[{"pubDate":"Thu, 08 Oct 2026 08:06:59 +0200","url":"https://www.ftc.gov/business-guidance/blog/2019/04/i-dressup-data-security-mess","titre":"i-Dressup and a data security mess-up","id":3203250,"description":"i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they collect. According to an FTC settlement, i-Dressup fell short on both COPPA requirements. The complaint alleges i-Dressup failed to provide sufficient notice on its site of the information it collected online from kids, how it used it, its disclosure practices, and other specifics required by the COPPA Rule. The company’s direct notices to parents were deficient, too. Among other things, they didn’t include the COPPA-required statement that if parents don’t provide consent within a reasonable time, i-Dressup will delete their online contact information from its records. Stick with the story because that failure turned out to be particularly troubling. In addition to letting users play online games, i-Dressup featured a community where they could “explore their creativity and fashion sense with unique personal profiles” and interact with others. To register, i-Dressup required people to submit a user name, password, birthdate, and email address. If the birthdate indicated the person was under 13, the email field changed to “Parent’s Email.” Once the under-13 user filled in the required fields and clicked “Join Now,” i-Dressup collected the personal information and sent a message to the address entered into the Parent’s Email field. The person receiving the email could consent by clicking the “Activate Now!” button. However, if the parent didn’t give consent, i-Dressup retained the personal information it had collected from the child online. The FTC says the company’s failure to delete that information violated Section 312.5(c)(1) of the COPPA Rule. In addition to violating COPPA’s parental consent provisions, i-Dressup allegedly violated the Rule’s data security requirements . According to the FTC, i-Dressup stored and transmitted users’ personal information (including passwords) in plain text. In addition, the company failed to perform network vulnerability testing of its network, even for well-known threats like SQL attacks; it didn’t implement an intrusion detection and prevention system; and it didn’t monitor for potential security incidents. The upshot? The company learned that a hacker had gained entry to its network and accessed information about 2.1 million users, including approximately 245,000 users who indicated they were under 13. To settle the case , i-Dressup and its owners will pay a $35,000 civil penalty. They’re also prohibited from violating COPPA in the future, and can’t sell, share, or collect any personal information until they implement a comprehensive data security program and get independent biennial assessments. In addition, they’ll have to provide the FTC with an annual certification of compliance. The message for sites and operators covered by COPPA is that an effective system of parental consent is only the first step toward compliance. Section 312.8 of the COPPA Rule also requires you to “establish and maintain reasonable","source":"FTC USA Business Blog Posts"},{"id":3201052,"description":"First FTC ROSCA case challenges bogus BOGO and \"free\" claims wfg-adm109 October 21, 2014 | 12:02PM First FTC ROSCA case challenges bogus BOGO and \"free\" claims By Lesley Fair It’s called ROSCA – the Restore Online Shoppers’ Confidence Act – and it prohibits marketers from charging consumers for an online transaction unless the marketer has clearly disclosed all material terms of the deal and received the consumer’s express informed consent. Your e-commerce clients will want to know about the FTC’s first ROSCA case , filed recently in Nevada. According to the lawsuit, Health Formulas, LLC and a tangle of related California- and Nevada-based companies and individuals – consumers may know them as Simple Pure Nutrition – pitched a variety of products for weight loss, muscle building, virility, and skin care. The defendants advertised diet supplements like Pure Green Coffee Bean Plus and RKG Extreme as a shortcut to drop the pounds: “Burn fat without diet or exercise,” “Extreme weight loss!” “Shed pounds fast!” “Super concentrated double fat burning,” etc. Among the defendants’ more colorful business names: Weight Loss Dojo, Longhorn Marketing (sorry, Texas fans), Black Bull, and Unleash the Thunder. But unsubstantiated weight loss claims were just the start. The FTC says the defendants lured people in with bogus promises of a “free” trial or deceptive buy-one-get-one (BOGO) offers. Then they tricked consumers into giving their credit or debit card information with the false implication that consumers had to “just pay shipping.”   