In Sept. 2012, Aaron’s was one of several rent-to-own retailers caught using software to illegally snoop on customers who rented computers. Yesterday, the Federal Trade Commission announced that Aaron’s has agreed to settle these charges and make sure franchisees cease the spying.
According to the original complaint [PDF], Aaron’s franchisees knowingly installed software that would allow them to remotely disable a rented computer via a “kill switch” if the customer stopped payment.
That would be fine, if the software didn’t also include a “Detective Mode,” that secretly uses a computer’s webcam to take pictures of the unwitting users. It included a key-logging feature that captured users’ login credentials for sensitive things like e-mail accounts and financial and social media sites. Detective Mode would also present users with deceptive “software registration” screens intended to harvest personal information about the users.
While the software was installed by Aaron’s franchisees, the FTC contended that Aaron’s HQ knew about the snoop-tastic features of Detective Mode and that the company provided instruction to franchisees on how to install and use the software.
The proposed consent agreement [PDF] bars the retailer from using monitoring technology that captures keystrokes or screenshots, or activates the camera or microphone on a consumer’s computer, except to provide technical support requested by the consumer.
If Aaron’s wants to install location-tracking software on a computer, it will be required to give clear notice and obtain express consent from consumers at the time of rental. Furthermore, unless a computer has been reported lost or stolen, Aaron’s will have to give notice to consumers when it activates any sort of tracking technology. The settlement also prohibits Aaron’s from deceptively gathering consumer information.
Any of the info gleaned through the use of the sketchy software can not be put to use by Aaron’s in connection with the collection of any debt, money or property. Additionally, Aaron’s must delete or destroy any information it has improperly collected.
The retailer must conduct annual monitoring and oversight of its franchisees to make sure they are complying with the standards of the agreement. Any franchisees found to be out of compliance risks losing their stores.
“Consumers have a right to rent computers free of cyberspying and to know when and how they are being tracked by a company,” said Jessica Rich, director of the FTC’s Bureau of Consumer Protection. “By enabling their franchisees to use this invasive software, Aaron’s facilitated a violation of many consumers’ privacy.”