[{"description":"FTC consumer protection year in review offers 2020 vision for your business lfair January 8, 2020 | 9:26AM FTC consumer protection year in review offers 2020 vision for your business By Lesley Fair They say hindsight is 20/20, but what about foresight? We’re not ones to prognosticate, but a look at notable FTC cases and initiatives from the past year suggests some topics likely to be top of mind in months to come. Here is a non-exhaustive list of issues in our 2019 rearview mirror and likely visible through the 2020 windshield. Consumer privacy. The FTC’s $5 billion enforcement action against Facebook made history and headlines, but the other notable part of the case is the monumental change the order mandates to Facebook’s privacy ecosystem. The Commission opinion in Cambridge Analytica reaffirms the proposition that like any other claim, a company’s privacy promises are viewed through the lens of established FTC consumer perception principles. A series of cases demonstrates the agency’s continued commitment to challenging false or misleading representations about businesses’ compliance with the EU-U.S. Privacy Shield Framework. Another important development is the FTC’s proposed settlement with Retina-X . It’s our first action against a marketer of stalking apps – software that allowed purchasers to monitor the mobile devices on which they’re installed, without users’ knowledge. COPPA. Congress passed the Children’s Online Privacy Protection Act to ensure that when it comes to the collection of kids’ personal information online, parents are in the driver’s seat. The FTC settlement with YouTube – brought in conjunction with the New York Attorney General – alleges that the company collected kids’ personal data without parental consent, in violation of the COPPA Rule . The $170 million civil penalty broke the record for the largest remedy in an FTC COPPA case, set months before in our $5.7 million settlement with Musical.ly , now known as TikTok. If you’re a YouTube channel owner, read a special Business Blog post for tips on determining if your content is directed to children. Data security. Is your company honoring its data security promises and taking reasonable steps to safeguard the sensitive information in its possession? The FTC, CFPB, and State AG actions against Equifax illustrate how consumers are injured when companies ignore reasonably foreseeable threats. The settlement, which totals between $575 million and $700 million – also reminds businesses that heeding warnings about known risks is more prudent (and cost-effective) than the alternative. Three threads tie together the FTC’s unrelated actions against LightYear Dealer Technologies and InfoTrax Systems . They both sell management software to specific industries. They both allegedly failed to take reasonable steps to secure their networks, resulting in damaging data breaches. And they’re both covered by similar new orders the FTC has introduced in recent data security cases. If you or your clients are players in the Internet of Things, the settlement of the FTC’s litigation against connected device company D-Link sends an unmistakable message: The future of the IoT marketplace depends on secure software development. Endorsements, certifications, and influencers. Why is the FTC concerned about the accuracy of endorsements and certifications? Because they’re material to consumers. The FTC says Truly Organics’ claim that its personal care products were “certified organic” lathered up a double bubble of deception. First, its merchandise contained ingredients that weren’t organic. Second, the company falsely claimed that its products were certified by USDA’s National Organic Program. Other FTC developments focused on the use of endorsements in social media. The FTC’s action against Devumi alleges the company sold fake followers, phony subscribers, and bogus","titre":"FTC consumer protection year in review offers 2020 vision for your business","id":3203247,"pubDate":"Thu, 08 Oct 2026 08:06:58 +0200","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2020/01/ftc-consumer-protection-year-review-offers-2020-vision-your-business"},{"description":"A clothes look at the RN database: Q&A with FTC staff lfair October 5, 2017 | 11:18AM A clothes look at the RN database: Q&A with FTC staff By Lesley Fair It’s not much bigger than a postage stamp, but the label on many textile, wool, and fur products provides important information, including fiber content, country of origin, and a company name or Registered Identification Number (RN). The FTC administers the RN system and industry members will want to check out recent upgrades to the RN website . With RNs and labels on our mind, we asked some common RN-related questions to attorney Josh Millard, whom we’d label as one of the FTC’s go-to people on the subject. First things first. What’s an RN? JOSH:   A Registered Identification Number (RN) is a numerical designation – the prefix RN followed by a set of digits – that identifies the company responsible for marketing, distributing or otherwise handling a product covered by the Textile, Wool, and Fur Acts.  Because some labels are small and some company names are long, the law allows U.S.-based businesses to use an RN as a “shorthand” identification. We think the upgrades to the RN website will make it even easier for businesses to use. How do I get an RN for my company? JOSH:   Apply online. FTC staff will review your application and email you typically within 1-3 business days. As soon as your application has been approved, you’ll receive your RN.  