[{"url":"https://www.ftc.gov/business-guidance/blog/2018/07/ftc-florida-ag-small-business-scrutinize-o-fishy-al-invoices","source":"FTC USA Business Blog Posts","description":"FTC, Florida AG to small business: Scrutinize “o-fishy-al” invoices lfair July 30, 2018 | 11:05AM FTC, Florida AG to small business: Scrutinize “o-fishy-al” invoices By Lesley Fair If it looks like a duck and quacks like a duck, it’s probably a duck. But the same can’t be said for a mailer that looks like an official invoice. It could be an “o- fishy -al” offer that deceptively mimics the appearance of a government document. A case filed by the FTC and the Florida Attorney General challenges the practice of sending mailers that allegedly create the false impression that small businesses are required to buy labor regulation posters from the sender. Consider what defendants Starwood Consulting, also doing business as Corporate Compliance Services, and company president Thomas Henry Fred, Jr., sent to small businesses. The mailers – which include a Washington, D.C., 202 area code – are titled “LABOR LAW COMPLIANCE REQUEST FORM” and include the warning “Failure to comply with posting regulations can lead to fines up to $17,000.” The mailers include a “Business ID” and instruct recipients to respond by a certain date. Small businesses can’t miss the purported consequences of ignoring the letter: Your business is required by federal law to post a current compliant labor law poster in the workplace. Federal law requires that this poster be placed on the property of the business. Whether you have 1 employee or 1,000 you must post current employment posters in the workplace. The poster must also include information about workers compensation benefits. Pursuant to federal law 29 USC Sec. 999(i) & 29 USC Sec. 2005 penalties and risks of non-compliance with posting regulations can lead to potential fines of $17,000 per instance, for failing to post federally required information. Further, lawsuits can be tolled based on failing to display mandatory posters. . . . To obtain your Federal employment labor law poster, please detach the above coupon and return it in the enclosed envelope with your document processing fee of $84.00. The mailer continues: “IMPORTANT! FOLLOW INSTRUCTIONS EXACTLY WHEN COMPLETING THIS FORM.” Those instructions include directions to detach the “payment coupon,” return it with the “document fee” of $84, and keep the bottom portion as the “official receipt.” The enclosed return envelope is addressed to “Corporate Compliance Services, Compliance Processing Center.” That’s a description of the mailer, but here are the facts, according to the FTC and the AG. First, the mailer isn’t from a government entity or affiliate. Starwood Consulting and its d/b/a Corporate Compliance Services are private companies in the business of selling those posters. In addition, despite the 202 area code, the defendants have no operations in Washington and posters similar to the ones the defendants peddle are available for free from the U.S. Department of Labor. What about those statutory provisions referring to “potential fines of $17,000 per instance”? In fact, neither of those citations has anything to do with labor posters. 29 U.S.C. § 999(i) refers to repealed provisions of the Young Adult Conservation Corps and 29 U.S.C. § 2005 addresses the Employee Polygraph Protection Act. According to the complaint , recipients of the mailer are often small businesses that have recently incorporated or established limited liability companies. What’s more, some businesses say they never received the posters they paid for. Others report they got second notices that they had to pay another $84 fee to get an updated poster. Despite a small “disclaimer” at the bottom of the reverse side of the mailer that “[t]his offer serves as a solicitation and not to be intended as a bill due,” the FTC and the AG say that business owners were misled and filed more than 250 complaints about the company. (According to the Better Business","pubDate":"Mon, 05 Oct 2026 14:07:45 +0200","id":3198177,"titre":"FTC, Florida AG to small business: Scrutinize “o-fishy-al” invoices"},{"url":"https://www.ftc.gov/business-guidance/blog/2017/08/stick-security-require-secure-passwords-authentication","source":"FTC USA Business Blog Posts","id":3197409,"pubDate":"Mon, 05 Oct 2026 08:07:08 +0200","titre":"Stick with Security: Require secure passwords and authentication","description":"Stick with Security: Require secure passwords and authentication lfair August 11, 2017 | 10:47AM Stick with Security: Require secure passwords and authentication By Thomas B. Pahl, Acting Director, FTC Bureau of Consumer Protection To make it harder for hackers to bluff their way onto a computer network, careful companies follow the advice of Start with Security and require strong authentication practices . We’ve considered FTC settlements, closed investigations, and the questions we get from businesses about implementing good authentication “hygiene.” Here are some tips on using effective authentication procedures to help safeguard your network. Insist on long, complex, and unique passwords. A password’s very reason for being is to be easy for a user to remember, but hard for a fraudster to figure out. Obvious choices like ABCABC, 121212, or qwerty are the digital equivalent of a “hack me” sign. Furthermore, experts have determined that passphrases or longer passwords are generally harder to crack. The smarter strategy is for companies to think through their standards, implement minimum requirements, and