Very Incognito Technologies, Inc., Doing Business as Vipvape

AGENCY:

Federal Trade Commission.

ACTION:

Consent order.

SUMMARY:

The Commission has approved a final consent order in this matter, settling alleged violations of federal law prohibiting deceptive acts or practices. The attached Analysis to Aid Public Comment describes both the allegations in the Complaint and the terms of the Decision and Order.

DATES:

Issued on June 21, 2016.

SUPPLEMENTARY INFORMATION:

Analysis of Agreement Containing Consent Order To Aid Public Comment

The Federal Trade Commission (“FTC” or “Commission”) has approved a final consent order applicable to Very Incognito Technologies, Inc. dba Vipvape (“Vipvape”).

The consent order was placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period became part of the public record. After the public comment period, the Commission reviewed the agreement and the comments received, and determined to make the proposed order final.

This matter concerns allegedly false representations that Vipvape made to consumers concerning its participation in the Asia-Pacific Economic Cooperation (“APEC”) Cross Border Privacy Rules (“CBPR”) system. The APEC CBPR system is a voluntary, enforceable mechanism that certifies a company's compliance with the principles in the CBPR and facilitates privacy-respecting transfers of data amongst APEC member economies. The APEC CBPR system is based on nine data privacy principles: Preventing harm, notice, collection limitation, use choice, integrity, security safeguards, access and correction, and accountability. Companies that seek to participate in the APEC CBPR system must undergo a review by an APEC-recognized Accountability Agent, which certifies companies that meet the standards.

Companies under the FTC's jurisdiction are eligible to apply for APEC CBPR certification. The names of certified companies are posted on a public-facing Web site, www.cbprs.org. Companies must re-apply annually in order to retain their status as current participants in the APEC CBPR system. A company that falsely claims APEC CBPR participation may be subject to an enforcement action based on the FTC's deception authority under Section 5 of the FTC Act.

Vipvape makes and distributes hand-held vaporizers. According to the Commission's complaint, Vipvape has set forth on its Web site, https://www.vipvape.com/content/legal/warranty/privacy , privacy policies and statements about its practices, including statements related to its participation in the APEC CBPR system.

The Commission's complaint alleges that Vipvape falsely represented that it was a participant in the APEC CBPR system when, in fact, it never sought or obtained certification.

Part I of the order prohibits Vipvape from making misrepresentations about its participation in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including, but not limited to, the APEC CBPR system.

Parts II through VI of the order are reporting and compliance provisions. Part II requires acknowledgment of the order and dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part III ensures notification to the FTC of changes in corporate status and mandates that Vipvape submit an initial compliance report to the FTC. Part IV requires Vipvape to retain documents relating to its compliance with the order for a five-year period. Part V mandates that Vipvape make available to the FTC information or subsequent compliance reports, as requested. Part VI is a provision that “sunsets” the order on June 21, 2036, with certain exceptions.

The purpose of this analysis, which was placed on the Commission Web site on May 4, 2016, was to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or order or to modify the order's terms in any way.