[{"url":"https://www.ftc.gov/business-guidance/blog/2017/08/stick-security-require-secure-passwords-authentication","source":"FTC USA Business Blog Posts","description":"Stick with Security: Require secure passwords and authentication lfair August 11, 2017 | 10:47AM Stick with Security: Require secure passwords and authentication By Thomas B. Pahl, Acting Director, FTC Bureau of Consumer Protection To make it harder for hackers to bluff their way onto a computer network, careful companies follow the advice of Start with Security and require strong authentication practices . We’ve considered FTC settlements, closed investigations, and the questions we get from businesses about implementing good authentication “hygiene.” Here are some tips on using effective authentication procedures to help safeguard your network. Insist on long, complex, and unique passwords. A password’s very reason for being is to be easy for a user to remember, but hard for a fraudster to figure out. Obvious choices like ABCABC, 121212, or qwerty are the digital equivalent of a “hack me” sign. Furthermore, experts have determined that passphrases or longer passwords are generally harder to crack. The smarter strategy is for companies to think through their standards, implement minimum requirements, and educate users about how to create stronger passwords. Also, when you install software, applications, or hardware on your network, computers, or devices, change the default password immediately. And if you design products that require consumers to use a password, configure the initial set-up so they have to change the default password. Example: A staff member attempts to select payroll as the password for the database that includes employee payroll information. The company sets up its system to reject an obvious choice like that. Example: To access the corporate network, a business allows employees to type in their username and a shared password common to everyone who works there. Employees are also allowed to use that shared password to access other services on the system, some of which contain sensitive personal information. The more prudent policy would be to require strong, unique passwords for each employee and to insist that they use different passwords to access different applications. Example: At a staff meeting, a company’s IT manager offers tips for employees about good password hygiene. She explains that passphrases or longer passwords are better than short passwords based on standard dictionary words or well-known information (for example, a child’s name, a pet, a birthday, or a favorite sports team). By establishing a more secure corporate password standard and educating employees about implementing it, the IT manager is taking a step to help her company reduce the risk of unauthorized access. Store passwords securely. A company’s first line of defense against data thieves is a workforce trained to keep passwords secret. But even the strongest password is ineffective if an employee writes it on a sticky note on her desk or shares it with someone else. Train your staff not to disclose passwords in response to phone calls or emails, including ones that may appear to be coming from a colleague. Con artists have been known to impersonate corporate officials by spoofing phone numbers or email addresses. A compromised password poses a particular risk if it can be used to open the door to even more sensitive information – for example, a database of other user credentials maintained on the network in plain, readable text. Make it difficult for data thieves to turn a lucky password guess into a catastrophic breach of your company’s most sensitive data by implementing policies and procedures to store credentials securely. Example: A new employee gets a call from someone who claims to be the company’s system administrator. The caller asks him to verify his network password. Because the new staffer learned about impersonation scams at an in-house security orientation, he refuses to disclose his password and instead reports the incident to the appropriate person in the company. Example: A company keeps user credentials and other passwords in plain","id":3197409,"pubDate":"Mon, 05 Oct 2026 08:07:08 +0200","titre":"Stick with Security: Require secure passwords and authentication"},{"pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","id":3194910,"titre":"Practice Fusion case suggests 6 health privacy pointers","description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers","source":"FTC USA Business Blog Posts"},{"pubDate":"Fri, 28 Aug 2026 08:07:59 +0200","id":3120376,"titre":"FTC Finalizes Orders with Cox Media Group, Two Other Firms Settling Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service","description":"The Federal Trade Commission finalized orders requiring Cox Media Group (CMG) and two other firms to pay a total of $930,000 to settle allegations they deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers’ smart devices and that consumers had opted into such targeting. In three separate complaints first announced in May , the FTC alleged that Georgia-based media and marketing company CMG Media Corporation, which does business as  Cox Media Group , and two marketing firms it worked with, New Hampshire-based MindSift LLC  and Wisconsin-based  1010 Digital Works LLC ,  deceived customers by claiming they used a special algorithm to listen in on and detect pertinent conversations from smart devices in order to target ads to consumers within a specific geographic region. Contrary to these companies’ claims, however, the marketing service wasn’t based on voice data, and consumers hadn’t opted into this service. If the service had functioned as advertised, this collection and use of consumers’ voice data without adequate consent would itself violate the FTC Act. Under the proposed orders settling the FTC’s allegations,  CMG must pay $880,000 while both  MindSift and  1010 Digital Works  must each pay $25,000, which will be used to provide redress to CMG customers impacted by these practices. In addition, each defendant is prohibited from making any misrepresentation about the qualities or features of its advertising or marketing services; the collection and use of voice data and whether consumers have provided their consent to collect, use or disclose their voice data; and the geographic targeting capabilities of its advertising or marketing services. After receiving two comments on the proposed settlement orders, the Commission voted 2-0 to give final approval to the consent","url":"https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-finalizes-orders-cox-media-group-two-other-firms-settling-charges-they-deceived-customers-about","source":"Federal Trade Commission - Protecting America's Consumers"},{"description":"Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a  report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .  The  Board selected this topic  as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic.  Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the action, ranging from small and medium-sized enterprises (SMEs) to big companies active in many different industries and fields, as well as various types of public entities. The results of these national actions have been aggregated and analysed together allowing for targeted follow-up on both national and EU level.   