[{"titre":"i-Dressup and a data security mess-up","id":3203250,"pubDate":"Thu, 08 Oct 2026 08:06:59 +0200","description":"i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they collect. According to an FTC settlement, i-Dressup fell short on both COPPA requirements. The complaint alleges i-Dressup failed to provide sufficient notice on its site of the information it collected online from kids, how it used it, its disclosure practices, and other specifics required by the COPPA Rule. The company’s direct notices to parents were deficient, too. Among other things, they didn’t include the COPPA-required statement that if parents don’t provide consent within a reasonable time, i-Dressup will delete their online contact information from its records. Stick with the story because that failure turned out to be particularly troubling. In addition to letting users play online games, i-Dressup featured a community where they could “explore their creativity and fashion sense with unique personal profiles” and interact with others. To register, i-Dressup required people to submit a user name, password, birthdate, and email address. If the birthdate indicated the person was under 13, the email field changed to “Parent’s Email.” Once the under-13 user filled in the required fields and clicked “Join Now,” i-Dressup collected the personal information and sent a message to the address entered into the Parent’s Email field. The person receiving the email could consent by clicking the “Activate Now!” button. However, if the parent didn’t give consent, i-Dressup retained the personal information it had collected from the child online. The FTC says the company’s failure to delete that information violated Section 312.5(c)(1) of the COPPA Rule. In addition to violating COPPA’s parental consent provisions, i-Dressup allegedly violated the Rule’s data security requirements . According to the FTC, i-Dressup stored and transmitted users’ personal information (including passwords) in plain text. In addition, the company failed to perform network vulnerability testing of its network, even for well-known threats like SQL attacks; it didn’t implement an intrusion detection and prevention system; and it didn’t monitor for potential security incidents. The upshot? The company learned that a hacker had gained entry to its network and accessed information about 2.1 million users, including approximately 245,000 users who indicated they were under 13. To settle the case , i-Dressup and its owners will pay a $35,000 civil penalty. They’re also prohibited from violating COPPA in the future, and can’t sell, share, or collect any personal information until they implement a comprehensive data security program and get independent biennial assessments. In addition, they’ll have to provide the FTC with an annual certification of compliance. The message for sites and operators covered by COPPA is that an effective system of parental consent is only the first step toward compliance. Section 312.8 of the COPPA Rule also requires you to “establish and maintain reasonable","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2019/04/i-dressup-data-security-mess"},{"source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business","titre":"FTC consumer protection year in review offers 2020 vision for your business","id":3203247,"pubDate":"Thu, 08 Oct 2026 08:06:58 +0200","description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus"},{"url":"https://www.ftc.gov/business-guidance/blog/2019/03/nixing-fix-warranties-mag-moss-restrictions-repairs","source":"FTC USA Business Blog Posts","description":"Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs lfair March 18, 2019 | 10:24AM Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs By Lesley Fair First, the bad news: That nifty purchase needs a repair. Now the good news for consumers: It’s still under warranty. But where can they go to get it fixed? Can the manufacturer restrict a consumer’s ability to go to the independent repair shop of their choice? Can the manufacturer use glue, non-standard screws, and proprietary diagnostic software that make it difficult for independent repair shops to fix things? Do limitations like these affect consumers’ rights under the Magnuson-Moss Warranty Act ? That’s the topic of Nixing the Fix: A Workshop on Repair Restrictions , an FTC event scheduled for July 16, 2019 . Enforced by the FTC, the Magnuson-Moss Warranty Act helps consumers make informed buying decisions and gives them access to remedies if the widget starts to fidget during the warranty period. One key consumer protection under Mag-Moss is that the law prohibits manufacturers from conditioning warranty coverage on the use of particular products or services. Here are some of the questions FTC staff intends to ask at Nixing the Fix : What’s the interplay between repair restrictions and the Magnuson-Moss Warranty Act’s anti-tying provision, which establishes that manufacturers can’t condition coverage on the use of parts or services identified by brand, trade, or corporate name? Do repair restrictions affect the market for extended warranties and service agreements? What types of restrictions are consumers running into when they try to get their stuff repaired? Are manufacturers’ restrictions having an impact on small fix-it businesses? Are manufacturers using software that may render products obsolete or unfixable if consumers engage in DIY or go to a local repair shop? Are repair restrictions necessary to reduce the risk of physical injury or to protect manufacturers from liability for products improperly repaired by others? Do consumers understand the effects of repair restrictions? We’re also looking for empirical research and data about the prevalence and impact of manufacturers’ repair restrictions. For example, what can you tell us about code that disables products that have been repaired by someone other than the manufacturer, product designs that make third-party repairs difficult (like attaching batteries with glue only the manufacturer can remove), contractual post-sale or licensing restrictions, or proprietary diagnostic software and replacement parts? Please send us your research and data by April 30, 2019. Do you have suggestions about possible panelists? Email us at nixingthefix@ftc.gov . Nixing the Fix will take place on July 16th at the FTC’s Constitution Center conference facility, 400 7th Street, S.W., in Washington, DC. It’s free and open to the public. You can file public comments online and we’ll keep the record open until September 16, 2019. Follow the Business Blog for more information about the agenda and for watch-the-webcast instructions.","pubDate":"Tue, 06 Oct 2026 08:06:23 +0200","id":3199073,"titre":"Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs"},{"description":"FTC challenges Online Trading Academy’s money-making claims lfair February 12, 2020 | 4:35PM FTC challenges Online Trading Academy’s money-making claims By Lesley Fair Ads for health products often target Boomer Consumers, but those aren’t the only