[{"description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus","id":3203247,"source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business","titre":"FTC consumer protection year in review offers 2020 vision for your business","pubDate":"Thu, 08 Oct 2026 08:06:58 +0200"},{"pubDate":"Tue, 06 Oct 2026 14:06:39 +0200","url":"https://www.ftc.gov/business-guidance/blog/2011/04/ftcs-google-settlement-whats-buzz","titre":"The FTC's Google settlement: What's the buzz?","id":3200009,"description":"The FTC's Google settlement: What's the buzz? wfg-adm109 April 1, 2011 | 4:28PM The FTC's Google settlement: What's the buzz? By Lesley Fair “Sweet!  Check out Buzz.” “Nah, go to my inbox.” That was the intriguing choice facing Gmail users last year when Google launched Google Buzz, its social network. But according to a settlement announced this week by the FTC, the company violated the privacy promises it made to Gmail users and used deceptive tactics in the Buzz rollout. The story starts with Google’s privacy policy. From October 2004 until October 2010, Gmail users were told, \"Gmail stores, processes and maintains your messages, contact lists and other data related to your account in order to provide service to you.\"  On the subject of the choices users had about the use of their personal information in all of Google’s products, including Gmail, the privacy policy said, \"When you sign up for a particular service that requires registration, we ask you to provide personal information. If we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use.\"  According to the FTC, statements like that conveyed that Google would use information from people signing up for Gmail only for the purpose of providing them with email service and that Google would ask for their consent before using their info for any other purpose. So far, so good. But then came the roll-out of Google Buzz. The service allows users to share updates, comments, pictures, videos, and the like through “buzzes” made either publicly or privately to individuals or groups of users. When Buzz was launched, Gmail users were taken to a welcome screen that announced the new service and presented the “Sweet!” or “Nah” choice. If users clicked “Nah,” the FTC complaint alleges that their info was nonetheless shared in a number of ways. First, the user could still be “followed” by Gmail users who enrolled in Buzz. Second, if the Gmail user had previously created a Google profile, he or she could appear on the public Google profiles of Buzz enrollees who were following them. Third, a link to Buzz would show up on the list of links on the user’s Gmail page. If the user clicked on that link, he or she would be taken to the Buzz welcome screen and would be automatically enrolled in Buzz without any disclosure of that fact. In other words, users would be enrolled in certain features of Buzz even if they didn’t sign up. So much for “Nah.” The FTC’s complaint alleges that despite what it said in its privacy policy, Google didn’t use information from people signing up for Gmail just for the purpose of providing email service. Rather, the company used it to populate Buzz. Thus, said the FTC, the representations in Google’s privacy policy were false or misleading. Furthermore, the agency alleged that despite the promise in its privacy policy that Google would ask for consumers’ consent before using their information for another purpose, Google went ahead and used it to populate its social network without getting their permission. The FTC charged that was false or misleading and constituted a deceptive practice. The next part of the story:   The not-so-sweet results when users clicked the “Sweet!”","source":"FTC USA Business Blog Posts"},{"titre":"FTC recaps consumer complaint data for 2017: Who’s on the list?","url":"https://www.ftc.gov/business-guidance/blog/2018/03/ftc-recaps-consumer-complaint-data-2017-whos-list","pubDate":"Tue, 06 Oct 2026 08:06:24 +0200","description":"FTC recaps consumer complaint data for 2017: Who’s on the list? lfair March 1, 2018 | 5:17PM FTC recaps consumer complaint data for 2017: Who’s on the list? By Lesley Fair Once bitten, twice shy. That fundamental principle of human behavior is why reputable businesses that work hard to earn consumers’ confidence should support the FTC’s ongoing efforts to fight fraud. According to the FTC’s 2017 Consumer Sentinel Data Book , consumers reported losing a total of $905 million to fraud last year. That’s close to a billion bucks people won’t be able to spend on legitimate products and services from credible companies. That figure is up $63 million from last year, although the total number of reports received from consumers is down from 2.98 million in 2016 to 2.68 million in 2017. Topping the list that no industry wants to be on is debt collection, making up 23% of the total number of complaints. But there are two caveats: 1) that number is down from 2016; and 2) the high number of debt collection reports was due in part to reports submitted