educate users about how to create stronger passwords. Also, when you install software, applications, or hardware on your network, computers, or devices, change the default password immediately. And if you design products that require consumers to use a password, configure the initial set-up so they have to change the default password. Example: A staff member attempts to select payroll as the password for the database that includes employee payroll information. The company sets up its system to reject an obvious choice like that. Example: To access the corporate network, a business allows employees to type in their username and a shared password common to everyone who works there. Employees are also allowed to use that shared password to access other services on the system, some of which contain sensitive personal information. The more prudent policy would be to require strong, unique passwords for each employee and to insist that they use different passwords to access different applications. Example: At a staff meeting, a company’s IT manager offers tips for employees about good password hygiene. She explains that passphrases or longer passwords are better than short passwords based on standard dictionary words or well-known information (for example, a child’s name, a pet, a birthday, or a favorite sports team). By establishing a more secure corporate password standard and educating employees about implementing it, the IT manager is taking a step to help her company reduce the risk of unauthorized access. Store passwords securely. A company’s first line of defense against data thieves is a workforce trained to keep passwords secret. But even the strongest password is ineffective if an employee writes it on a sticky note on her desk or shares it with someone else. Train your staff not to disclose passwords in response to phone calls or emails, including ones that may appear to be coming from a colleague. Con artists have been known to impersonate corporate officials by spoofing phone numbers or email addresses. A compromised password poses a particular risk if it can be used to open the door to even more sensitive information – for example, a database of other user credentials maintained on the network in plain, readable text. Make it difficult for data thieves to turn a lucky password guess into a catastrophic breach of your company’s most sensitive data by implementing policies and procedures to store credentials securely. Example: A new employee gets a call from someone who claims to be the company’s system administrator. The caller asks him to verify his network password. Because the new staffer learned about impersonation scams at an in-house security orientation, he refuses to disclose his password and instead reports the incident to the appropriate person in the company. Example: A company keeps user credentials and other passwords in plain"},{"titre":"Practice Fusion case suggests 6 health privacy pointers","id":3194910,"pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2026/10/ftc-secures-settlement-protects-small-businesses-illegal-price-discrimination","source":"Federal Trade Commission Concurrence communiqués","pubDate":"Sat, 03 Oct 2026 08:09:36 +0200","id":3194908,"titre":"FTC Secures Settlement that Protects Small Businesses from Illegal Price Discrimination","description":"The Federal Trade Commission secured a settlement agreement with Southern Glazer’s Wine and Spirits LLC, the nation’s largest distributor of wine and spirits, that will redress allegedly illegal price discrimination practices and make it easier for small businesses to compete against large chain retailers. The sweeping settlement covers nearly all Southern wine and spirits sales to the five largest chain retailers in 26 states. The settlement will also provide direct cash payments to harmed small businesses if an independent monitor finds that Southern violates the settlement order going forward. “This settlement marks a significant milestone for the FTC in its enforcement of the Robinson-Patman Act, which Congress enacted to empower small businesses to compete against large ones,” said Daniel Guarnera, Director of the FTC’s Bureau of Competition. “Small businesses are an invaluable part of the American economy and way of life. The FTC is committed to ensuring that all businesses, no matter their size, can compete on a fair and level playing field to serve their customers and boost the entire American economy.” The FTC’s settlement with Southern delivers a successful conclusion to the Commission’s first enforcement action under the Robinson-Patman Act in a generation. Under the terms of a proposed stipulated order filed by the FTC , Southern will face limitations on its ability to charge small, independent retailers higher prices for wine and spirits than it charges competing large retail chains.  The FTC’s settlement resolves a  lawsuit brought by the Commission in 2024, which alleges that Southern violated the Robinson-Patman Act by depriving small, independent businesses access to discounts and rebates that were available to large competitors. As alleged in the complaint, these pricing practices interfere with the ability of independent retailers to compete against large national and regional chains and big box stores. Under the Robinson-Patman Act, it is generally unlawful for sellers to engage in price discrimination that harms competition by charging higher prices to disfavored retailers that purchase similar goods. According to the FTC’s complaint, Southern charged significantly higher prices for sales of identical bottles of wine and spirits during the same time period to independent retailers as compared to competing large chains, like Total Wine, Walmart and Kroger, even when the stores were located a few miles or even a few blocks from each other. Southern engaged in discriminatory pricing via a variety of mechanisms, such as by offering discounts and rebates to large buyers that were inaccessible to small competitors and were not justified by differences in the cost of distributing products to different retailers, the FTC’s complaint further alleged.  