A Web analytics company that tracked the browsing behavior of millions of US consumers has agreed to settle federal charges that it collected credit card numbers, financial account information, and other sensitive data without proper notice.

Boston, Massachusetts-based Compete Inc. agreed to obtain end users' consent before collecting future data on their browsing history, according to a release published on Monday by officials with the Federal Trade Commission. The company also agreed to delete or anonymize the consumer data it has already collected and to provide directions for removing tracking software installed on the computers of many of the people whose data was collected.

The agreement settles charges filed against Compete accusing company officials of failing to adequately describe two products used to collect details about end users' browsing habits. The Compete Toolbar was billed as a way for consumers to get "instant access" to information about the websites they visited. A second software package known as the Consumer Input Panel was billed as a way for consumers to win rewards while expressing opinions about products and services.

"In fact, Compete collected more than browsing behavior or addresses of webpages," FTC lawyers wrote in a civil complaint filed in the case. "It collected extensive information about consumers' online activities and transmitted the information in clear readable text to Compete's servers. The data collected included information about all websites visited, all links followed, and the advertisements displayed with the consumer was on a given webpage."

As long ago as January 2006, the company also captured credit card numbers, social security numbers, passwords, and other sensitive data, because code designed to filter out that data often didn't work properly, FTC officials alleged. After the flaws were publicly disclosed in January 2010, the company upgraded the filters to better screen out such information. The software also began encrypting data in transit to prevent it from being intercepted by third parties.