Digits in hand, the defendants really went to town, allegedly signing consumers up without their authorization for a negative option program that billed their accounts over and over again, to the monthly tune of between $60 and $210. The FTC says the defendants violated ROSCA by using a negative option feature without providing clear and conspicuous disclosures, getting the consumer’s express informed consent, and offering a simple mechanism for stopping the recurring charges. The FTC’s complaint also cites the defendants’ hard-to-find and hard-to-understand fine-print “terms and conditions,” which consumers could reach only by scrolling through the equivalent of two printed pages and clicking on an obscure hyperlink. Assuming they found it – and that’s a big if – the typical “terms and conditions” document was 10 pages long. On some websites, consumers had to scroll down the payment page to see further fine-print disclosures about the cost of the products. The first sentence reiterated what consumers generally understood (“You must pay a shipping and handling fee of $4.95 for us to send you a full 30 day supply of Garcinia Cambogia Extract”) but it wasn’t until the middle of the paragraph that the defendants mentioned that the trial period lasts only 14 days, that it began when the items were shipped (not delivered), and that consumers would be charged after that. Other websites didn’t even include that information. According to the lawsuit, consumers who attempted to take the defendants up on their money-back guarantee were met with a series of undisclosed roadblocks. In addition to the ROSCA counts, the FTC says the defendants’ practices violated the Electronic Fund Transfer Act by debiting consumers’ accounts on a recurring basis without their prior written authorization. What’s more, the complaint charges that the defendants continued to call people after being told to cut it out, in violation of the Telemarketing Sales Rule’s entity-specific Do Not Call provisions. The FTC says they also violated the TSR through a series of deceptive upsells. A federal judge has entered a temporary restraining order and the FTC is seeking to put a permanent stop to the defendants’ illegal practices. If your clients have ROSCA questions, the","source":"FTC USA Business Blog Posts","pubDate":"Wed, 07 Oct 2026 08:05:50 +0200","titre":"First FTC ROSCA case challenges bogus BOGO and \"free\" claims","url":"https://www.ftc.gov/business-guidance/blog/2014/10/first-ftc-rosca-case-challenges-bogus-bogo-free-claims"},{"source":"FTC USA Business Blog Posts","id":3199073,"description":"Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs lfair March 18, 2019 | 10:24AM Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs By Lesley Fair First, the bad news: That nifty purchase needs a repair. Now the good news for consumers: It’s still under warranty. But where can they go to get it fixed? Can the manufacturer restrict a consumer’s ability to go to the independent repair shop of their choice? Can the manufacturer use glue, non-standard screws, and proprietary diagnostic software that make it difficult for independent repair shops to fix things? Do limitations like these affect consumers’ rights under the Magnuson-Moss Warranty Act ? That’s the topic of Nixing the Fix: A Workshop on Repair Restrictions , an FTC event scheduled for July 16, 2019 . Enforced by the FTC, the Magnuson-Moss Warranty Act helps consumers make informed buying decisions and gives them access to remedies if the widget starts to fidget during the warranty period. One key consumer protection under Mag-Moss is that the law prohibits manufacturers from conditioning warranty coverage on the use of particular products or services. Here are some of the questions FTC staff intends to ask at Nixing the Fix : What’s the interplay between repair restrictions and the Magnuson-Moss Warranty Act’s anti-tying provision, which establishes that manufacturers can’t condition coverage on the use of parts or services identified by brand, trade, or corporate name? Do repair restrictions affect the market for extended warranties and service agreements? What types of restrictions are consumers running into when they try to get their stuff repaired? Are manufacturers’ restrictions having an impact on small fix-it businesses? Are manufacturers using software that may render products obsolete or unfixable if consumers engage in DIY or go to a local repair shop? Are repair restrictions necessary to reduce the risk of physical injury or to protect manufacturers from liability for products improperly repaired by others? Do consumers understand the effects of repair restrictions? We’re also looking for empirical research and data about the prevalence and impact of manufacturers’ repair restrictions. For example, what can you tell us about code that disables products that have been repaired by someone other than the manufacturer, product designs that make third-party repairs difficult (like attaching batteries with glue only the manufacturer can remove), contractual post-sale or licensing restrictions, or proprietary diagnostic software and replacement parts? Please send us your research and data by April 30, 2019. Do you have suggestions about possible panelists? Email us at nixingthefix@ftc.gov . Nixing the Fix will take place on July 16th at the FTC’s Constitution Center conference facility, 400 7th Street, S.W., in Washington, DC. It’s free and open to the public. You can file public comments online and we’ll keep the record open until September 16, 2019. Follow the Business Blog for more information about the agenda and for watch-the-webcast