Settlement Terms  To resolve the FTC’s complaint, Southern has agreed to a series of conditions that will disincentivize the company from engaging in discriminatory pricing and compensate independent retailers if they are harmed. Specifically, the terms of the proposed stipulated order target “paired” transactions where Southern sells a product to a chain retailer at one price while contemporaneously selling that same product to a nearby independent retailer at a significantly higher price.  Southern will be in violation of the FTC’s proposed stipulated order, if, among other conditions, the paired transactions involve:  Significant price discrimination (exceeding a maximum threshold based on state-specific operating costs) Recurring price discrimination (in the aggregate, exceeding $5,000 over a 12-month period) Where a set of discriminatory paired transactions meets certain specifications, Southern can resolve the violation by paying the independent retailer 1.5 times the full aggregated price-differential amount. If Southern does not redress the price discrimination, the FTC can bring an enforcement action, and, if the Commission"},{"titre":"Pink slip slip-up: First FTC cases challenging deceptive car title loans","id":3192605,"pubDate":"Fri, 02 Oct 2026 08:12:17 +0200","description":"Pink slip slip-up: First FTC cases challenging deceptive car title loans lfair January 30, 2015 | 9:12AM Pink slip slip-up: First FTC cases challenging deceptive car title loans By Lesley Fair She’s got a competition clutch with four on the floor And she purrs like a kitten ‘til the lake pipes roar. And if that ain’t enough to make you flip your lid, There's one more thing. I got the pink slip, Daddy. Back in the days of the Beach Boys’ “Little Deuce Coupe,” the only risk to a car title – the pink slip – was when hot rodders bet them on drag races.The FTC just announced its first two settlements with car title lenders that underscore additional risks to consumers’ pink slips and wallets. What should other companies consider if they want to avoid crossing the yellow line? The complaints challenge allegedly illegal practices by First American Title Lending of Georgia, which operates over 30 locations in that state, and Finance Select, which does business as Fast Cash Title Pawn at five Georgia locations and two in Alabama. What’s a car title loan? It’s typically a high-cost, short-term loan secured with a consumer’s free-and-clear car title. The lender holds on to the title as long as payments keep coming in. Of course, if consumers don’t pay, the lender takes the car. Car title loans tend to run between $1,000 and $10,000. They have high interest rates – the typical APR can be a whopping 300% – and short repayment periods, sometimes only 30 days. Each payment after that first month is called a “renewal.” Given that many consumers who take out car title loans are in financial distress, it’s not surprising that loans may extend over a much longer period. According to the FTC, the average is more like eight renewals. In addition to holding the consumer’s car title, the lender charges monthly fees, sometimes as much as 25% of the amount borrowed per month. That means that after eight renewals, a consumer taking out a $1,000 loan could wind up paying $2,000 in fees. The FTC says the companies’ ads lured consumers in with promises of “zero” interest, but then failed to clearly and conspicuously disclose hidden conditions attached to those eye-catching deals. For example, First American Title Lending touted “0% interest” in big headlines on websites, billboards, newspaper ads, yard signs, and elsewhere. What consumers weren’t clearly told was that they’d only get the 0% rate if they were new customers, if they paid by money order or certified funds, and if they paid in full within 30 days. If it took them longer to pay – the norm in the industry – consumers would have to pony up hefty finance charges calculated back to Day 1 of that \"0% interest\" loan, as well as the fees that started on Day 31. According to the complaint, Fast Cash Title Pawn similarly advertised “0% Title Loans,” sometimes adding “1st 30 days 0%,” without clearly and conspicuously disclosing the substantial strings that were attached – including that if the consumer didn’t pay in full within 30 days, they’d have to pay the finance charge for the first 30 days in addition to charges that kicked in on Day 31.  The lawsuits allege that the companies’ practices violate the FTC Act.  