by a data contributor who collects complaints via a mobile app. Second on the list is identity theft at 14%. The injury to consumers came in two equally unpalatable flavors. Credit card fraud was the most common manifestation. Tax fraud was next, but the glimmer of hope there is that the total number of tax-related identity theft complaints fell by 46%. Winners of the dubious bronze medal were imposter scams , with consumers reporting financial losses of a whopping $328 million. Imposters wear many masks: “I’m with [big-name tech company] and your computer is riddled with viruses,” “Help, Grampa! I’ve been arrested and need bail money,” and “We’re from [government agency] and we’ll arrest you if you don’t pay us today.” Nearly one in five consumers who reported an imposter scam said they lost money to the fraud. For the first time, the Consumer Sentinel Data Book breaks out fraud losses by reported age groups and here’s a result that may surprise you: Consumers in their 20s reported losing money to fraud more often than those over 70. Among 20-somethings who reported fraud, 40% said they lost money. Compare that with the over-70 crowd, only 18% of whom reported a financial loss. But there’s a troubling aspect to that surprising factoid. When older adults did report losing money to a scammer, the loss was much greater. For example, people 80 and older reported median losses of $1,092 compared to $400 for those in their 20s. Wire transfers continue to be scammers’ preferred payment method and in 70% of the complaints we received, the fraudster contacted the consumer by phone. The top states for reporting fraud were Florida, Georgia and Nevada, while Michigan, Florida and California had the most reports about identity theft, per capita. Stats cats tell us that they find our state-by-state data dive helpful, so we’ve created a new webpage to make it easier to evaluate the information. The bottom line for business people: Educate.   Use your status in the community to spread the word to employees, industry colleagues, and friends about the latest forms of fraud. One way to stay in the know: Sign up for scam alerts from the FTC. Cooperate.  If people you know suspect that their identity has been compromised, send them to identitytheft.gov to create a personal recovery plan. (And remember that your company may have a legal obligation to provide identity theft victims and law enforcers with transaction records related to ID theft.) Report.   When you spot a scam, report it to the FTC . We’re talking about fraud directed to consumers and questionable promotions targeting small businesses. Your reports have helped the FTC and other law enforcement agencies put together cases against the con artists behind bogus business directories, office supply flimflams, and other forms of B2B fraud. Consumer Sentinel is an online database available to civil","id":3199077,"source":"FTC USA Business Blog Posts"},{"url":"https://www.ftc.gov/business-guidance/blog/2012/06/speaking-spokeo-part-2-companys-allegedly-bogus-endorsements","titre":"Speaking of Spokeo: Part 2 — The company’s allegedly bogus endorsements","pubDate":"Sat, 03 Oct 2026 14:06:13 +0200","source":"FTC USA Business Blog Posts","description":"Speaking of Spokeo: Part 2 — The company’s allegedly bogus endorsements wfg-adm109 June 13, 2012 | 12:25PM Speaking of Spokeo: Part 2 — The company’s allegedly bogus endorsements By Lesley Fair The lawsuit against data broker Spokeo is the FTC’s first Fair Credit Reporting Act case addressing the collection of online info — including data from social networking sites — when used in the context of employment screening.  But that’s not the only way the Spokeo settlement touches on social media.  The FTC also charged that Spokeo violated Section 5 by having employees post glowing recommendations of the company’s services on news and technology websites without disclosing their true identity. Perhaps just the work of a rogue cubicle occupant?  No, said the FTC.  According to the complaint , Spokeo directed its employees to write the comments.  Spokeo managers then edited what they wrote and had the staffers post the endorsements using account names provided by Spokeo.  The purpose, says the FTC, was to give readers the misleading impression that the laudatory words had been posted by independent consumers or business users of Spokeo. The FTC’s revisions to its Endorsement Guides made headlines a few years ago.  Ironically enough, the provision that seemed to attract the most attention is one that didn’t change.  It’s the law — and it’s always been the law under Section 5 — that consumers have a right to know when there’s a material connection between an advertiser and an endorser.  Here’s how the Guides put it:  \"When there exists a connection between the endorser and the seller of the advertised product that might materially affect the weight or credibility of the endorsement ( i.e., the connection is not reasonably expected by the audience), such connection must be fully disclosed.