Consumer Advertising Law Blog

FTC Recommends Privacy Protections for Social Security Numbers

The Federal Trade Commission recently voted 4-0 to issue a new report recommending measures to protect against the use of Social Security numbers (“SSNs”) for purposes of identity theft.  The report, titled “Security in Numbers: SSNs and ID Theft,” (“SSN Report”) is a joint product of the FTC and the other 16 federal agencies that are members of the President’s Identity Theft Task Force.  In April 2007, the Task Force recommended that its member agencies explore ways to preserve the beneficial uses of SSNs while curtailing their availability and value to identity thieves.  One of the ways in which the FTC studied this issue was to hold two public workshops in April 2007 and December 2007.

In the SSN Report, the FTC presents five recommendations to help curtail the use of SSNs to accomplish identity theft:  (1) Improve consumer authentication (“[a]uthentication” is the process of verifying that someone is who he or she claims to be); (2) Restrict the public display and transmission of SSNs; (3) Establish national standards for data protection and breach notification; (4) Conduct outreach to businesses and consumers; and (5) Promote coordination and information sharing on use of SSNs. 

The Commission suggested that Congress consider establishing national standards along these lines, which could be delineated further through agency rulemaking.  Noting that some states have already passed laws to protect SSN misuse, the FTC argued that differences between various state laws complicates compliance.  The Commission also recommended that Congress consider granting the FTC authority to obtain civil penalties for violations of the suggested national standards. 

The new Obama Administration will likely be sympathetic to the FTC’s recommendations, and the incoming Congress can be expected to be supportive as well.  If Congress does move ahead in this area, it will be critical for interested parties to voice their views and experience with respect to the valuable and legitimate use of SSNs as well as the risks of their misuse for identity theft purposes.

You Say Class Action We Say Collective Redress: EU Considers Changes

Collective redress, much like the concept of a class action in the United States, is used in the EU when multiple consumers are harmed by the same trader and wish to take collective action against him.

As the level of cross border trading to consumers increases in Europe, the EU Commission believes it is becoming increasingly important to provide consumers in one EU member state with the ability of seeking compensation from traders located in other EU member states.

However, although some EU member states do have provision for collective redress, many of them do not. Moreover the strength of such provisions and the ease with which they can be used by consumers located in the member state concerned or in other member states varies significantly.

On 27 November 2008, the Commission of the European Communities published a Green Paper on consumer collective redress. This is intended to stimulate debate about how best to protect the rights of consumers and to allow them to be compensated when they are harmed by illegal commercial practices.

The Green Paper sets out four options for debate:

1. The European Union takes no immediate action, but continues to monitor the national rules and the ability for consumers to seek compensation.
2. Encourage greater co-operation between Member States, so Member States extend national systems to consumers from other Member States.
3. A mixture of policy instruments to strengthen the current systems in place throughout the EU, including provisions on arbitration, small claims procedures and encouraging businesses to improve complaints handling.
4. An EU wide measure, so that a mechanism exists in all Member States.

The Commission has invited third parties to comment on the proposals in the Green Paper by 1 March 2009. The Commission will then decide how best to proceed, and if necessary publish draft legislation.

- Susan Hinchliffe

Children’s Online Privacy Must be Handled with Kid Gloves

The evidence continues to grow that the FTC is vigilant when it comes to children’s online privacy and is willing to seek large fines to make its point.  In the latest settlement involving children’s online privacy, Sony BMG has agreed to pay a $1 million fine to settle various alleged violations of the Children’s Online Privacy Protection Act (“COPPA”).  Given the large fines recently assessed by the Commission and the list of well-known companies that the Commission has targeted as COPPA violators, it may well be a good time to assess your own company’s COPPA compliance.

COPPA, which became effective April 21, 2000, was passed in order to prevent unfair and deceptive practices in connection with the collection, use, or disclosure of personal information from and about children under the age of 13 on the internet.  The COPPA rule, promulgated by the FTC, spells out what a company must include in their privacy policy, when and how verifiable consent must be obtained from a parent, and what responsibilities an online operator has to protect the privacy of children online.  COPPA and the accompanying rule apply to information such as name, home address, email address, telephone number, and other information that would allow someone to contact a child.  In addition, the Act and Rule also cover information such as hobbies, interests, and other information that can be collected through cookies or other tracking mechanisms that are tied to identifiable information.  The Act and Rule require, among other things, that web-based operators obtain parental consent before collecting, using, or disclosing a child’s personal information.  The FTC’s website contains numerous helpful guides on COPPA compliance.  CARU, which is part of the Better Business Bureau, also operates an FTC-approved safe harbor program. 

Sony BMG Music Entertainment operates over 1,000 websites for various musical artists.  The company requires users to submit a range of personal information, along with date of birth, to register for these sites.  On 196 of these sites, Sony allegedly collected personal information about 30,000 underage children without first obtaining parental consent.  In addition, the FTC alleged, several of the Sony sites permit users to create personal fan pages, music reviews, upload photos or videos, post comments in online forums, and utilize personal messaging; allowing children to interact with users of all ages, including adults.

