The FTC has reached a settlement with UPromise, Inc., a membership reward service aimed at helping save for college, to resolve charges that company allegedly used a web-browser toolbar to collect consumers’ personal information, without adequately disclosing the extent of personal information collected. Under the settlement, UPromise must destroy all data it collected under the “Personalized Offers” feature of its “TurboSaver” toolbar, clearly disclose its data collection practices and obtain consent to collection of personal information from those using the toolbar before it is installed or re-enabled, and must further establish a comprehensive information security programming, requiring biennial independent security assessments, for the next 20 years.

UPromise is a website that allows users to save money for college by getting rebates offered by partner merchants. As part of that website, UPromise offers a downloadable “TurboSaver Toolbar” that highlights UPromise partner merchants in search results, and allows users to get “personalized offers” based on websites visited. UPromise stated that it “automatically encrypts . . . sensitive information” and “infrequently” collected personal data “inadvertently,” and that any personally identifying data would be deleted prior to transmission.