Rent-to-own businesses are more often than not a bad idea for consumers struggling financially; promises of guaranteed credit approval and zero money down have a way of ballooning into unmanageable debt for the less disciplined among us. And if that isn't enough to steer you away, it turns out a number of these companies have been spying on late-paying customers through specialized PC software that's nearly impossible to detect. This comes according to the FTC, which today announced settlement proposals with seven rent-to-own businesses that sold PCs with embedded spyware designed to secretly collect confidential consumer information and leverage that data to collect money from them.

One of the implicated companies is Watershed Development Corp. — a franchisee of Aaron's, which has recently notched up its TV advertising with spots like the one below. The tagline? "Starting at just $99.99 a month, with no credit needed and automatic pre-approval."

Thousands of unsuspecting victims

The FTC says the software in question, developed by DesignerWare (also named in the complaint), has been employed by approximately 1,617 stores in the US, Canada, and Australia. It's estimated that as of August, 2011, a staggering 420,000 computers had been armed with the PC Rental Agent utility, with an included Detective Mode enabling stores to track those consumers by capturing screenshots, logging keystrokes, and even snapping photos with an integrated webcam. Worse yet, because this software runs outside a user's session, it's difficult for antivirus apps to pick up on. The deception didn't stop there, as users were also prompted by fake software registration screens that duped them into providing personal information.

Every piece of private data you can imagine was silently collected

Just what sort of sensitive data did these rent-to-own companies gather? They left very few areas unturned, says the FCC.

  • User names and passwords for email accounts, social media websites, and financial institutions
  • Social Security numbers
  • Medical records; private emails to doctors
  • Bank and credit card statements
  • Webcam pictures of children, partially undressed individuals, and intimate activities at home

For such a blatant disregard of privacy, you'd expect the offending parties to be face severe repercussions. Unfortunately that punishment doesn't extend as far as many would hope. The seven business will need to immediately cease all monitoring activity and provide records to the FCC showing they've done so for the next 20 years. Geolocation tracking will still be permitted with consumer consent, however. They're also prohibited from using any of the improperly-collected data moving forward, and DesignerWare is "barred from providing others with the means to commit illegal acts."

Chairman Jon Leibowitz seems satisfied with the FTC's proposal, saying, "an agreement to rent a computer doesn’t give a company license to access consumers’ private emails, bank account information, and medical records, or, even worse, webcam photos of people in the privacy of their own homes. The FTC orders today will put an end to their cyber spying.”

Yet incredibly, those orders mean these companies will evade criminal charges and monetary fines, at least from where the FTC is concerned. If you're not satisfied with the proposed settlement, the agency is accepting public comment through October 25th at the source below.