instructions.","pubDate":"Tue, 06 Oct 2026 08:06:23 +0200","titre":"Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs","url":"https://www.ftc.gov/business-guidance/blog/2019/03/nixing-fix-warranties-mag-moss-restrictions-repairs"},{"url":"https://www.ftc.gov/business-guidance/blog/2014/04/keep-fcra-foreground-when-subject-background-screening","titre":"Keep FCRA in the foreground when the subject is background screening","pubDate":"Mon, 05 Oct 2026 14:07:46 +0200","description":"Keep FCRA in the foreground when the subject is background screening chundycz April 9, 2014 | 12:13AM Keep FCRA in the foreground when the subject is background screening By Lesley Fair When the talk turns to Big Data, part of the conversation is about all the public information available about people's lives – and how companies market it to prospective employers, landlords, etc.  Two cases just announced by the FTC  serve as a cautionary reminder to members of the industry that what they do may be subject to the long-standing consumer protections of the  Fair Credit Reporting Act (FCRA) .  InfoTrack, an Illinois company, and San Diego-based Instant Checkmate will be paying civil penalties to settle FTC lawsuits that they violated the FCRA.  Is it time for an FCRA refresher at your business? Instant Checkmate marketed its reports as a way for prospective employers and landlords to investigate applicants.  For example, the company advertised that one of the “GOOD REASONS to get instant criminal checks on anyone right now” was to “check out tenants before they rent.”  It also used a Google Ad Words campaign to make sure its site appeared when people searched for background checks on nannies, babysitters, maids, and housekeepers.  What kind of information would buyers get?  Current and previous addresses, birth certificates, arrest histories, and marriage and divorce records, to name just a few examples. InfoTrack offered similar services to employers nationwide, including background screening reports with people’s driving records, education and employment information, criminal histories, and even records from sex offender registries. How does the FCRA come in?  The law defines a “consumer report” as a “communication of any information” by a consumer reporting agency (CRA) that bears on a person’s “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” which is used (or expected to be used) as a factor in establishing their eligibility for credit, insurance, employment, or other reasons outlined in the law. According to the FTC, what Instant Checkmate and InfoTrack were doing triggered the FCRA.  For example, companies covered by the law must follow procedures to assure their reports are as accurate as possible, must take steps to see that those using their reports have permissible purposes for accessing them, and must provide required User Notices explaining key protections for consumers.  The law imposes special requirements when CRAs provide reports containing public record information that could have an adverse effect on a person’s ability to get a job.  In that case, the CRA must either: 1) notify the consumer that it’s reporting the information in the public record; or 2) maintain “strict procedures” – that’s the language in the law – designed to ensure the reported public information is complete and up to date. You’ll want to read the complaints for specifics of where the FTC says the companies fell short, but one example cited in the lawsuit against InfoTrack offers an object lesson on why FCRA protections are so important to consumers – and how the consequences can be devastating when companies don’t live up to the law.  According to the FTC, the reports InfoTrack provided to prospective employers included information about whether a job applicant was on the National Sex Offender Registry.  The employer would provide the first and last name and the date of birth to help InfoTrack with its search.  The problem was that before the fall of 2011, no date of birth was available for many names on the Registry.  If InfoTrack’s search found more than one person with the same first and last name, it reported a “possible match” to employers and gave them reports that included several different people with the","id":3198181,"source":"FTC USA Business Blog Posts"},{"id":3198174,"description":"Two on the aisle for FTC’s “That’s the Ticket” workshop lfair June 6, 2019 | 10:40AM Two on the aisle for FTC’s “That’s the Ticket” workshop By Lesley Fair Humphrey Bogart said it in “The African Queen” and it was a catchphrase popularized by Jon Lovitz on “Saturday Night Live.” But to the FTC, That’s the Ticket is the name of a June 11, 2019, workshop to explore consumer protection issues related to online ticket sales – and the agenda is out now. Consumers who try to buy tickets online to a concert, theatrical performance, or sporting event have often expressed frustration with the process. That’s the Ticket will bring together advocates, industry members, academics, and law enforcers to explore the topic from the consumer’s perspective. FTC Commissioner Slaughter will open the event at 9:30 ET. Next on the agenda: Professor Eric Budish from the University of