On January 7, the FTC announced that a California-based lead generator agreed to settle with the FTC for $1.5 million to resolve allegations that through a number of its subsidiaries, the company induced consumers into sharing their personal financial information and then sold that information from these loan applications as “leads” to a variety of entities without regard to whether these entities are lenders or use the consumers’ data to make loans.

Despite its representation that the loan applications that it received would be circulated to a “trusted network of lenders” to help consumers obtain loan offers, the complaint alleges that the company distributed information it collected to entities in a lead marketplace, in which consumer sensitive financial information was sent to prospective buyers who could bid on the information.  The complaint alleges that the company did not ensure that these buyers were only using the information to make loan offer determinations and in fact, the company seldom shared information with actual lenders.  The company also represented to consumers that loans were available without credit score or history checks; however, it allegedly never prohibited downstream purchasers from conducting credit checks.

The FTC found that the company’s practices violated the FCRA, which prohibits using or obtaining a consumer report for any purpose, other than an authorized purpose. The FTC explained that using a credit score or other consumer report to evaluate leads for marketing was not a permissible purpose. The FTC found that the company’s violations of FCRA also constituted unfair and deceptive practices, which amounted to a violation of Section 5(a) the FTC Act.

In addition to the monetary penalty, the settlement order prohibits the company from making misleading statements about how consumer information will be used and prohibits the company from selling consumer information or using it for anything other than a permissible purpose under FCRA.

Putting it into Practice: This case highlights that lead generators, and other companies holding sensitive consumer information, must ensure that if they are sharing or selling information with third parties, that it is permissible to do so under FCRA. This case also serves as a reminder that the FTC has a broad eye on companies and their potentially deceptive practices and companies should ensure that whatever they are representing to consumers accurately reflects their actual practices. In addition, a number of states in recent years have instituted enhanced privacy laws and licensing requirements applicable to lead generators, further signaling the need for companies to institute an appropriate compliance management system in connection with applicable state and federal laws and regulations.