The FTC issued a complaint against Sony BMG, alleging that the company violated COPPA by failing to provide notice on its websites of what information is collected online about children, how such information is used and disclosed, failing to obtain parental consent, and failing to provide parents with Sony’s information practices and the ability to review the personal information collected from children. Sony’s $1 million penalty matches the highest amount collected for a COPPA case. 

On a related note, earlier this week the Network Advertising Initiative, an industry self-regulatory group, released guidelines related to “behavioral advertising” or the monitoring of individual consumer internet activity designed to focus advertising content to individual interest.  The guidelines prohibit using behavioral advertising techniques with children under age 13.

Green Claims Not in the Bag

As we eagerly await the anticipated revision by the FTC to its Green Guides, which most believe will address the next generation of environmental marketing claims, challenges to such claims under the current Guides are being aired in self-regulatory forums such as the NAD.  Earlier this month the NAD recommended that GP Plastics Corp. discontinue green marketing claims for its "PolyGreen" plastic bags used in the newspaper industry.  GP made three types of claims:

• General Claims of environmental benefit (e.g., "A greener tomorrow is in the bag"; "Eco-Friendly Plastic Newspaper Bags")
• PolyGreen bags are oxo-biodegradable (e.g. "100% oxo-biodegradable"; "disposable through ordinary channels")
• Recyclable claims (e.g., "Our bags are completely recyclable.")

GP used the term "oxo-biodegradable" as a next generation environmental claim that did not exist at the time the Green Guides were issued.  The term "oxo-biodegradable" refers to a two-step process.  In the first step, the plastic starts to break down under exposure to oxygen and heat.  In the second step, reactions with naturally occurring microorganisms cause the plastic to break down further into carbon dioxide, water, and biomass.  Although landfills are not ordinarily conducive to biodegradability, GP claimed that oxo-biodegradable plastics will degrade in two to three years in landfills, depending on the conditions. 

The NAD did not rule out the possibility of the use of a properly qualified biodegradable claim, but concluded that in the absence of additional disclosures consumers were likely to believe that oxo-biodegradable and biodegradable had similar meanings.  Given that the Green Guides state that products marketed as biodegradable must completely "decompose into elements found in nature within a reasonably short period of time after customary disposal,"  the NAD found that there was no evidence that oxo-biodegradable plastics quickly and completely break down in ordinary landfill conditions. (NAD also ruled against GP on its other two claims based upon traditional readings of the Green Guides.) GP plans to appeal the NAD's decision.

Bottom line - if you're going to tout a new technology, make sure consumers understand it. 

Fuel Surcharges Don’t Cruise By Unnoticed

Fluctuating gas prices got you (or your business) down?  If you plan to pass on your higher costs to your customers, not in the form of an overall price increase, but as a surcharge or extra fee, use caution in how you describe the charge and be sure to disclose the charge and its terms clearly and conspicuously.  Recently, these types of charges have been under fire by state AGs and private class action plaintiffs.

On November 5, Florida Attorney General Bill McCollum filed a lawsuit against Imperial Majesty Cruise Line, alleging the company has been sneaking fuel surcharges onto customers’ invoices since 2006.  According to the complaint, surcharges amounting to $20 to $30 per passenger (totaling over $4 million) were added on to cruise bills without properly informing or alerting customers.

The Attorney General’s Economic Crimes Division conducted an investigation and uncovered alleged statements on the company’s website telling consumers that a “fuel/security” surcharge would not be added to their account if they paid the requisite government taxes and fees at the time of booking their cruise.  Complaints issued by consumers state that the surcharges were imposed on them when they arrived for their trip even though the fees were not mandated by any government agency.  The lawsuit alleges that no printed advertisements or brochures informed consumers of the surcharges and that the company implied that the fees were government-mandated.  Failing to disclose that the advertised rates and pricing issued by the company did not include the surcharge is deemed an unfair and deceptive trade practice in the Attorney General’s complaint. 

This newest lawsuit follows several agreements reached earlier this year with other cruise line companies for the same fuel surcharge issue.  The Florida Attorney General’s office received hundreds of complaints from consumers alleging that fuel surcharge fees were being retroactively applied after cruises had been booked.  Carnival and several of its subsidiary cruise lines agreed to refund $40 million to consumers nationwide.  Holland America, Princess, Costa, Cunard and Seabourne cruise lines were also affected by the investigation. 

State and federal authorities have been monitoring the imposition of surcharges on consumers over the past decade.  In the 2002, several hotels were sued for imposing surcharges. Similar allegations  have been lodged against cell phone providers, airlines, and others.  In addition to investigations by government officials, these types of fees have been, and continue to be probed in various class actions.