The FTC says First American Title Lending also violated the Truth in Lending Act and Reg Z. Under the proposed settlements, the companies will have to clearly disclose all the qualifying terms associated with getting a loan at the advertised rate and what the finance charge would be after an introductory period ends. The orders also prohibit misrepresentations about material terms of any loan agreement. The FTC’s message to members of the industry is that they’re not flying (driving?) under the radar. Truth-in-advertising standards apply to car title loans, too. What's more, companies will be held to well-established principles of","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2015/01/pink-slip-slip-first-ftc-cases-challenging-deceptive-car-title-loans"},{"titre":"FTC takes on unproven health claims and “own-dorsements”","pubDate":"Wed, 30 Sep 2026 14:10:25 +0200","id":3187485,"description":"FTC takes on unproven health claims and “own-dorsements” lfair March 19, 2020 | 4:38PM FTC takes on unproven health claims and “own-dorsements” By Lesley Fair It’s a disturbing trend. Companies are targeting older consumers, claiming to have easy answers for serious diseases for which there may not be a proven cure. That’s one allegation in the FTC’s action against Nevada-based telemarketer Health Center, Inc.   Another count challenges what we call “own-dorsements.” According to Health Center’s telemarketing scripts, websites, social media, and testimonials from supposedly satisfied customers, the company’s Rejuvi-Cell oral spray and Rejuvi-Sea and Rejuvi-Stem pills could treat a broad range of medical conditions: everything from cancer, Alzheimer’s disease, and Parkinson’s disease to hepatitis, heart attacks, and high cholesterol. In promoting the products, which sold in packages priced between $350 and $800, the company checked the buzzword boxes with science-y sounding terms like homeopathic , adult stem cell enhancement , and marine phytoplankton . The company claimed that diseases like diabetes, rheumatoid arthritis, and dementia “could be greatly reduced if not eliminated” through the use of its products. According to the complaint , Health Center’s telemarketers – who were instructed to follow the scripts word-for-word – told consumers the main ingredient of Rejuvi-Sea “alkalizes your body . . . so you can’t grow cancer cells.” Then there were heartfelt testimonials from purported customers who described themselves as “walking on air” and “amazed and redeemed,” thanks to the products. But the FTC says the company hasn’t conducted any studies demonstrating the products cure or treat any diseases or health conditions and there are no human clinical studies in the scientific literature to that effect. What’s more, the lawsuit alleges that some of those glowing endorsements that appeared to come from satisfied customers across the country were actually “own-dorsements” – testimonials from Health Center’s own employees. To settle the case , the defendants have agreed to injunctive provisions, including a requirement that a broad range of health claims must have the support of randomized, double-blind, and placebo-controlled human clinical testing. Almost all of the $8.6 million judgment will be suspended, based on their financial condition. Aside from the obvious points that the FTC continues to take a close look at cures targeting older consumers and that companies shouldn’t palm off endorsements from employees as independent opinions, the case illustrates two other important principles. First, the defendants’ unlawful practices were the subject of an earlier enforcement action by the Iowa Attorney General. Companies shouldn’t have to be told once of the need to substantiate their health claims – and they certainly shouldn’t have to be told twice. Second, the complaint includes a count for violating the Telemarketing Sales Rule , which prohibits misrepresentations about “any material aspect of the performance, efficacy, nature, or central characteristics of goods or services that are the subject of a sales offer.” That’s yet another reason to keep your telemarketing efforts above board .","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2020/03/ftc-takes-unproven-health-claims-own-dorsements"},{"description":"FleetCor and its CEO will pay $100 million to settle a Federal Trade Commission administrative action alleging that the company charged its customers, who overwhelmingly are small businesses, undisclosed fees in connection with their use of fuel cards that FleetCor falsely promised businesses would save them money. In a complaint first filed in federal court in 2019 , the FTC alleged that FleetCor Technologies Inc., now known as Corpay Inc., and its CEO Ronald Clarke imposed a broad array of unauthorized fees that its customers never knew about and did not agree to pay, totaling hundreds of millions of dollars and harming tens of thousands of customers.  In addition, FleetCor charged late fees to customers who had either paid on time or were prevented by FleetCor from paying on time. FleetCor also misrepresented the gas savings, fraud-control features, and fees associated with its fuel cards. “FleetCor deceived its small business customers by promising fuel savings that never materialized, while unfairly charging them hidden and unauthorized fees,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “In addition to the relief the FTC has obtained in federal court, this order will help return money to the customers the company took advantage of.” According to the complaint, FleetCor often waited to begin charging many fees until several billing cycles passed, making the fees less noticeable to consumers. The complaint also alleged that FleetCor’s invoices did not disclose that any fees were being charged, requiring customers to proactively view other account management reports. Even on those documents, many fees were obscured among other information or not listed at all. In 2023, a federal district court entered summary judgment for the FTC on all counts, finding that FleetCor had charged its customers hidden or otherwise unauthorized fees and misrepresented the gas savings and fees associated with FleetCor’s fuel cards. The court-imposed order permanently prohibits FleetCor from: billing a customer for any charge unless FleetCor has obtained the customer’s express informed consent and provided clear and unavoidable information about the charge; hiding material information about a charge behind a hyperlink; and making deceptive claims about its fuel cards. In 2026, a federal appeals court upheld the summary judgment against FleetCor on all counts and affirmed the permanent injunction against it.  