Recently, the FTC finalized an order banning a software provider from engaging in the sale, disclosure, or licensing of web browsing data for advertising. The order resolves the FTC’s accusations that the company monetized user data despite promises of protecting users from online tracking. The firm is also required to pay $16.5 million, intended to compensate consumers.

In its complaint, the FTC claimed that the company, through an overseas subsidiary, inappropriately harvested users’ browsing data via browser add-ons and antivirus products, retained this information indefinitely, and sold it without proper notification or consent. The provider was accused of misleading consumers by offering privacy protection against third-party tracking while simultaneously selling their identifiable online activity data to a large number of third parties.

The order requires the company to (i) erase all collected browsing data and any derived products or algorithms; (ii) secure explicit consent prior to selling or licensing any browsing data from certain products; (iii) inform consumers who had their data sold without consent about the enforcement action; and (iv) establish a privacy program to correct and prevent similar issues in the future.