Update: FTC Settles With Toysmart Allowing Sale of Customer Data

Updated from 5:15 p.m. EDT

The Federal Trade Commission said Friday it has settled a dispute with Toysmart.com, allowing the failed online retailer to sell a list of personal information it gathered on customers, whom it had assured the data would be kept in confidence.

The agreement allows Toysmart to sell the list to a bidder that "is engaged in the family commerce market and agrees to abide by Toysmart's privacy policy," according to Harold Murphy, a lawyer with Hanify & King of Boston, which represents Toysmart.

The agreement must be approved by Judge Carol J. Kenner of the U.S. Bankruptcy Court in Boston.

Toysmart announced on May 22 that it was closing operations and selling its assets because a last-minute investment attempt to reposition the company broke down. A majority of the company's board members are appointees of Disney (DIS), which owns a 60% stake. The media giant has offered to buy the list of personal information and retire it.

Disney said it is "pleased that the FTC and Toysmart agreed upon a strategy to protect the privacy of those included on the Toysmart customer list."

The suit has added to the debate over online privacy, and about whether Internet retailers should be subject to government regulation limiting how they handle and protect customer information. Internet retailers assert they can regulate themselves by disclosing on their sites whether and how they might use customer data accrued when visitors join sites or make purchases.

"We are pleased that we have been able to fashion a resolution that both respects the confidentiality of Toysmart's customers and provides an opportunity for the company and its creditors to realize value from a potentially valuable asset," Murphy said in a statement.

The FTC sued Toysmart.com on July 10 to prevent the Waltham, Mass.-based company from selling a list containing addresses and other personal information about its customers. Toysmart's privacy policy, posted on its Web site, states that its customers' personal information "is never shared with a third party.''

The company had gone on to reassure customers that their names and addresses were stored on a separate server, and it gave them the option of securing the data with a password.

On June 8, Toysmart took out an advertisement in The Wall Street Journal offering the sale of both tangible and intangible assets, including ''databases and customer lists.''

The list includes customers' addresses, buying habits, children's ages and other personal information. The list is thought to include information on roughly 190,000 people, said Michael W. Macleod-Ball, a lawyer for Digital Research of Kennebunkport, Maine, a market research firm that has bid for the list.

The list is split in two parts, he said. It includes detailed information on around 100,000 people who made purchases from Toysmart's Web site and less extensive data on 90,000 people who registered with the site but did not buy toys.

Bidding on the list was open until 4 p.m. Friday. A hearing was scheduled for Wednesday, July 26. Under rules set up by Toysmart.com, bidders can make offers for all the company's assets or any of four portions: leases of real property, furniture, software or the Web site. That last lot includes the name list.

On June 29, The Wall Street Journal advertisement came to the attention of Truste, a nonprofit agency that certifies the privacy policy of online retailers. Toysmart.com was among roughly 2,000 sites, including major online search engines, that have received Truste's seal of approval of private policy.

>To order reprints of this article, click here: Reprints