Chicago’s Booth School of Business, who will share his insights into the issues. The first panel will explore Bots and the BOTS Act . Passed in 2016, the Better Online Ticket Sales Act makes it illegal to “circumvent a security measure, access control system, or other technological control or measure on an Internet website or online service that is used by the ticket issuer to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules.” The next panel will address Other Consumer Protection Issues Around Ticket Availability . After a mid-day break, the topic will turn to The Adequacy of Ticket Price and Fee Disclosures . Do consumers have accurate information about how much they’ll be charged? The last panel of the afternoon will consider Consumer Confusion: What and From Whom Am I Buying? Do buyers have a clear picture of what they’re getting and the identity of the seller? Mary Engle, Director of the FTC’s Division of Advertising Practices, will offer closing remarks. Ironically enough, you don’t need a ticket to attend That’s the Ticket , which will take place on June 11th at the FTC’s Constitution Center conference facility, 400 7th Street, S.W., in Washington, DC. The event is free and open to the public or you can watch via webcast, which will go live moments before the 9:30 ET starting time on the That’s the Ticket event page. We’ll also live tweet using the hashtag #FTCticket.    ","source":"FTC USA Business Blog Posts","pubDate":"Mon, 05 Oct 2026 14:07:45 +0200","url":"https://www.ftc.gov/business-guidance/blog/2019/06/two-aisle-ftcs-thats-ticket-workshop","titre":"Two on the aisle for FTC’s “That’s the Ticket” workshop"},{"pubDate":"Mon, 05 Oct 2026 14:07:45 +0200","titre":"First INFORM Consumers Act enforcement case filed against online marketplace Temu","url":"https://www.ftc.gov/business-guidance/blog/2025/09/first-inform-consumers-act-enforcement-case-filed-against-online-marketplace-temu","source":"FTC USA Business Blog Posts","id":3198178,"description":"First INFORM Consumers Act enforcement case filed against online marketplace Temu kkrown September 5, 2025 | 10:00AM First INFORM Consumers Act enforcement case filed against online marketplace Temu Online marketplaces and third party sellers looking for a refresher on the INFORM Consumers Act should look no further than the recent settlement with Whaleco, Inc., which operates the online marketplace Temu. The complaint alleges the company failed to provide online shoppers with required information and tools. This is the first case brought to enforce the INFORM Act. The INFORM Act, which went into effect in 2023, seeks to make online transactions more transparent. Among other things, the law requires online marketplaces to collect, verify, and disclose certain information about high-volume third party sellers. ( Informing Businesses about the INFORM Consumers Act  has more on how the law defines terms, what’s required of online marketplaces, and the substantial penalties the FTC and state law enforcers may seek if online marketplaces violate the law.) In 2022, Temu launched its online marketplace in the United States, where consumers can view product listings on Temu’s homepage, through search results, and in gamified shopping experiences on the platform. According to the complaint, Temu violated the INFORM Act by failing to offer a mechanism for consumers to report suspicious activity — electronically and by phone — on the gamified product listings of many high-volume third party sellers and by failing to offer a telephonic mechanism on non-gamified product listings. The complaint also alleges that Temu did not post required identifying information about sellers on its gamified product listings or mobile site, and that Temu’s disclosures, when made, were difficult to find. According to the settlement, Temu will pay a $2 million civil penalty, provide a telephonic mechanism for consumers to report suspicious activity on listings, and make other required disclosures. Is your business covered by the INFORM Act? Make sure you:  Review the provisions of the INFORM Act thoroughly . Make sure you fully understand — and have measures in place to comply with — each of its requirements. Make required disclosures easy for consumers to notice . Required disclosures should stand out from any surrounding material and use plain language. Minimize or eliminate steps consumers need to take to reach required disclosures. Ensure required disclosures are available across all iterations of your platform . The INFORM Act mandates disclosures on all interfaces with product listings. And as your platforms evolve, regularly assess and update your compliance efforts. If your business sells through online platforms, check out  What Third Party Sellers Need to Know About the INFORM Consumers Act . This covers what sellers are impacted by the INFORM Act, what you can expect online platforms to require of you, and what information platforms must disclose about you to consumers. It also answers some questions you may have about the law. And if you spot a violation of the INFORM Act, r­eport it to the FTC using this  dedicated link"},{"pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","titre":"Company