[{"description":"i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they collect. According to an FTC settlement, i-Dressup fell short on both COPPA requirements. The complaint alleges i-Dressup failed to provide sufficient notice on its site of the information it collected online from kids, how it used it, its disclosure practices, and other specifics required by the COPPA Rule. The company’s direct notices to parents were deficient, too. Among other things, they didn’t include the COPPA-required statement that if parents don’t provide consent within a reasonable time, i-Dressup will delete their online contact information from its records. Stick with the story because that failure turned out to be particularly troubling. In addition to letting users play online games, i-Dressup featured a community where they could “explore their creativity and fashion sense with unique personal profiles” and interact with others. To register, i-Dressup required people to submit a user name, password, birthdate, and email address. If the birthdate indicated the person was under 13, the email field changed to “Parent’s Email.” Once the under-13 user filled in the required fields and clicked “Join Now,” i-Dressup collected the personal information and sent a message to the address entered into the Parent’s Email field. The person receiving the email could consent by clicking the “Activate Now!” button. However, if the parent didn’t give consent, i-Dressup retained the personal information it had collected from the child online. The FTC says the company’s failure to delete that information violated Section 312.5(c)(1) of the COPPA Rule. In addition to violating COPPA’s parental consent provisions, i-Dressup allegedly violated the Rule’s data security requirements . According to the FTC, i-Dressup stored and transmitted users’ personal information (including passwords) in plain text. In addition, the company failed to perform network vulnerability testing of its network, even for well-known threats like SQL attacks; it didn’t implement an intrusion detection and prevention system; and it didn’t monitor for potential security incidents. The upshot? The company learned that a hacker had gained entry to its network and accessed information about 2.1 million users, including approximately 245,000 users who indicated they were under 13. To settle the case , i-Dressup and its owners will pay a $35,000 civil penalty. They’re also prohibited from violating COPPA in the future, and can’t sell, share, or collect any personal information until they implement a comprehensive data security program and get independent biennial assessments. In addition, they’ll have to provide the FTC with an annual certification of compliance. The message for sites and operators covered by COPPA is that an effective system of parental consent is only the first step toward compliance. Section 312.8 of the COPPA Rule also requires you to “establish and maintain reasonable","pubDate":"Thu, 08 Oct 2026 08:06:59 +0200","id":3203250,"titre":"i-Dressup and a data security mess-up","url":"https://www.ftc.gov/business-guidance/blog/2019/04/i-dressup-data-security-mess","source":"FTC USA Business Blog Posts"},{"source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-requires-amazon-pay-225-million-resolve-charges-it-knowingly-violated-fair-credit-reporting-act","titre":"FTC Requires Amazon to Pay $2.25 Million to Resolve Charges It Knowingly Violated the Fair Credit Reporting Act","id":2997627,"pubDate":"Wed, 01 Jul 2026 08:09:43 +0200","description":"Amazon will pay $2.25 million in civil penalties to settle Federal Trade Commission allegations that the online retail giant knowingly violated the Fair Credit Reporting Act (FCRA) by refusing to provide transaction records to consumers whose personal information was used by identity thieves to commit fraud. The complaint , filed by the Department of Justice upon notification and referral from the FTC, alleged that in numerous instances, Amazon.com Inc. failed to comply with Section 609(e) of the FCRA, which requires companies to, within 30 days of a consumer’s request, provide victims of identity theft with application and business transaction records about fraudulent transactions made in their names. According to the complaint, Amazon had no written policy to respond to Section 609(e) requests until early 2025, after it learned of the FTC’s investigation, despite prior outreach from FTC staff advising the company to review its compliance with Section 609(e). “Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “The FTC will not allow companies to simply ignore their legal obligations, especially those designed to support and protect identity theft victims.” Many consumers who contacted Amazon to report fraud were told by its customer service agents that they could not provide the requested records for “security” or “privacy” reasons, the complaint alleged. For example, one consumer reported that when they contacted Amazon seeking business records related to unauthorized charges stemming from a fraudulent account, a company representative said they could not share details about the other account that had used the consumer’s credit card for “security reasons” unless the consumer guessed the name on the account (the name used by the identity thief), which the consumer was unable to do after making 30 attempts. The complaint alleged that in other instances, Amazon agents told consumers they were not able to access the requested records. Amazon even refused to provide application and business transaction records to law enforcement agencies who had been authorized to, and who did, submit requests to Amazon on behalf of consumers who were victims of identity theft. Some frustrated consumers resorted to sending copies of the FCRA and FTC guidance to Amazon in hopes of receiving the requested records, but Amazon still failed to comply with the law. The complaint also alleged that in some cases where Amazon ultimately provided requested records, it failed to respond to consumers within the 30-day timeframe required by the FCRA. In addition to the $2.25 million civil penalty—a record for a Section 609(e) violation—the proposed order will prohibit Amazon from failing to comply with Section 609(e) of the FCRA, requiring the company to provide the records lawfully requested by identity theft victims and law enforcement agencies acting on their behalf. The order also requires Amazon to provide notice to consumers about how identity theft victims can request records under the FCRA. The company must also contact consumers who had requested records since April 2024 from Amazon but did not receive them to inform these consumers that it may have additional records and that the consumers may request those records from Amazon. This is the second case the FTC has brought using its authority under Section 609(e) of the FCRA. The FTC announced its first case involving a violation of Section 609(e) of the FCRA in 2020 against Kohl’s Department Stores Inc . The Commission voted 2-0 to authorize the staff to refer the complaint to the DOJ and to approve the proposed stipulated order. The DOJ filed the complaint and final"}]