claims pitched to people looking toward retirement. An FTC action alleges a company called Online Trading Academy has taken in more than $370 million by gearing its deceptive representations to that demographic. In addition, the complaint alleges violations of the Consumer Review Fairness Act. According to the FTC, the California-based operation, related companies, and three individual defendants advertise a “patented strategy” that consumers can apply “to any asset class including stocks, options, futures and currencies” to rake in big money. They claim their “training programs” – with price tags as high as $50,000 – will teach consumers how to “invest like the pros on Wall Street.” ”No matter your experience and goals,” people were told the defendants’ “proven” strategy was “designed to make money in any market, whether it’s going up or down.” The complaint recounts the process the defendants use to attract consumers through TV and radio ads, online promotions, and direct mail. First comes an in-person “preview” seminar. Next, people pay $299 for a three-day “orientation.” That’s where the defendants urge attendees to sign up for seminars costing thousands more. The defendants assign each attendee an “Education Counselor” – a/k/a salesperson working on commission – who follows up by phone or email. According to the complaint, the defendants train their Education Counselors not to “look like, act like or sound like, a traditional salesperson,” but instead to take on a “role” and lead consumers through “The Pain Funnel,” Q&A designed to overcome consumer qualms. To get people to sign up for more seminars, the defendants routinely offer to finance all or part of the cost with loans at 18%, with the promise to forgive the interest if the consumer pays the total off within six months. The FTC says that in some instances, the defendants lead buyers to believe they’ll be able to repay the loan quickly with money they’ll make using that “patented strategy.” So how much does Online Trading Academy say consumers will earn? A central theme of their pitch is “You don’t have to work on Wall Street to make money like Wall Street.” Infomercials feature purchasers claiming that “in three hours I made $12,000” or “I made $32,000 in less than seven trading days.” In a YouTube video, a retiree says he made “$40,000 in a single trade.” In addition, a speaker at a live event claimed consumers “could potentially make $50,000 of annual income with an account size as low as $5,000” because Online Trading Academy has “a patent on the fact that you can time the markets,” which “gives us the ability to know when to get in and when to get out, long-term and short-term.” Other speakers – including some of the named defendants – paint a picture of lavish lifestyles filled with international travel, a “super luxury car” every year, and homes in areas where kids have “live-in nannies, cooks, gardeners.” One speaker said the money he made using Online Trading Academy’s strategy allows him to live in an enclave so exclusive that a neighbor, a renowned Olympic gold medalist, taught his daughter to swim. But the facts paint a different picture. The FTC alleges the defendants don’t systematically collect data sufficient to substantiate their earnings claims. But even the evidence they do have gave them good reason to know their representations are deceptive. For starters, according to the FTC, the defendants know that few consumers who","pubDate":"Mon, 05 Oct 2026 08:07:09 +0200","id":3197414,"titre":"FTC challenges Online Trading Academy’s money-making claims","url":"https://www.ftc.gov/business-guidance/blog/2020/02/ftc-challenges-online-trading-academys-money-making-claims","source":"FTC USA Business Blog Posts"},{"url":"https://www.ftc.gov/business-guidance/blog/2012/06/speaking-spokeo-part-2-companys-allegedly-bogus-endorsements","source":"FTC USA Business Blog Posts","id":3195787,"pubDate":"Sat, 03 Oct 2026 14:06:13 +0200","titre":"Speaking of Spokeo: Part 2 — The company’s allegedly bogus endorsements","description":"Speaking of Spokeo: Part 2 — The company’s allegedly bogus endorsements wfg-adm109 June 13, 2012 | 12:25PM Speaking of Spokeo: Part 2 — The company’s allegedly bogus endorsements By Lesley Fair The lawsuit against data broker Spokeo is the FTC’s first Fair Credit Reporting Act case addressing the collection of online info — including data from social networking sites — when used in the context of employment screening.  But that’s not the only way the Spokeo settlement touches on social media.  The FTC also charged that Spokeo violated Section 5 by having employees post glowing recommendations of the company’s services on news and technology websites without disclosing their true identity. Perhaps just the work of a rogue cubicle occupant?  No, said the FTC.  According to the complaint , Spokeo directed its employees to write the comments.  Spokeo managers then edited what they wrote and had the staffers post the endorsements using account names provided by Spokeo.  The purpose, says the FTC, was to give readers the misleading impression that the laudatory words had been posted by independent consumers or business users of Spokeo. The FTC’s revisions to its Endorsement Guides made headlines a few years ago.  Ironically enough, the provision that seemed to attract the most attention is one that didn’t change.  It’s the law — and it’s always been the law under Section 5 — that consumers have a right to know when there’s a material connection between an advertiser and an endorser.  Here’s how the Guides put it:  \"When there exists a connection between the endorser and the seller of the advertised product that might materially affect the weight or credibility of the endorsement ( i.e., the connection is not reasonably expected by the audience), such connection must be fully disclosed.\" According to the FTC, by posting comments that conveyed the untruthful impression that they came from satisfied users of Spokeo’s services, Spokeo engaged in false and misleading practices.  To settle the endorsement count in the lawsuit, Spokeo has agreed that it won’t misrepresent, expressly or by implication, the status of any user of a product or service — for example, that someone is an independent, ordinary endorser if that’s not the case.  The company also will clearly and prominently disclose any material connection between an endorser and Spokeo (or any other entity advertising, selling, or promoting a product) when a connection exists.  What about the bogus endorsements already posted?  Spokeo has seven days to take all reasonable steps to pull them down. Looking for more about complying with the Endorsement Guides?  Read The FTC’s Revised Endorsement Guides: What People are Asking and watch this video: While you’re at it, share this post and those resources with your marketing staff, your ad agency, your PR firm, and anyone else who plays a role in your publicity and promotions. Next:  What the Spokeo settlement means for your business, your next ad campaign, and your job search"}]