FTC hits retail firm for secretly tracking customers