\" According to the FTC, by posting comments that conveyed the untruthful impression that they came from satisfied users of Spokeo’s services, Spokeo engaged in false and misleading practices.  To settle the endorsement count in the lawsuit, Spokeo has agreed that it won’t misrepresent, expressly or by implication, the status of any user of a product or service — for example, that someone is an independent, ordinary endorser if that’s not the case.  The company also will clearly and prominently disclose any material connection between an endorser and Spokeo (or any other entity advertising, selling, or promoting a product) when a connection exists.  What about the bogus endorsements already posted?  Spokeo has seven days to take all reasonable steps to pull them down. Looking for more about complying with the Endorsement Guides?  Read The FTC’s Revised Endorsement Guides: What People are Asking and watch this video: While you’re at it, share this post and those resources with your marketing staff, your ad agency, your PR firm, and anyone else who plays a role in your publicity and promotions. Next:  What the Spokeo settlement means for your business, your next ad campaign, and your job search","id":3195787},{"source":"FTC USA Business Blog Posts","description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","id":3194910,"url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers","titre":"Practice Fusion case suggests 6 health privacy pointers","pubDate":"Sat, 03 Oct 2026 08:09:37 +0200"},{"id":3191273,"description":"Is it amour – or scam-more? lfair February 11, 2021 | 12:17PM Is it amour – or scam-more? By Lesley Fair Online romance may begin with Panic! At The Disco’s High Hopes , but according to a new FTC Data Spotlight , all too often it ends with the conclusion that – to quote the J. Geils Band –  Love Stinks . Far be it from us to put a damper on Valentine’s Day, but reports to the Consumer Sentinel Network suggest that the injury inflicted by romance scams is on the rise. According to the new Data Spotlight , “For three years running, people have reported losing more money on romance scams than on any other fraud type identified in Sentinel. In 2020, reported losses to romance scams reached a record $304 million, up about 50% from 2019. For an individual, that meant a median dollar loss of $2,500.” Why the increase? The continued popularity of dating apps is part of the story, but the pandemic has played a part, too. For right now, the need for social distancing and masking makes the “meet cute” at the local coffee shop less likely. Of course, we’ve all heard heart-warming stories of romances that started on screen and blossomed IRL, but the Data Spotlight suggests that at least some of those digital dalliances may be hiding something more sinister. What does that have to do with you? We thought you’d never ask. Chances are that someone you know – a friend or family member perhaps – has a long-distance love they have yet to meet. A subtle word from you about the telltale signs of a romance scam could mean one less report to Consumer Sentinel in 2021 about a heart broken and a wallet emptied by a romance scammer. It can be a difficult topic to broach, but we have a sure-fire opener: “I just read the most fascinating thing on the website of the Federal Trade Commission, America’s consumer protection agency.” (What? That’s not your typical conversation starter? No Valentine for you!) Regardless of how you bring up the topic, Valentine’s Day offers a way to share some heart-to-heart hints. Romance scams can happen to anyone. According to the Data Spotlight, reports of money lost on romance scams increased for every age group in 2020. The 20-29 crowd saw the most notable spike, with the number of reports more than doubling since 2019. People between 40 and 69 were once again the most likely to report losing money to romance scams. And people 70+ reported the highest individual median losses at $9,475. Every picture tells a story, but some of those stories are fiction. Knowing that fetching photos can lure in a love, scammers routinely steal people’s snaps and pass themselves off as the person in the picture. To investigate their identity, try a reverse-image search of their profile picture or other photos they send you. If the picture is associated with another name or if the details don’t match up, you’re dealing with a scammer. Don’t mix romance with finance. We’ve always cautioned people not to wire money or send gift cards to online loves, but we have a new tip to add. Don’t let your guard down just because that special someone sends you money first. You can bet the money’s stolen. Next, they’ll want you to send it on for some cooked-up reason. This is how people become unwitting accomplices to money laundering. As soon as the requests for money start, it’s time to – depending on your musical generation – Go Your Own Way , bid them Bye Bye Bye , or make it clear that We Are Never Ever Getting Back Together . The FTC has more advice on how to spot a romance scam . ","source":"FTC USA Business Blog Posts","pubDate":"Thu, 01 Oct 2026 14:10:47 +0200","url":"https://www.ftc.gov/business-guidance/blog/2021/02/it-amour-or-scam-more","titre":"Is it amour – or scam-more?"