[{"source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business","description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus","titre":"FTC consumer protection year in review offers 2020 vision for your business","pubDate":"Thu, 08 Oct 2026 08:06:58 +0200","id":3203247},{"description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer","titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program","pubDate":"Wed, 17 Dec 2025 09:50:37 +0100","id":2577895,"source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program"},{"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/interplay-between-dsa-and-gdpr-edpb-adopts-guidelines_en","description":"Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by intermediary service providers and include references to GDPR concepts and definitions. While it is up to the competent authorities under the DSA - with the support of the European Board for Digital Services and EU courts - to interpret the DSA, there are a number of provisions which relate to the GDPR. These include: notice-and-action systems that help individuals or entities report illegal content recommender systems used by online platforms to automatically present specific content to the users of the platform with a certain relative order or prominence the provisions to ensure a high level of privacy, safety, and security of minors and prohibiting that profile-based advertising using their data is presented to them transparency of advertising by online platforms prohibition of profiling-based advertising using special categories of data  The EDPB guidelines help to understand how the GDPR should be applied in the context of DSA obligations. The EDPB also provides practical guidance relating to the cross-regulatory cooperation between authorities to coordinate enforcement which will provide more legal certainty for intermediary service providers and ultimately to protect the rights and freedoms of individuals. The guidelines will be subject to public consultation, providing stakeholders with the opportunity to comment and provide feedback. EDPB Chair Anu Talus said: “By clarifying the interplay between the DSA and the GDPR, these guidelines mark a significant step towards ensuring a coherent and effective EU digital rulebook, and they will help uphold the fundamental rights and freedoms of individuals. I hope that stakeholders, including the competent authorities under the DSA, will make the most of the opportunity to contribute to the public consultation\". More work in the pipeline Following these first guidelines on the interplay between the GDPR and the DSA, further work is underway with other regulators to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working on joint guidelines with the European Commission on the interplay between the Digital Markets Act (DMA) and the GDPR, as well as on joint guidelines on the interplay between the AI Act and EU data protection laws.","titre":"Interplay between the DSA and the GDPR: EDPB adopts guidelines","id":2368407,"pubDate":"Fri, 12 Sep 2025 15:51:31 +0200"}]