to pay $22 million for offering \"free\" credit scores that turned out to be not so free","url":"https://www.ftc.gov/business-guidance/blog/2014/11/company-pay-22-million-offering-free-credit-scores-turned-out-be-not-so-free","source":"FTC USA Business Blog Posts","id":3194913,"description":"Company to pay $22 million for offering \"free\" credit scores that turned out to be not so free wfg-adm109 November 19, 2014 | 11:12AM Company to pay $22 million for offering \"free\" credit scores that turned out to be not so free By Lesley Fair We’ve brought law enforcement actions – dozens of ‘em. We’ve held workshops, issued reports, and sent warning letters. If it takes sky writing, tap dancing, and a float in a Thanksgiving Day parade, we’ll do that, too. But here’s what’s not going to happen. The FTC is not giving up until businesses get the message that: 1) Free means free; and 2) Key terms and conditions have to be clearly and conspicuously disclosed. A $22 million settlement announced by the FTC and the AGs of Illinois and Ohio with a national credit monitoring service advertising so-called “free” credit scores emphasizes that point. Another note for practitioners: It's the FTC's third case alleging violations of ROSCA . One Technologies and related outfits marketed their credit monitoring programs, MyCreditHealth and ScoreSense, through at least 50 sites, including FreeScore360.com, FreeScoreOnline.com and ScoreSense.com. Their strategy was simple. Buy advertising on search engines so their ads show up near the top when people look for phrases like “free credit report\" and then follow up with a persuasive pitch: “View your latest Credit Scores from All 3 Bureaus in 60 seconds for $0!” According to the lawsuit , the defendants failed to clearly tell consumers that if they availed themselves of those “free” services and didn’t cancel within seven days, the defendants would ding their credit cards for $29.95 a month over and over and over again. The complaint includes screen shots of the defendants’ sites, but before looking at them, take out your reading glasses because they’ll come in handy in trying to locate where the defendants chose to tell people about that $29.95 monthly fee. One line of fine print added in late 2012 said “Free 7-Day trial when you order your 3 Free Credit Scores. Membership is then just $29.95 per month until you call to cancel.” The first problem: The type was tiny – a fraction of the size of the defendants’ multiple use of the word “free.” The second problem: Why should consumers even have to be on the look-out for the cost, given that the defendants so prominently advertised it as “free”? A second purported disclosure appeared as an obscure hyperlink on the page where people typed in their Social Security number and birthdate.  Sandwiched between the logos of various security firms and a large color button that said CONTINUE was this less-than-crystal-clear statement: By clicking on the ‘Continue’ button, you agree to the Offer Details, to the Terms and Conditions, acknowledge receipt of our Privacy Policy and agree to its terms . . . The “Offer Details” link triggered a small pop-up that said, among other things, “At the end of the 7-day trial period, your credit/debit card will be charged $29.95 on a monthly basis until you call to cancel.” Another place the defendants put the information was on a side panel of the Payment Form in white letters on a grey background – a color combination one of the defendants’ own employees described as “known to cause seizures in lab rats.” According to the complaint, once people spotted the unauthorized charges on their accounts, the defendants didn’t make it easy to stop the billing.  And even when people asked for their money back because they hadn’t approved of the charges, the defendants denied refunds to many of them. The lawsuit alleges violations of the FTC Act, as well as the Illinois Consumer Fraud Act, the Ohio Consumer Sales Practices Act, and related state rules. In addition, the complaint is the third FTC action to charge violations of ROSCA, the Restore Online Shoppers’"},{"description":"FleetCor and its CEO will pay $100 million to settle a Federal Trade Commission administrative action alleging that the company charged its customers, who overwhelmingly are small businesses, undisclosed fees in connection with their use of fuel cards that FleetCor falsely promised businesses would save them money. In a complaint first filed in federal court in 2019 , the FTC alleged that FleetCor Technologies Inc., now known as Corpay Inc., and its CEO Ronald Clarke imposed a broad array of unauthorized fees that its customers never knew about and did not agree to pay, totaling hundreds of millions of dollars and harming tens of thousands of customers.  