},{"id":2959787,"description":"New data from the Federal Trade Commission reveal that people reported losing a staggering $3.5 billion to imposter scams in 2025, with reported losses increasing nearly three times since 2020. FTC data also show that people reported imposter scams more than any other fraud category in 2025—nearly one in three fraud reports were about imposter scams. These scams lured consumers through text, phone, email, social media, search engine results and other means. Some of the costliest impersonation scams start with a fake security alert, often from a bank. People are convinced to move money to “protect” it, with their losses often limited only by their available funds. Last year, people reported losing nearly $1 billion to business impersonators with the highest reported losses to bank impersonators—and about $920 million to government impersonators, up from $866 million and $789 million respectively in 2024. The FTC has seen a striking increase in reported fraud losses to all types of fraud—about $16 billion was reported lost in 2025, the highest on record and an increase of about 25% compared to the 2024 figure. “Consumers derive enormous benefits from competitive markets built on truthful information. But fraud undermines that foundation, impeding the market process and preventing markets from operating efficiently,” said Christopher Mufarrige, Director of the Bureau of Consumer Protection. “The FTC will use every tool available to combat one of the most pernicious forms of fraud—government and business impersonation—and to protect the integrity of the digital economy.” The data underscore the importance of the FTC’s work with the  Elder Justice Coordinating Council (EJCC) , which is working to help raise awareness of imposter scams and other scams impacting older adults as well as other consumers. This year, the FTC, along with the Department of Justice, Department of Health and Human Services and members of the EJCC, is leading the Never Ever campaign, a public-private coordinated consumer education effort to raise awareness of government and business imposter scams. In addition to the federal agency members of the EJCC , the campaign also includes private sector representatives such as the American Bankers Association, USTelecom, Google and Microsoft. To help the public spot imposter scams, EJCC members launched the Never Ever campaign, which is aimed at promoting messaging on the key actions that government and businesses will Never Ever take. The Never Ever campaign will run from June 15 to June 26, in conjunction with World Elder Abuse Awareness Day. This first-of-its-kind public-private partnership includes participants from a wide range of organizations and is aimed at directing consumers to a website that includes information and resources to help them avoid imposter scams and what to do if they spot one. Enforcement Actions To help combat impersonation scams, the FTC in 2024 finalized the Impersonation Rule. The Rule gives the agency stronger tools to combat and deter scammers who impersonate government agencies and businesses, enabling the FTC to file federal court cases seeking to get money back to injured consumers and civil penalties against rule violators. Since then, the FTC has vigorously enforced the rule and brought a dozen enforcement actions that have resulted in halting imposter schemes and obtained over $70 million in redress for consumers. In 2025, the FTC brought law enforcement actions under the Impersonation Rule against:  American Tax Service (IRS imposter scheme);  MediaAlpha (government imposter scheme to sell health insurance);  Click Profit (business imposter money making scam);  Blackstone Legal (phantom debt business imposter scheme) and  Accelerated Debt Settlement (government and business imposter scheme that targeted older adults for debt relief). More recently, the  FTC filed a complaint against Innovative Partners in April 2026 , alleging the operators","source":"Federal Trade Commission - Protecting America's Consumers","pubDate":"Tue, 16 Jun 2026 08:09:40 +0200","url":"https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025","titre":"FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2025/06/statement-grant-early-termination-ftcs-investigation-proposed-acquisition-kellanova-mars","titre":"Statement on the Grant of Early Termination of the FTC’s Investigation of the Proposed Acquisition of Kellanova by Mars","pubDate":"Thu, 26 Jun 2025 09:50:00 +0200","description":"Today, the FTC granted early termination of its review of Mars, Incorporated’s proposed acquisition of Kellanova. Mars is a global manufacturer of pet care, snacking, and food products. Kellanova owns legacy Kellogg brands, including in snacks, crackers, and