volume XII, Number 12