[{"url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business","source":"FTC USA Business Blog Posts","pubDate":"Thu, 08 Oct 2026 08:06:58 +0200","id":3203247,"titre":"FTC consumer protection year in review offers 2020 vision for your business","description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus"},{"url":"https://www.ftc.gov/business-guidance/blog/2017/07/we-cant-go-no-can-do","source":"FTC USA Business Blog Posts","id":3200011,"pubDate":"Tue, 06 Oct 2026 14:06:39 +0200","titre":"We can’t go for that (no can do)","description":"We can’t go for that (no can do) lfair July 17, 2017 | 11:38AM We can’t go for that (no can do) By Lesley Fair Of course, phantom debt collection – the practice of pressuring people to pay “debts” they don’t owe – harms consumers. But as an FTC complaint demonstrates, when phantom debt collectors strike, they could affect your company, too. According to the FTC , a Florida-based outfit engaged in a scheme to defraud consumers through the collection of debts people didn’t actually owe or the company didn’t have the authority to collect. The complaint charges that the defendants – Hardco Holding Group, S & H Financial Group, Dequan M. Sicard, and Daryl M. Hall (no, not that Daryl Hall) – violated the FTC Act and Fair Debt Collection Practices Act. When contacting consumers, in many instances the defendants allegedly impersonated attorneys and threatened to have people thrown in jail if they didn’t pay up on delinquent payday loans – loans, remember, that many consumers didn’t take out in the first place and defendants didn’t have the right to collect. One tactic involved contacting people with a “case number” and directing them to dial a callback number. On the second call, the defendants allegedly said they were affiliated with named law firms and that the consumer had committed a felony, could go to prison, or faced arrest. According to the complaint , to boost the credibility of their threat of pending or imminent legal action, the defendants claimed to have the consumer’s Social Security number, bank account number, or contact information for family members. Afraid of legal repercussions, many consumers knuckled under to the demand for payment. The FTC says the defendants also told third parties that consumers owed money, a violation of the FDCPA. In addition, the complaint charges that the defendants didn’t disclose their identity to consumers, failed to provide proper validation notices, and used other false, misleading, and abusive tactics. Phantom debt collectors unquestionably injure consumers, but how could conduct like that affect your company? According to the lawsuit, when pressed to identify themselves, the defendants often gave the names or addresses of legitimate small businesses that had nothing to do with the purported debt or the debt collectors. When concerned consumers contacted those companies to complain, their employees got an understandably angry earful. From the FTC’s perspective, unrelated small businesses shouldn’t have their reputations sullied by others’ allegedly illegal tactics. A federal court in Orlando has temporarily halted the operation and frozen its assets. The FTC wants to stop the illegal practices once and for all. What can consumers do if they’re getting calls for debts they don’t owe ? File a complaint with the FTC. How can small businesses help protect their good names? Every now and then, do a selfie search with your company name and a word like “debt.” If you see consumer posts that suggest that a debt collector is illegally using your name – or if your employees are getting complaints about debt collection calls supposedly coming from your company – let the FTC know about it , too. In the meantime, businesses looking for FDCPA compliance resources can visit the FTC’s debt collection page for some – in the words of the other Daryl Hall (and let’s not forget John Oates) – “Adult Education.”"},{"url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program","source":"Federal Trade Commission - Protecting America's Consumers","description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer","pubDate":"Wed, 17 Dec 2025 09:50:37 +0100","id":2577895,"titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program"}]