frozen breakfasts, after spinning off its North American cereals business in 2023 as WK Kellogg Co. “The Commission cares deeply about any competition concerns that affect American consumers, including in food products,” said Daniel Guarnera, Director of the Bureau of Competition. “Commission staff closely reviewed every aspect of this transaction, including both specific product markets and potential portfolio effects from the acquisition. They turned over every stone needed to arrive at a robust assessment of the likely competitive effects of this transaction. After nearly a year of investigation, dozens upon dozens of interviews with non-parties at all levels of the supply chain (including large chains and small, independent businesses), extensive data analysis, sworn testimony from party witnesses, and the review of hundreds of thousands of documents, staff found that the evidence pointed in one direction: this transaction does not meet the standard for an anticompetitive merger set by Section 7 of the Clayton Act.” “In other countries, Mars and Kellanova offer different products than they do in the United States, and they face different market participants, consumer preferences, and shopping practices. Notably, Kellanova continues to sell breakfast cereal in other markets, including the European Union, that it does not sell in the United States,” continued Guarnera. “The Trump-Vance FTC takes an America First approach to antitrust enforcement. Our job is to protect competition and consumers in the United States. Our job is to determine whether there is a violation of American law that we can prove in court. And once we’ve concluded there is not, our job is to get out of the","id":2208210,"source":"Federal Trade Commission Concurrence communiqués"},{"pubDate":"Mon, 20 Jan 2025 15:49:16 +0100","url":"https://www.edpb.europa.eu/news/news/2025/cef-2024-edpb-identifies-challenges-full-implementation-right-access_en","titre":"CEF 2024: EDPB identifies challenges to the full implementation of the right of access","source":"EDPB News","id":1857297,"description":"Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exercised data subject rights.” Throughout 2024, 30 DPAs across Europe launched coordinated investigations into the compliance of controllers with the right of access, by opening formal investigations, assessing whether a formal investigation was warranted and/or carrying out fact-finding exercises.  A total of 1,185 controllers, consisting of small and medium-sized enterprises (SMEs) and big companies active in different industries and fields, as well as various types of public entities, responded to the action. Areas of improvement and main challenges The results suggest that more awareness raising about Guidelines 01/2022 is necessary , both at national and EU level, as the guidelines help controllers implement the right of access, explain how exercising this right can be made easier, and list the exceptions and limitations of the right to access. As a result of the 2024 CEF action, seven challenges were identified. One of them is the lack of documented internal procedures to handle access requests. In addition, inconsistent and excessive interpretations of the limits to the right of access were also observed, such as overly relying on certain exceptions to automatically refuse access requests. Another example is the barriers that individuals could encounter when exercising their right of access, such as  formal requirements or being requested to provide excessive identification documents. For each challenge identified, the report provides a list of non-binding recommendations to be taken into account by controllers and DPAs. Positive findings Despite the existing challenges, two thirds of participating DPAs evaluated the level of compliance of responding controllers with respect to the right of access from ‘average’ to ‘high’. One important factor identified as having an impact on the level of compliance was the volume of access requests received by controllers, as well as the size of the organisation. More specifically, large-sized controllers or controllers receiving more requests were more likely to reach a higher level of compliance than small organisations with less resources. Positive findings were observed across Europe. These include the implementation of best practices by controllers, such as user-friendly online forms enabling individuals to submit an access request easily as well as self-service systems to allow individuals to autonomously download their personal data in a few clicks and at any time. Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy, aimed at streamlining enforcement and cooperation among DPAs.  In the past three years, two previous CEF actions were carried out. The results of these national actions are aggregated and analysed together to generate deeper insight into the topic and allowing for targeted follow-up on both national and EU level. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the"}]