The court affirmed the judgment against Clarke on all but one count and vacated the injunction as to Clarke.  As part of the settlement order with the FTC, FleetCor and Clarke will pay $100 million, which will be used to provide redress to the company’s business customers harmed by its practices. FleetCor and Clarke have also agreed not to oppose reimposition of a federal court injunction against Clarke.  The Commission vote to accept the consent agreement was 1-0-1. FTC Chairman Andrew N. Ferguson is recused. The FTC will publish a description of the consent agreement in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE: When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to","titre":"FleetCor Agrees to Pay $100 Million to Resolve Administrative Action After Federal Court Finds that It Violated the FTC Act by Charging Unauthorized Fees","id":3160549,"pubDate":"Fri, 18 Sep 2026 08:08:58 +0200","source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2026/09/fleetcor-agrees-pay-100-million-resolve-administrative-action-after-federal-court-finds-it-violated"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-states-sue-amazon-over-secret-ad-surcharge-scheme","source":"Federal Trade Commission - Protecting America's Consumers","description":"Today, 22 states joined the Federal Trade Commission in filing suit against Amazon, alleging that the company engaged in deceptive and unfair practices that secretly inflated prices in its online search advertising auctions. The complaint   alleges that, for over seven years, Amazon has covertly and substantially increased the prices that more than one million brands and sellers were required to pay to advertise on its platform. As a result, the complaint alleges that Amazon’s scheme has likely extracted tens of billions of dollars from its unwitting advertising customers. “When one of the world’s largest online retailers engages in unfair and deceptive conduct, the impact can be staggering,” said Chairman Andrew N. Ferguson. “Amazon has millions of advertising customers who were misled into paying significantly higher prices. These higher costs were largely passed on to American consumers. The FTC under President Trump won’t allow this deception to continue.” The FTC, along with the attorneys general of Alaska, Arizona, California, Colorado, Florida, Idaho, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maryland, Nebraska, New Jersey, New York, North Carolina, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Vermont and Washington, allege Amazon has imposed undisclosed surcharges on its advertising customers, which include over 500,000 small- and medium-sized businesses that participated in auctions for advertising placements on Amazon.com and its mobile app. In these auctions, prospective advertisers bid to place Sponsored Product ads, Sponsored Brands ads and Display Ads alongside the results that appear when a consumer searches for a product using a keyword on Amazon’s store. Placements are auctioned to the highest-ranked bidder for each keyword. As described in the complaint, Amazon has represented to prospective advertisers for years that Amazon runs “second price” auctions where the winner of the auction would only pay “one cent more than the next highest bidder” for each successful bid for an advertising keyword. However, in practice, the complaint alleges that Amazon has charged its Sponsored Products advertisers their own winning bid close to 80% of the time and has effectively converted its nominally “second price” auction into a first price auction. According to the complaint, Amazon’s “second price” auctions have been described by Amazon, and understood by advertisers, to be run as generalized second-price, or GSP auctions, which have been the accepted industry standard for digital advertising placements. The complaint states that Amazon has made these or similar representations on its website, in training videos and in other public-facing materials, as well as in presentations made to advertisers by its hundreds of sales personnel.  The type of auction matters to advertisers because it impacts how they bid. In a sealed first-price auction—the type of auction where winners pay the amount of their winning bid—bidders run the risk that they might overbid. So, in repetitive auctions for the same goods, they will often reduce their bid to determine what the minimum amount needed to win future auctions might be. This is called bid shading. In second-price auctions, bidders are more likely to bid higher, closer to their true value for the product, because they will only be liable to pay the least bid amount needed to win under the auction’s rules.  As alleged in the complaint, Amazon told advertisers it ran a GSP, but for years its auction pricing had “a surcharge hidden in it,” in the words of one internal Amazon document. The complaint alleges that, beginning in 2019, Amazon changed its auction rules without notice by adding an undisclosed surcharge that Amazon referred to internally as a “soft reserve price.” This resulted in advertisers paying substantially more than the price determined by the GSP auction.  