On January 6, 2022, the Federal Trade Commission reached a $1.5 million settlement with loan application firm ITMedia Solutions LLC (“ITMedia”) regarding alleged violations of the FTC Act and the Fair Credit Reporting Act (“FCR”). The FTC alleged that ITMedia deceptively acquired and indiscriminately shared consumers’ sensitive personal information under the guise of connecting them with lenders.
Since 2012, ITMedia, operating under website names such as cashadvance.com, personalloans.com and badcreditloans.com, has allegedly solicited consumers’ sensitive personal information, including social security numbers and bank account information, in the purpose of sharing them with ITMedia’s network of trusted lenders. On some of these sites, ITMedia reportedly promises loans with no credit score requirement to people with bad credit histories.
The FTC alleged that 84% of loan applications received by ITMedia since 2016 were sold as marketing leads to a variety of merchants, debt relief and credit repair sellers, and other unauthorized parties. , as opposed to lenders. In its complaint, the FTC alleged that ITMedia did not impose usage restrictions on the information sold and, in many cases, was unaware of the purposes for which the companies purchased consumer information.
As a result of ITMedia’s alleged deceptive practices, the FTC charged ITMedia with violating Section 5(a) of the FTC Statute, 15 USC § 45(a). The FTC complaint also alleged that ITMedia unlawfully obtained and resold the credit scores of consumers who submitted information, in violation of FCRA Sections 604 and 607, 15 USC §§ 1681b and 1681e. ITMedia has neither admitted nor denied the allegations in the complaint, but has agreed to settle the claims.
Pursuant to the proposed settlement order, ITMedia will pay a civil penalty of $1.5 million. The settlement order prohibits the company from engaging in various activities, including:
- mislead consumers, including with respect to the purposes for which consumer information is collected and shared, and the entities with which the information is shared;
- sell or disclose consumers’ sensitive personal information unless certain conditions are met, including obtaining express and informed consent;
- use or obtain a consumer report for any unauthorized purpose; and
- failing to comply with reasonable procedures to ensure the legitimate use of consumer reports or sensitive personal information collected or disclosed by ITMedia.
In addition, ITMedia will be required to destroy any unauthorized sensitive personal information in its possession and require any recipient of such information to do the same. Within 90 days of the order and again one year after, ITMedia must submit a report verifying its compliance with the settlement order. The order also requires ITMedia to comply with certain record keeping and monitoring requirements.