In addition, FleetCor charged late fees to customers who had either paid on time or were prevented by FleetCor from paying on time. FleetCor also misrepresented the gas savings, fraud-control features, and fees associated with its fuel cards. “FleetCor deceived its small business customers by promising fuel savings that never materialized, while unfairly charging them hidden and unauthorized fees,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “In addition to the relief the FTC has obtained in federal court, this order will help return money to the customers the company took advantage of.” According to the complaint, FleetCor often waited to begin charging many fees until several billing cycles passed, making the fees less noticeable to consumers. The complaint also alleged that FleetCor’s invoices did not disclose that any fees were being charged, requiring customers to proactively view other account management reports. Even on those documents, many fees were obscured among other information or not listed at all. In 2023, a federal district court entered summary judgment for the FTC on all counts, finding that FleetCor had charged its customers hidden or otherwise unauthorized fees and misrepresented the gas savings and fees associated with FleetCor’s fuel cards. The court-imposed order permanently prohibits FleetCor from: billing a customer for any charge unless FleetCor has obtained the customer’s express informed consent and provided clear and unavoidable information about the charge; hiding material information about a charge behind a hyperlink; and making deceptive claims about its fuel cards. In 2026, a federal appeals court upheld the summary judgment against FleetCor on all counts and affirmed the permanent injunction against it.  The court affirmed the judgment against Clarke on all but one count and vacated the injunction as to Clarke.  As part of the settlement order with the FTC, FleetCor and Clarke will pay $100 million, which will be used to provide redress to the company’s business customers harmed by its practices. FleetCor and Clarke have also agreed not to oppose reimposition of a federal court injunction against Clarke.  The Commission vote to accept the consent agreement was 1-0-1. FTC Chairman Andrew N. Ferguson is recused. The FTC will publish a description of the consent agreement in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE: When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to","id":3160549,"source":"Federal Trade Commission - Protecting America's Consumers","titre":"FleetCor Agrees to Pay $100 Million to Resolve Administrative Action After Federal Court Finds that It Violated the FTC Act by Charging Unauthorized Fees","url":"https://www.ftc.gov/news-events/news/press-releases/2026/09/fleetcor-agrees-pay-100-million-resolve-administrative-action-after-federal-court-finds-it-violated","pubDate":"Fri, 18 Sep 2026 08:08:58 +0200"},{"description":"Alexander Mashinsky, the former CEO of cryptocurrency platform Celsius Network Inc. (Celsius), and his business partners, Shlomi Daniel Leon and Hanoch “Nuke” Goldstein, will pay a total of $16.5 million to resolve the Federal Trade Commission’s charges that they deceived users by falsely promising that deposits made to their cryptocurrency platform would be safe and always available. Mashinsky and Leon have also agreed to a ban on marketing or selling products or services that can be used to deposit, exchange, invest or withdraw assets. Similarly, Goldstein has agreed to a ban on marketing or selling retail products or services that can be used to buy, sell, deposit, withdraw, distribute or trade cryptocurrency. In its  July 2023 complaint , the FTC alleged that Celsius and its co-founders promised consumers that Celsius was “safer” than a bank or other traditional financial institutions and misrepresented that their deposits were safe because Celsius earned profits at “no risk” to consumers by making secured loans to other exchanges. The FTC says the company and its top executives deceived users by falsely promising them that they could withdraw their deposits at any time, that the company maintained a $750 million insurance policy for deposits, that it had sufficient reserves to meet customer obligations and that those in its Earn program could earn rewards as high as 18% annual percentage yield on deposits. They also repeatedly claimed that the company did not make any unsecured loans. The FTC, however, alleged that the promises were false and that its top executives continued to claim that customers’ deposits were safe days before the company filed for bankruptcy. The settlement orders with the FTC require Mashinsky to pay $10 million, Leon to pay $4.1 million and Goldstein to pay $2.4 million. In addition,  the order with Mashinsky ,  the order with Leon ,   and the proposed order with Goldstein   will also prohibit the Celsius co-founders from: Marketing or selling products or services that can be used to deposit or withdraw certain assets, as Mashinsky, Leon and Goldstein’s deceptive conduct led to enormous consumer injury; Making misrepresentations regarding the benefits of any product or service or any other material fact about any other product or service; and Violating the Gramm-Leach-Bliley Act, including by obtaining or attempting to obtain customer financial information by making false, fictitious or fraudulent representations; and Finally, the orders with Mashinsky and Leon prohibit them from disclosing nonpublic personal information about consumers unless the consumer first provides express informed consent. The Commission vote approving the stipulated