According to the complaint, Amazon","pubDate":"Tue, 01 Sep 2026 08:10:10 +0200","id":3127461,"titre":"FTC, States Sue Amazon Over Secret Ad Surcharge Scheme"},{"url":"https://www.edpb.europa.eu/news/news/2026/edpb-identifies-challenges-hindering-full-implementation-right-erasure_en","source":"EDPB News","description":"Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a  report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .  The  Board selected this topic  as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic.  Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the action, ranging from small and medium-sized enterprises (SMEs) to big companies active in many different industries and fields, as well as various types of public entities. The results of these national actions have been aggregated and analysed together allowing for targeted follow-up on both national and EU level.   Areas of improvement and main challenges The report lists the issues that were identified, along with a series of recommendations addressed to controllers, to help them implement the right to erasure. Seven recurring main challenges were identified by DPAs. The results confirmed some of the findings of the 2024 coordinated action on the right of access , for example when it comes to the lack of appropriate internal procedures to handle requests, or the lack of sufficient information provided to individuals. In addition, participating DPAs reported specific findings related to the reliance by some controllers on inefficient anonymisation techniques to handle erasure requests as an alternative to deletion. DPAs also noted inconsistent practices, and the difficulties faced by controllers regarding the determination of retention periods and the deletion of personal data in the context of back-ups. In addition, as the right to erasure is not an absolute right, some controllers face difficulties in assessing and applying the conditions for the exercise of this right, including in carrying out the different balancing tests between the right to erasure and other rights and freedoms.   Follow-up to help organisations comply  Extensive guidance, documents and templates exist at national level to help controllers comply with the right of erasure and help individuals exercise this right. In line with the Helsinki Statement’s objectives of making GDPR compliance easier and ensuring consistent interpretation and enforcement across Europe, the extensive guidance and templates already available at national level will be leveraged at EDPB level where appropriate.   Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs.  In 2023, the EDPB published the report on its first coordinated action on the  use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the  designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the  implementation of the right of access . The CEF 2026 action will be on the  obligations of transparency and information under the GDPR .   For further information: DA DPA:   EDPB vedtager rapport om dataansvarliges overholdelse af retten til sletning EL DPA: Ολοκλήρωση της συντονισμένης δράσης του","pubDate":"Wed, 18 Feb 2026 15:27:14 +0100","id":2703238,"titre":"EDPB identifies challenges hindering the full implementation of the right to erasure"},{"titre":"DMA and GDPR: EDPB and European Commission endorse joint guidelines to clarify common touchpoints","pubDate":"Thu, 09 Oct 2025 15:53:21 +0200","id":2425502,"description":"Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said:   “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance for businesses and bringing enhanced legal certainty to them.  The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law.” How the DMA and the GDPR interact The DMA and the GDPR both protect individuals in the digital landscape , but their goals are complementary as they address interconnected challenges: individual rights and privacy in case of the GDPR and fairness and contestability of digital markets under the DMA.    Several activities regulated by the DMA entail the processing of personal data by gatekeepers and, in several provisions, the DMA explicitly refers to definitions and concepts included in the GDPR. The joint guidelines clarify how gatekeepers can implement these DMA provisions in accordance with EU data protection law . For example, the EDPB and the Commission specify which elements gatekeepers should consider in order to comply with the requirements of specific choice and valid consent under Art. 5(2) DMA and the GDPR, and thus to lawfully combine or cross-use personal data in core platform services. The EDPB and the Commission also address other provisions including those related to the distribution of third party apps and stores, data portability, data access requests and interoperability of messaging services.   Next steps The Board and the Commission have just launched a joint public consultation on the first version of the guidelines which will be open until 4 December 2025 .  This will be an opportunity for stakeholders to comment and provide feedback. All submissions will be published on the DMA website to which a link will be included on the EDPB website, after the consultation period has closed. The final text, incorporating input received during the consultation, will be prepared jointly by the Board and the Commission, and will be adopted by the EDPB and European Commission.   