According to the story, one of the victims bought a ticket from Ticketmaster.Com, then clicked on a "Rewards" popup, looked at the site that appeared -- thought "No Thanks" -- and then left it. Some time later she found that her credit card had been billed. In small print on the first site, she'd allegedly "agreed" that if she clicked the popup her credit card would be billed for a trial offer for a $7/month club under terms described partly on the screen. The small print, supposedly buttressed by more small print in the "Privacy Policy" and "Terms and Conditions" pages apparently told her that Ticketmaster could share her credit card information with the rewards firm if she used the site to buy a ticket. Two other victims had stories about other web merchants in the Fox piece, called "Terms and Conditions."

Identical scandals associated with so-called "free-to-pay" scams by telemarketers (some obtaining the information not from merchants but, incredibly, from regulated banks), resulted in hefty regulatory activity. "Free-to-pay" means a trial offer-- where you must cancel your credit card within a certain period of time or you are billed. The problem is exacerbated where a consumer hasn't given out his credit card number in the first place and is unaware that the telemarketer has it. State Attorneys General call this "pre-acquired account telemarketing" and it turns a purchase upside down. If you haven't given out a credit card number or handed anyone cash, how you have entered into a transaction?

After pressure was brought by state Attorneys General (their comments), the Federal Trade Commission amended the Telemarketing Sales Rule (TSR) prohibiting telemarketers from billing consumer credit cards in a similar way. The telemarketers are now required to ask consumers to read back at least part of their credit card number as a way of documenting that they have actually agreed to a transaction.

As the AGs argued in their comments to FTC: "The essential characteristic of [preacquired account telemarketing]is the ability of the telemarketer to charge the consumer’s account without traditional forms of consent."

So, in its final rule, the FTC said the following, for telemarketers:

"(i) In any telemarketing transaction involving preacquired account information and a free-to-pay conversion feature, the seller or telemarketer must: (A) obtain from the customer, at a minimum, the last four (4) digits of the account number to be charged;(B) obtain from the customer his or her express agreement to be charged for the goods or services and to be charged using the account number..."

Now we need a similar rule for the web that is based on real understanding and real consent, not simple clicking.