Areas of improvement and main challenges The report lists the issues that were identified, along with a series of recommendations addressed to controllers, to help them implement the right to erasure. Seven recurring main challenges were identified by DPAs. The results confirmed some of the findings of the 2024 coordinated action on the right of access , for example when it comes to the lack of appropriate internal procedures to handle requests, or the lack of sufficient information provided to individuals. In addition, participating DPAs reported specific findings related to the reliance by some controllers on inefficient anonymisation techniques to handle erasure requests as an alternative to deletion. DPAs also noted inconsistent practices, and the difficulties faced by controllers regarding the determination of retention periods and the deletion of personal data in the context of back-ups. In addition, as the right to erasure is not an absolute right, some controllers face difficulties in assessing and applying the conditions for the exercise of this right, including in carrying out the different balancing tests between the right to erasure and other rights and freedoms.   Follow-up to help organisations comply  Extensive guidance, documents and templates exist at national level to help controllers comply with the right of erasure and help individuals exercise this right. In line with the Helsinki Statement’s objectives of making GDPR compliance easier and ensuring consistent interpretation and enforcement across Europe, the extensive guidance and templates already available at national level will be leveraged at EDPB level where appropriate.   Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs.  In 2023, the EDPB published the report on its first coordinated action on the  use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the  designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the  implementation of the right of access . The CEF 2026 action will be on the  obligations of transparency and information under the GDPR .   For further information: DA DPA:   EDPB vedtager rapport om dataansvarliges overholdelse af retten til sletning EL DPA: Ολοκλήρωση της συντονισμένης δράσης του","titre":"EDPB identifies challenges hindering the full implementation of the right to erasure","pubDate":"Wed, 18 Feb 2026 15:27:14 +0100","id":2703238,"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2026/edpb-identifies-challenges-hindering-full-implementation-right-erasure_en"},{"source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program","description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer","titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program","pubDate":"Wed, 17 Dec 2025 09:50:37 +0100","id":2577895},{"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","titre":"The French SA fines SOLOCAL €900 000","id":2170441,"pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en"},{"titre":"The French SA fines SOLOCAL 900 000 €","id":2130472,"pubDate":"Wed, 21 May 2025 15:52:14 +0200","description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en"},{"pubDate":"Thu, 10 Apr 2025 09:51:48 +0200","id":2044739,"titre":"FTC Surveillance Pricing Study Indicates Wide Range of Personal Data Used to Set Individualized Consumer Prices","description":"The Federal Trade Commission’s initial findings from its surveillance pricing market study revealed that details like a person’s precise location or browser history can be frequently used to target individual consumers with different prices for the same goods and services. The staff perspective is based on an examination of documents obtained by FTC staff’s 6(b) orders sent to  several companies in July aiming to better understand the shadowy market that third-party intermediaries use to set individualized prices for products and services based on consumers’ characteristics and behaviors, like location, demographics, browsing patterns and shopping history. Staff found that consumer behaviors ranging from mouse movements on a webpage to the type of products that consumers leave unpurchased in an online shopping cart can be tracked and used by retailers to tailor consumer pricing. “Initial staff findings show that retailers frequently use people’s personal information to set targeted, tailored prices for goods and services—from a person's location and demographics, down to their mouse movements on a webpage,” said FTC Chair Lina M. Khan. “The FTC should continue to investigate surveillance pricing practices because Americans deserve to know how their private data is being used to set the prices they pay and whether firms are charging different people different prices for the same good or service.” The FTC’s study of the 6(b) documents is still ongoing. The staff perspective is based on an initial analysis of documents provided by Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey & Co. Image The FTC’s 6(b) study focuses on intermediary firms, which are the middlemen hired by retailers that can algorithmically tweak and target their prices. Instead of a price or promotion being a static feature of a product, the same product could have a different price or promotion based on a variety of inputs—including consumer-related data and their behaviors and preferences, the location, time, and channels by which a consumer buys the product, according to the perspective. The agency will only release information obtained from a 6(b) study as long as all data has been aggregated or anonymized to protect confidential trade secrets from company respondents, and therefore the staff perspective only includes hypothetical examples of surveillance pricing.  The staff perspective found that some 6(b) respondents can determine individualized and different pricing and discounts based on granular consumer data, like a cosmetics company targeting promotions to specific skin types and skin tones. The perspective also found that the intermediaries the FTC examined can show higher priced products based on consumers’ search and purchase activity. As one hypothetical outlined, a consumer who is profiled as a new parent may intentionally be shown higher priced baby thermometers on the first page of their search results. The FTC staff found that the intermediaries worked with at least 250 clients that sell goods or services ranging from grocery stores to apparel retailers. The FTC found that widespread adoption of this practice may fundamentally upend how consumers buy products and how companies compete. As the FTC continues its work in this area, it is issuing a request for information   today seeking public comment on consumers’ experiences with surveillance pricing. The RFI also asks for comments from businesses about whether surveillance pricing tools can lead to competitors gaining an unfair advantage, and whether gig workers or employees have been impacted by the use of surveillance pricing to determine their compensation. Comments are due by April 17. The Commission voted 3-2 to allow staff to issue the report. Commissioners Andrew Ferguson and Melissa Holyoak issued a dissenting statement related to the release of the initial research summaries. The FTC has additional resources on the interim","url":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer","source":"Federal Trade Commission Concurrence communiqués"}]