More guidelines on the way Following these first joint guidelines with the Commission, further work is underway to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working with the Commission, specifically with the AI Office, on joint guidelines on the interplay between the AI Act and EU data protection laws. Note to editors: The Digital Markets Act is one of the first regulatory tools that aims to tackle unfair practices of gatekeepers in digital markets. Gatekeepers are large digital platforms providing core platform services, such as online search engines, app stores, and messenger services. The main objective of the DMA is to make the markets in the digital sector fairer and more contestable. ","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/dma-and-gdpr-edpb-and-european-commission-endorse-joint-guidelines-clarify-common_en"},{"url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en","source":"EDPB News","pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","id":2170441,"titre":"The French SA fines SOLOCAL €900 000","description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)"},{"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","titre":"The French SA fines SOLOCAL 900 000 €","pubDate":"Wed, 21 May 2025 15:52:14 +0200","id":2130472,"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en"},{"source":"Federal Trade Commission Concurrence communiqués","url":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer","description":"The Federal Trade Commission’s initial findings from its surveillance pricing market study revealed that details like a person’s precise location or browser history can be frequently used to target individual consumers with different prices for the same goods and services. The staff perspective is based on an examination of documents obtained by FTC staff’s 6(b) orders sent to  several companies in July aiming to better understand the shadowy market that third-party intermediaries use to set individualized prices for products and services based on consumers’ characteristics and behaviors, like location, demographics, browsing patterns and shopping history. Staff found that consumer behaviors ranging from mouse movements on a webpage to the type of products that consumers leave unpurchased in an online shopping cart can be tracked and used by retailers to tailor consumer pricing. “Initial staff findings show that retailers frequently use people’s personal information to set targeted, tailored prices for goods and services—from a person's location and demographics, down to their mouse movements on a webpage,” said FTC Chair Lina M. Khan. “The FTC should continue to investigate surveillance pricing practices because Americans deserve to know how their private data is being used to set the prices they pay and whether firms are charging different people different prices for the same good or service.” The FTC’s study of the 6(b) documents is still ongoing. The staff perspective is based on an initial analysis of documents provided by Mastercard, Accenture, PROS, Bloomreach, Revionics and McKinsey & Co. Image The FTC’s 6(b) study focuses on intermediary firms, which are the middlemen hired by retailers that can algorithmically tweak and target their prices. Instead of a price or promotion being a static feature of a product, the same product could have a different price or promotion based on a variety of inputs—including consumer-related data and their behaviors and preferences, the location, time, and channels by which a consumer buys the product, according to the perspective. The agency will only release information obtained from a 6(b) study as long as all data has been aggregated or anonymized to protect confidential trade secrets from company respondents, and therefore the staff perspective only includes hypothetical examples of surveillance pricing.  The staff perspective found that some 6(b) respondents can determine individualized and different pricing and discounts based on granular consumer data, like a cosmetics company targeting promotions to specific skin types and skin tones. The perspective also found that the intermediaries the FTC examined can show higher priced products based on consumers’ search and purchase activity. As one hypothetical outlined, a consumer who is profiled as a new parent may intentionally be shown higher priced baby thermometers on the first page of their search results. The FTC staff found that the intermediaries worked with at least 250 clients that sell goods or services ranging from grocery stores to apparel retailers. The FTC found that widespread adoption of this practice may fundamentally upend how consumers buy products and how companies compete. As the FTC continues its work in this area, it is issuing a request for information   today seeking public comment on consumers’ experiences with surveillance pricing. The RFI also asks for comments from businesses about whether surveillance pricing tools can lead to competitors gaining an unfair advantage, and whether gig workers or employees have been impacted by the use of surveillance pricing to determine their compensation. Comments are due by April 17. The Commission voted 3-2 to allow staff to issue the report. Commissioners Andrew Ferguson and Melissa Holyoak issued a dissenting statement related to the release of the initial research summaries. The FTC has additional resources on the interim","titre":"FTC Surveillance Pricing Study Indicates Wide Range of Personal Data Used to Set Individualized Consumer Prices","pubDate":"Thu, 10 Apr 2025 09:51:48 +0200","id":2044739}]