[{"description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus","pubDate":"Thu, 08 Oct 2026 08:06:58 +0200","id":3203247,"titre":"FTC consumer protection year in review offers 2020 vision for your business","url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business","source":"FTC USA Business Blog Posts"},{"description":"FTC announces first mobile app case wfg-adm109 August 15, 2011 | 9:41AM FTC announces first mobile app case By Lesley Fair There are some combinations that raise immediate compliance issues for responsible businesses — and kids’ privacy and mobile applications are among them.   A settlement announced by the FTC — the agency’s first involving a mobile app — sends the important message that consumer protection laws and rules apply with full force in the mobile marketplace. W3 Innovations, which does business as Broken Thumbs Apps, develops and distributes mobile apps.   Several of their apps, including the Emily’s Girl World, Emily’s Dress Up & Shop, and Emily’s Runway High Fashion apps, were directed to children and were marketed in the Games-Kids section of Apple’s App Store.  The Emily apps, which had more than 50,000 downloads, allow kids to play games, create virtual models, and design outfits. The apps encouraged them to email Emily’s Blog with shouts-outs to friends or requests for advice. The Children’s Online Privacy Protection Rule requires parental notice and consent before companies collect kids’ personal info online, whether through a website or a mobile app.  According to the FTC, W3 Innovations collected and maintained thousands of e-mail addresses from users of the Emily apps without giving notice of their information collection practices and without getting verifiable parental consent. That, says the FTC, violated the COPPA Rule. In addition to a $50,000 civil penalty, the settlement — which names both the company and its president — bars future COPPA violations and requires them to delete all kids’ personal information collected in violation of the Rule. Today the FTC also released Living Life Online , a resource for children with short articles, activities, quizzes, and an ask-the-expert column.  Being online is part of kids’ lives. Living Life Online helps them be better digital citizens. Share it with your children or with parents of kids wrestling with topics ranging from cyberbullying to cell phone bill shock.  Order free copies from the FTC’s bulk order page","titre":"FTC announces first mobile app case","id":3201055,"pubDate":"Wed, 07 Oct 2026 08:05:50 +0200","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2011/08/ftc-announces-first-mobile-app-case"},{"description":"Brussels, 16 April – During its latest plenary, the EDPB has adopted Guidelines on processing of personal data for scientific research purposes . In addition, the Board has created a team to speed up the finalisation of the guidelines on anonymisation. The EDPB has also adopted two opinions on the two sets of the Europrivacy certification criteria for approval as European Data Protection Seals, one of which to be used as a tool for transfers. Many areas of scientific research rely on the processing of individuals’ personal data, and this has driven significant scientific breakthroughs that benefit society. The rise of new technologies, such as artificial intelligence, also contributes to scientific progress by enabling researchers to use and analyse data in innovative ways. The main objective of the EDPB guidelines on scientific research is to provide more clarity for researchers and make GDPR compliance easier , while ensuring the protection of individuals’ fundamental rights . “Scientific research can drive societal progress and improve our daily lives.  Our guidelines facilitate innovative research by helping researchers to navigate the GDPR. The EDPB is committed to supporting the scientific community and unlocking the full potential of scientific research in the EU while upholding data protection rights.\" EDPB Chair, Anu Talus In its guidelines, the Board provides clarifications on the concept of ‘scientific research’ . To determine if the processing takes place for scientific research purposes in the meaning of the GDPR, the Board provides six key-indicative factors that should be considered, in addition to the nature, scope, context and purposes of processing. These are: 1) methodical and systematic approach, 2) adherence to ethical standard, 3) verifiability and transparency, 4) autonomy and independence, 5) objectives of the research, and 6) potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways. If the research activities meet these six factors, they can be presumed to constitute scientific research. Otherwise, the controller should justify and be able to demonstrate why the activities should be considered scientific research, within the meaning of the GDPR. Further processing for scientific research purposes is presumed to be compatible with the initial purpose for collecting individuals’ personal data. Therefore, controllers are not obliged to do the purpose compatibility test under the GDPR to determine if the new processing is compatible with the original purpose of collection. However, controllers must still make sure that the legal basis of the initial processing is also suitable for the further processing of personal data for scientific research purposes. Controllers can rely on “broad consent” where the purposes of research are not fully known at the time of collecting the personal data. In this case, researchers should respect ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. Controllers can also ask individuals to consent to different individual research projects separately, as soon as the purposes of those projects become known (dynamic consent). A combination of both broad and dynamic consent is also possible. In addition, the EDPB clarifies rights of individuals when their personal data are processed for scientific purposes. This includes the rights to erasure and object for which limitations may apply when personal data are processed for scientific research purposes. The Board provides examples to explain when the right to erasure can be considered likely to render impossible or seriously impair the objective of conducting scientific research. The EDPB also explains when controllers may reject an individuals’ objection to the processing of their personal data for scientific research purposes. This can be the case when processing is necessary for the performance of a task carried out for reasons of","titre":"EDPB brings clarity to data processing for scientific research, speeds up the finalisation of the anonymisation guidelines and approves first European data protection seal as a tool for transfers","id":2829942,"pubDate":"Thu, 16 Apr 2026 14:15:11 +0200","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2026/edpb-brings-clarity-data-processing-scientific-research-speeds-finalisation_en"},{"source":"Federal Trade Commission Concurrence communiqués","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/7-eleven-pay-record-45-million-penalty-settle-ftc-antitrust-order-violation-case","titre":"7-Eleven to Pay Record $4.5 Million Penalty to Settle FTC Antitrust Order Violation Case","id":2559842,"pubDate":"Tue, 09 Dec 2025 09:50:02 +0100","description":"7-Eleven, Inc. and its parent company, Seven & i Holdings Co., Ltd., (collectively 7-Eleven) will pay $4.5 million to settle a Federal Trade Commission lawsuit alleging that the convenience store chain violated a 2018 FTC consent order by acquiring a fuel outlet in St. Petersburg, Fla. without providing the Commission prior notice. The $4.5 million penalty marks the largest civil penalty ever collected in an FTC case involving a prior-notice violation. It is also the largest negotiated settlement of any order violation in the FTC Bureau of Competition’s history. “Under the Trump-Vance FTC, merger remedies that protect competition are once again on the table. But for merger remedies to work, firms must abide by the terms of their consent orders, and we will hold parties accountable when they don’t live up to their commitments,” said Daniel Guarnera, Director of the FTC’s Bureau of Competition. “7-Eleven failed to fulfill the terms of the FTC’s consent order and is now paying a record price. The FTC will not hesitate to protect the public by actively enforcing order violations and seeking penalties against future violators.” The settlement resolves an FTC lawsuit filed in 2023. That suit arose from a 2018 consent order to resolve the FTC’s antitrust claims that 7-Eleven’s $3.3 billion acquisition of 1,100 retail fuel outlets from Sunoco would harm competition and raise fuel prices for consumers in 76 local markets. In the consent order, 7-Eleven agreed to divest certain fuel outlets and to provide prior notice to the FTC before making future acquisitions of competing fuel outlets in the local markets. This prior notice allowed the FTC to investigate—and, if needed, file an enforcement action—if additional acquisitions by 7-Eleven harmed consumers in these local markets. The consent order specifically listed the St. Petersburg outlet as one that 7-Eleven could not acquire without providing the FTC with prior notice. According to the FTC’s complaint, 7-Eleven acquired the St. Petersburg fuel outlet in December 2018, in violation of the consent order. On March 25, 2022—over three years after 7-Eleven acquired the St. Petersburg outlet—7-Eleven first informed the Commission it had acquired the St. Petersburg outlet. The FTC found that 7-Eleven’s internal controls for ensuring compliance with the consent order were wholly inadequate and that the company failed to implement any meaningful systems to ensure compliance with the Commission order. In addition to the $4.5 million in civil penalties, 7-Eleven was required to divest the St. Petersburg outlet to a strong buyer. 7-Eleven also agreed to commit to additional prior approval and prior notice requirements, which will help ensure that the Commission is made aware of any attempts by 7-Eleven to further consolidate in the local fuel markets addressed in the FTC’s order.  The Commission vote authorizing staff to file the stipulated final judgment and order for permanent injunction and civil penalty was"},{"description":"Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said:   “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance for businesses and bringing enhanced legal certainty to them.  The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law.” How the DMA and the GDPR interact The DMA and the GDPR both protect individuals in the digital landscape , but their goals are complementary as they address interconnected challenges: individual rights and privacy in case of the GDPR and fairness and contestability of digital markets under the DMA.    Several activities regulated by the DMA entail the processing of personal data by gatekeepers and, in several provisions, the DMA explicitly refers to definitions and concepts included in the GDPR. The joint guidelines clarify how gatekeepers can implement these DMA provisions in accordance with EU data protection law . For example, the EDPB and the Commission specify which elements gatekeepers should consider in order to comply with the requirements of specific choice and valid consent under Art. 5(2) DMA and the GDPR, and thus to lawfully combine or cross-use personal data in core platform services. The EDPB and the Commission also address other provisions including those related to the distribution of third party apps and stores, data portability, data access requests and interoperability of messaging services.   Next steps The Board and the Commission have just launched a joint public consultation on the first version of the guidelines which will be open until 4 December 2025 .  This will be an opportunity for stakeholders to comment and provide feedback. All submissions will be published on the DMA website to which a link will be included on the EDPB website, after the consultation period has closed. The final text, incorporating input received during the consultation, will be prepared jointly by the Board and the Commission, and will be adopted by the EDPB and European Commission.   More guidelines on the way Following these first joint guidelines with the Commission, further work is underway to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working with the Commission, specifically with the AI Office, on joint guidelines on the interplay between the AI Act and EU data protection laws. Note to editors: The Digital Markets Act is one of the first regulatory tools that aims to tackle unfair practices of gatekeepers in digital markets. Gatekeepers are large digital platforms providing core platform services, such as online search engines, app stores, and messenger services. The main objective of the DMA is to make the markets in the digital sector fairer and more contestable. ","id":2425502,"pubDate":"Thu, 09 Oct 2025 15:53:21 +0200","titre":"DMA and GDPR: EDPB and European Commission endorse joint guidelines to clarify common touchpoints","url":"https://www.edpb.europa.eu/news/news/2025/dma-and-gdpr-edpb-and-european-commission-endorse-joint-guidelines-clarify-common_en","source":"EDPB News"},{"url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en","source":"EDPB News","description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","id":2170441,"titre":"The French SA fines SOLOCAL €900 000"},{"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","titre":"The French SA fines SOLOCAL 900 000 €","pubDate":"Wed, 21 May 2025 15:52:14 +0200","id":2130472,"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en"}]