final order with Mashinsky was 3–0 and was approved prior to the departure of former Commissioner Melissa Holyoak. The Commission votes approving the stipulated final orders with Leon and Goldstein were both 2–0. The FTC filed the proposed orders in the U.S. District Court for the Southern District of New York. Stipulated final orders have the force of law when approved and signed by the District Court Judge. The staff attorneys on this matter are Stephanie Liebner, Carlton Mosley and Sally Tieu of the FTC’s Bureau of Consumer","id":3042974,"source":"Federal Trade Commission - Protecting America's Consumers","titre":"Founders of Celsius Network Ordered to Pay $16.5 Million to Resolve FTC Charges","url":"https://www.ftc.gov/news-events/news/press-releases/2026/07/founders-celsius-network-ordered-pay-165-million-resolve-ftc-charges","pubDate":"Tue, 21 Jul 2026 08:04:33 +0200"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-requires-amazon-pay-225-million-resolve-charges-it-knowingly-violated-fair-credit-reporting-act","titre":"FTC Requires Amazon to Pay $2.25 Million to Resolve Charges It Knowingly Violated the Fair Credit Reporting Act","pubDate":"Wed, 01 Jul 2026 08:09:43 +0200","source":"Federal Trade Commission - Protecting America's Consumers","description":"Amazon will pay $2.25 million in civil penalties to settle Federal Trade Commission allegations that the online retail giant knowingly violated the Fair Credit Reporting Act (FCRA) by refusing to provide transaction records to consumers whose personal information was used by identity thieves to commit fraud. The complaint , filed by the Department of Justice upon notification and referral from the FTC, alleged that in numerous instances, Amazon.com Inc. failed to comply with Section 609(e) of the FCRA, which requires companies to, within 30 days of a consumer’s request, provide victims of identity theft with application and business transaction records about fraudulent transactions made in their names. According to the complaint, Amazon had no written policy to respond to Section 609(e) requests until early 2025, after it learned of the FTC’s investigation, despite prior outreach from FTC staff advising the company to review its compliance with Section 609(e). “Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “The FTC will not allow companies to simply ignore their legal obligations, especially those designed to support and protect identity theft victims.” Many consumers who contacted Amazon to report fraud were told by its customer service agents that they could not provide the requested records for “security” or “privacy” reasons, the complaint alleged. For example, one consumer reported that when they contacted Amazon seeking business records related to unauthorized charges stemming from a fraudulent account, a company representative said they could not share details about the other account that had used the consumer’s credit card for “security reasons” unless the consumer guessed the name on the account (the name used by the identity thief), which the consumer was unable to do after making 30 attempts. The complaint alleged that in other instances, Amazon agents told consumers they were not able to access the requested records. Amazon even refused to provide application and business transaction records to law enforcement agencies who had been authorized to, and who did, submit requests to Amazon on behalf of consumers who were victims of identity theft. Some frustrated consumers resorted to sending copies of the FCRA and FTC guidance to Amazon in hopes of receiving the requested records, but Amazon still failed to comply with the law. The complaint also alleged that in some cases where Amazon ultimately provided requested records, it failed to respond to consumers within the 30-day timeframe required by the FCRA. In addition to the $2.25 million civil penalty—a record for a Section 609(e) violation—the proposed order will prohibit Amazon from failing to comply with Section 609(e) of the FCRA, requiring the company to provide the records lawfully requested by identity theft victims and law enforcement agencies acting on their behalf. The order also requires Amazon to provide notice to consumers about how identity theft victims can request records under the FCRA. The company must also contact consumers who had requested records since April 2024 from Amazon but did not receive them to inform these consumers that it may have additional records and that the consumers may request those records from Amazon. This is the second case the FTC has brought using its authority under Section 609(e) of the FCRA. The FTC announced its first case involving a violation of Section 609(e) of the FCRA in 2020 against Kohl’s Department Stores Inc . The Commission voted 2-0 to authorize the staff to refer the complaint to the DOJ and to approve the proposed stipulated order. The DOJ filed the complaint and final","id":2997627},{"description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer","id":2577895,"source":"Federal Trade Commission - Protecting America's Consumers","titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program","pubDate":"Wed, 17 Dec 2025 09:50:37 +0100"}]