[{"id":3203250,"description":"i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they collect. According to an FTC settlement, i-Dressup fell short on both COPPA requirements. The complaint alleges i-Dressup failed to provide sufficient notice on its site of the information it collected online from kids, how it used it, its disclosure practices, and other specifics required by the COPPA Rule. The company’s direct notices to parents were deficient, too. Among other things, they didn’t include the COPPA-required statement that if parents don’t provide consent within a reasonable time, i-Dressup will delete their online contact information from its records. Stick with the story because that failure turned out to be particularly troubling. In addition to letting users play online games, i-Dressup featured a community where they could “explore their creativity and fashion sense with unique personal profiles” and interact with others. To register, i-Dressup required people to submit a user name, password, birthdate, and email address. If the birthdate indicated the person was under 13, the email field changed to “Parent’s Email.” Once the under-13 user filled in the required fields and clicked “Join Now,” i-Dressup collected the personal information and sent a message to the address entered into the Parent’s Email field. The person receiving the email could consent by clicking the “Activate Now!” button. However, if the parent didn’t give consent, i-Dressup retained the personal information it had collected from the child online. The FTC says the company’s failure to delete that information violated Section 312.5(c)(1) of the COPPA Rule. In addition to violating COPPA’s parental consent provisions, i-Dressup allegedly violated the Rule’s data security requirements . According to the FTC, i-Dressup stored and transmitted users’ personal information (including passwords) in plain text. In addition, the company failed to perform network vulnerability testing of its network, even for well-known threats like SQL attacks; it didn’t implement an intrusion detection and prevention system; and it didn’t monitor for potential security incidents. The upshot? The company learned that a hacker had gained entry to its network and accessed information about 2.1 million users, including approximately 245,000 users who indicated they were under 13. To settle the case , i-Dressup and its owners will pay a $35,000 civil penalty. They’re also prohibited from violating COPPA in the future, and can’t sell, share, or collect any personal information until they implement a comprehensive data security program and get independent biennial assessments. In addition, they’ll have to provide the FTC with an annual certification of compliance. The message for sites and operators covered by COPPA is that an effective system of parental consent is only the first step toward compliance. Section 312.8 of the COPPA Rule also requires you to “establish and maintain reasonable","source":"FTC USA Business Blog Posts","pubDate":"Thu, 08 Oct 2026 08:06:59 +0200","url":"https://www.ftc.gov/business-guidance/blog/2019/04/i-dressup-data-security-mess","titre":"i-Dressup and a data security mess-up"},{"pubDate":"Thu, 08 Oct 2026 08:06:58 +0200","url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business","titre":"FTC consumer protection year in review offers 2020 vision for your business","source":"FTC USA Business Blog Posts","id":3203247,"description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus"},{"url":"https://www.ftc.gov/business-guidance/blog/2014/11/company-pay-22-million-offering-free-credit-scores-turned-out-be-not-so-free","titre":"Company to pay $22 million for offering \"free\" credit scores that turned out to be not so free","pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","source":"FTC USA Business Blog Posts","description":"Company to pay $22 million for offering \"free\" credit scores that turned out to be not so free wfg-adm109 November 19, 2014 | 11:12AM Company to pay $22 million for offering \"free\" credit scores that turned out to be not so free By Lesley Fair We’ve brought law enforcement actions – dozens of ‘em. We’ve held workshops, issued reports, and sent warning letters. If it takes sky writing, tap dancing, and a float in a Thanksgiving Day parade, we’ll do that, too. But here’s what’s not going to happen. The FTC is not giving up until businesses get the message that: 1) Free means free; and 2) Key terms and conditions have to be clearly and conspicuously disclosed. A $22 million settlement announced by the FTC and the AGs of Illinois and Ohio with a national credit monitoring service advertising so-called “free” credit scores emphasizes that point. Another note for practitioners: It's the FTC's third case alleging violations of ROSCA . One Technologies and related outfits marketed their credit monitoring programs, MyCreditHealth and ScoreSense, through at least 50 sites, including FreeScore360.com, FreeScoreOnline.com and ScoreSense.com. Their strategy was simple. Buy advertising on search engines so their ads show up near the top when people look for phrases like “free credit report\" and then follow up with a persuasive pitch: “View your latest Credit Scores from All 3 Bureaus in 60 seconds for $0!” According to the lawsuit , the defendants failed to clearly tell consumers that if they availed themselves of those “free” services and didn’t cancel within seven days, the defendants would ding their credit cards for $29.95 a month over and over and over again. The complaint includes screen shots of the defendants’ sites, but before looking at them, take out your reading glasses because they’ll come in handy in trying to locate where the defendants chose to tell people about that $29.95 monthly fee. One line of fine print added in late 2012 said “Free 7-Day trial when you order your 3 Free Credit Scores. Membership is then just $29.95 per month until you call to cancel.” The first problem: The type was tiny – a fraction of the size of the defendants’ multiple use of the word “free.” The second problem: Why should consumers even have to be on the look-out for the cost, given that the defendants so prominently advertised it as “free”? A second purported disclosure appeared as an obscure hyperlink on the page where people typed in their Social Security number and birthdate.  Sandwiched between the logos of various security firms and a large color button that said CONTINUE was this less-than-crystal-clear statement: By clicking on the ‘Continue’ button, you agree to the Offer Details, to the Terms and Conditions, acknowledge receipt of our Privacy Policy and agree to its terms . . . The “Offer Details” link triggered a small pop-up that said, among other things, “At the end of the 7-day trial period, your credit/debit card will be charged $29.95 on a monthly basis until you call to cancel.” Another place the defendants put the information was on a side panel of the Payment Form in white letters on a grey background – a color combination one of the defendants’ own employees described as “known to cause seizures in lab rats.” According to the complaint, once people spotted the unauthorized charges on their accounts, the defendants didn’t make it easy to stop the billing.  And even when people asked for their money back because they hadn’t approved of the charges, the defendants denied refunds to many of them. The lawsuit alleges violations of the FTC Act, as well as the Illinois Consumer Fraud Act, the Ohio Consumer Sales Practices Act, and related state rules. In addition, the complaint is the third FTC action to charge violations of ROSCA, the Restore Online Shoppers’","id":3194913},{"titre":"Federalism and the New National Security","url":"https://harvardlawreview.org/print/vol-139/federalism-and-the-new-national-security/","pubDate":"Fri, 12 Dec 2025 10:05:22 +0100","description":"U.S. states traditionally play a minor role in establishing national security policies, which generally fall within the federal government’s remit. But the return of great power competition with China and Russia and the accompanying proliferation of threats have spurred states to act on national security concerns. The post Federalism and the New National Security appeared first on Harvard Law Review","id":2567815,"source":"Harvard Law Review"}]