June 9, 2016
Authored by: David Zetoony
Online retailers often learn information about a consumer that may be used to help identify other products, services, or companies that may be of interest to the consumer. For example, if a consumer purchases an airplane ticket to Washington, D.C., the consumer may want information about hotels, popular restaurants, or amenities at the airport.
Although online retailers often strive to provide recommendations quickly, and to make a consumer’s transition to a third party retailer seamless, the Restore Online Shoppers’ Confidence Act (“ROSCA”) generally prohibits one online merchant from transferring payment information (e.g., a credit card number) to a second online merchant.
Below are some questions to consider when evaluating the data privacy issues involved in passing information between online retailers:
- Are consumers being presented with third party products or services when they visit a retailer’s website?
- Are consumers being presented with third party products or services immediately after they visit a retailer’s website?
- Are such items affirmatively selected by the consumer, or added automatically to the consumer’s shopping cart?
- If the consumer decides to purchase such items, would they likely think that your organization, or the third party, is processing the transaction?
- Is the total cost of each third party product clearly and conspicuously disclosed?
- If the consumer indicates that they wish to buy a third party product or service, can the consumer easily change that decision?
- Is contact information being transferred from one retailer to another?
- Is payment information being transferred from one retailer to another?
- Is the third party offering a free trial offer? If so, will the consumer be charged any money to participate and does the consumer need to take an affirmative act to prevent a charge after the trial period?
- Is the third party offering a continuity program or membership? If so, are the terms of the program clearly and conspicuously disclosed?