How much does it cost to get an RN? JOSH:   There’s no charge. Is it mandatory that companies use an RN on labels? JOSH:   No, you don’t have to use an RN. It’s perfectly acceptable to include your company name instead, but many companies prefer to use an RN because it takes up less space. The RN system has other benefits, too. For example, it lets people identify your business easily through the RN Search screen . Consumers or other industry members can type in the number and readily find your business. Our company doesn’t reside in the United States.  Can we get an RN? JOSH:   Only U.S.-based businesses can get an RN. If your foreign company manufactures or is involved in the advertising, distribution, or sale of a product covered by the Textile, Wool, and Fur Acts, put the company name on the label instead of an RN. Alternatively, you can label the product with the RN or business name of a U.S. company directly involved with importing, distributing, or selling the product when that’s the case. Going through our records we found we have multiple RNs.  Is that a problem? JOSH:   It’s not prohibited, but we no longer issue multiple RNs to a single company and encourage companies to cancel any extra RNs to simplify recordkeeping. Our headquarters has moved since we applied for an RN.  Do we need to update our application? JOSH:   Yes. If there has been a change to your business name, address, or legal status, please update the information in your RN registration.  An RN can be cancelled if a business doesn’t keep its information up to date, so it’s wise to check. The good news is that the upgraded RN website makes that easier to do. What if we choose to use a company name on the label, rather than an RN? JOSH:   You must include the full name your company uses to do business – in other words, the name that appears on documents like purchase orders or invoices. It can’t be a trademark, trade name, brand, or designer name unless that’s also the name under which your company does business. What kind of guidance does the FTC have for industry members? JOSH:  Threading Your Way Through the Labeling Requirements Under the Textile and Wool Acts is a great place to start, and the FTC’s Clothing and Textiles page includes links to brochures, cases, workshops and other compliance resources.","titre":"A clothes look at the RN database: Q&A with FTC staff","id":3201873,"pubDate":"Wed, 07 Oct 2026 14:05:06 +0200","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2017/10/clothes-look-rn-database-qa-ftc-staff"},{"pubDate":"Mon, 30 Mar 2026 19:33:01 +0200","id":2793006,"titre":"BEREC Provides Early Assessment of the Digital Networks Act, Welcoming Ambition While Highlighting Areas for Improvement","description":"BEREC Provides Early Assessment of the Digital Networks Act, Welcoming Ambition While Highlighting Areas for Improvement yannick.stephan Mon, 30/03/2026 - 12:57 Press Releases The Body of European Regulators for Electronic Communications (BEREC) today published its early assessment of the European Commission’s proposal for a Digital Networks Act (DNA). BEREC welcomes the overarching ambition to modernise the regulatory framework for Europe’s connectivity sector and to support resilient, sustainable and high quality digital networks. At the same time, BEREC identifies important areas where further refinement is needed to ensure that the DNA strengthens, rather than complicates, Europe’s internal market for electronic communications. BEREC stands ready to provide its regulatory expertise in order to avoid undue complexity or uncertainty and to ensure that the final framework delivers a competitive, connected and resilient digital Europe. BEREC welcomes the updated objectives introduced by the DNA , including resilience, sustainability, in addition to the existing objectives addressed by the European Electronic Communications Code. While BEREC supports the ambition to strengthen the competitiveness of the EU digital sector, it highlights that this can only be achieved through an effective and robust competition framework. It further notes that the proposal introduces elements of greater centralisation that require further clarification to ensure they contribute effectively to a well functioning internal market. While BEREC recognises the Commission’s intention to streamline the General Authorisation procedures, the proposed Single Passport mechanism raises concerns from several perspectives. In particular, by concentrating significant enforcement responsibilities in the Member State of first notification, the system risks forum shopping, uneven supervisory burdens and slower enforcement. Overall, BEREC considers that the proposal could introduce greater operational complexity, administrative burden and legal uncertainty, without offering clear benefits over the current straightforward authorisation regime. BEREC also notes that the DNA proposes major changes to spectrum management , including treating spectrum as an EU‑level resource and introducing common rules for fees, long‑duration rights and satellite authorisation. While these measures aim at harmonisation, BEREC warns that the proposed single market procedure, which includes a Commission veto, signifies a notable trend towards centralisation and raises certain concerns. BEREC also cautions that some proposals in particular the introduction of unlimited license duration and automatic renewals, risk favouring existing rights holders and reducing market contestability. On the other hand, it welcomes it proposed role in the market shaping aspects of spectrum assignment. On satellite authorisation, BEREC supports EU coordination but stresses the need for alignment with ITU‑R rules. The DNA’s move to treat numbering resources as a common Union asset introduces a more centralised approach, and while BEREC sees potential benefits in greater harmonisation, it notes that key concepts—such as an EU wide numbering plan and pan European numbering ranges—require further clarification. BEREC also considers that additional analysis of demand, use cases and operational impacts would help ensure that any new framework is aligned with the needs of end users, operators and regulators. BEREC welcomes the preservation of the Significant Market Power regime, a cornerstone of the EU regulatory model, alongside the continued availability of symmetric access tools . Nonetheless, several DNA proposals, including new sequencing rules for remedies, the potential removal of the Recommendation on Relevant Markets, and expanded Commission veto powers could reduce the ability of NRAs to address national market needs. BEREC supports the goal of enabling a smooth transition from copper to fibre networks and recognises improvements made to","url":"https://www.berec.europa.eu/en/news/press-releases/berec-provides-early-assessment-of-the-digital-networks-act-welcoming-ambition-while-highlighting-areas-for-improvement","source":"BEREC Office"},{"description":"The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for receiving and addressing vulnerability reports and responding to security incidents; and utilize widely known technologies that might have helped mitigate consumer losses. According to the complaint, in June 2022, Nomad introduced inadequately tested code that included a significant vulnerability. Just over a month later, hackers began exploiting the vulnerability. The FTC alleged that Nomad failed to respond to the attack in time because of its inadequate security and incident response measures, which led to the loss of $186 million. The company was able to recover some money, but consumers lost approximately $100 million. Nomad was warned about the dangers of inadequate testing as well as the need to ensure it had adequate staff and security in place. The company, however, failed to implement basic safety measures that would mitigate consumer losses, the FTC alleged. Under the proposed order , Nomad will be prohibited from making misrepresentations about its security practices. In addition, the company will also be required to: Implement a comprehensive information security program that is designed to protect consumers from theft or other unauthorized access and address the security issues outlined in the FTC’s complaint; Obtain biennial assessments of its information security program by an independent third party and cooperate with the third-party assessor; and Return to consumers money recovered following the security breach that was not already returned to customers. The Commission voted 2-0 to accept the proposed complaint and order for public comment. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov. NOTE:  The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $51,744. The lead staff attorneys on this matter are M. Hasan Aijaz and Julia Horwitz with the FTC’s Bureau of Consumer","titre":"FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program","id":2577895,"pubDate":"Wed, 17 Dec 2025 09:50:37 +0100","source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program"},{"id":2368407,"pubDate":"Fri, 12 Sep 2025 15:51:31 +0200","titre":"Interplay between the DSA and the GDPR: EDPB adopts guidelines","description":"Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by intermediary service providers and include references to GDPR concepts and definitions. While it is up to the competent authorities under the DSA - with the support of the European Board for Digital Services and EU courts - to interpret the DSA, there are a number of provisions which relate to the GDPR. These include: notice-and-action systems that help individuals or entities report illegal content recommender systems used by online platforms to automatically present specific content to the users of the platform with a certain relative order or prominence the provisions to ensure a high level of privacy, safety, and security of minors and prohibiting that profile-based advertising using their data is presented to them transparency of advertising by online platforms prohibition of profiling-based advertising using special categories of data  The EDPB guidelines help to understand how the GDPR should be applied in the context of DSA obligations. The EDPB also provides practical guidance relating to the cross-regulatory cooperation between authorities to coordinate enforcement which will provide more legal certainty for intermediary service providers and ultimately to protect the rights and freedoms of individuals. The guidelines will be subject to public consultation, providing stakeholders with the opportunity to comment and provide feedback. EDPB Chair Anu Talus said: “By clarifying the interplay between the DSA and the GDPR, these guidelines mark a significant step towards ensuring a coherent and effective EU digital rulebook, and they will help uphold the fundamental rights and freedoms of individuals. I hope that stakeholders, including the competent authorities under the DSA, will make the most of the opportunity to contribute to the public consultation\". More work in the pipeline Following these first guidelines on the interplay between the GDPR and the DSA, further work is underway with other regulators to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working on joint guidelines with the European Commission on the interplay between the Digital Markets Act (DMA) and the GDPR, as well as on joint guidelines on the interplay between the AI Act and EU data protection laws.","url":"https://www.edpb.europa.eu/news/news/2025/interplay-between-dsa-and-gdpr-edpb-adopts-guidelines_en","source":"EDPB News"}]