A Posting for the Season - Retailers and Gift Cards

Consumers, though worried about the bankruptcy of large retailers, still say they will make gift cards their top gift choice this Christmas.  In light of that fact, we offer this timely holiday reminder that businesses offering gift cards need to be familiar with the federal and state laws and regulations governing the terms of the gift cards they sell and the disclosures that they must make to consumers.  Of particular concern to regulators are expiration dates and fees, such as dormancy, maintenance, inactivity, monthly, and balance inquiry fees.  Sellers should make sure that the terms of their gift cards are clear to consumers before they buy, and also are clear to those who will be receiving and redeeming the cards.

In In re Kmart Corp., after 24 consecutive months of non-use, Kmart deducted a $2.10 per month “dormancy fee” from its gift cards for each of those 24 months.  This frequently resulted in gift card values being reduced to zero or a minimal amount.  The FTC alleged that Kmart engaged in unfair and deceptive practices in violation of section 5 of the FTC Act because the fee was disclosed in small print on the back of the card, the disclosure was obscured because the cards were attached to cardstock for sale, the language used was not understandable, and consumers purchasing gift cards on-line were not informed of the dormancy fee.  The resulting consent order offers a possible roadmap for businesses to use for their own gift cards.  It required Kmart to do the following:

• At the point of sale, prior to purchase, clearly and prominently disclose all material terms and conditions of any expiration date or fee.
• On the front of each card, clearly and prominently disclose the existence of any expiration date or fee.

Many states have enacted consumer protection laws that regulate gift card terms and required disclosures.  These laws often prohibit expiration dates and fees, or place severe restrictions on such terms.  A brief summary of some features of state laws can be found here.

Gift cards issued by banks, which are branded with the VISA or MasterCard logo, generally are not subject to state law limitations on gift cards, but still must comply with the federal regulators’ guidance on gift cards.  Both the Office of Thrift Supervision (OTS) and the Office of the Comptroller of the Currency (OCC) have issued guidance in this area, which mandates prominent disclosures of fees and expiration dates.  The OCC guidance can be found here, and the OTS guidance can be found here.  Because the bank regulators are increasing their focus on unfair and deceptive practices, bank gift card issuers also should review their disclosures in light of FTC cases brought under section 5 of the FTC Act, such as the Kmart case.

- Beth DeSimone and Matthew Shultz

FTC Obtains a $2.25 Million Civil Penalty from a Debt Collector

Right before Thanksgiving, on November 21, 2008, the Federal Trade Commission (FTC) announced the largest civil penalty ever obtained in a debt collection case. This enforcement action highlights the FTC’s announced commitment to scrutinize debt collection practices, especially at a time when the volume of debt collection activity is expected to increase substantially.

The $2.25 million civil penalty will be paid by Academy Collection Service, Inc. (“Academy”), a nationwide debt collection company, and its owner, to settle FTC charges that the company violated section 5 of the FTC Act and the Fair Debt Collections Practices Act (“FDCPA”). Section 5 of the FTC Act outlaws “unfair or deceptive acts or practices in or affecting commerce,” whereas the FDCPA prescribes detailed rules that debt collectors must comply with, in addition to generally prohibiting debt collectors from making deceptive representations or using unfair means in debt collection. Therefore, a violation of either Act may subject the violator to a civil penalty and/or injunction.

In its action, the FTC alleged that Academy engaged in deceptive practices in violation of Section 5 of the FTC Act by misrepresenting to consumers that nonpayment of a debt would result in garnishment of their wages, arrest, or legal action, and that Academy engaged in unfair practices by withdrawing funds from consumers’ bank accounts without obtaining the consumers’ express informed consent. The FTC also alleged various violations of the specific provisions of the FDCPA, such as depositing or threatening to deposit postdated checks prior to the date on such checks, communicating with consumers at inappropriate times or locations, and threatening to harm the person, reputation, or property of consumers.

In addition to paying the penalty, Academy is enjoined from violating the FTC Act or the FDCPA. It must also provide certain disclosure to consumers about their rights, as well as certain disclosure to its employees regarding their obligations. Academy must report to the FTC periodically on how it complies with the injunction and the disclosure requirements, and submit itself to FTC monitoring.

Importantly, the case was brought under both the Fair Debt Collection Practices Act (“FDCPA”) and Section 5 of the FTC Act. Generally, the FDCPA applies only to debt collectors and not lenders who service their own debt. However, in this case, the FTC also charged the company with violations of Section 5 of the FTC Act -- unfair or deceptive practices -- in its collection activities. Since the prohibition on “unfair or deceptive” practices under the FTC Act applies to any lender under the FTC’s jurisdiction (not just debt collectors), this type of action can be pursued even against lenders seeking the collection of their own originated debts.

Thus, lenders of all types, including banks, automobile lenders, payday lenders and others, should review their debt collection practices policies in light of this action.

- Beth DeSimone and Brian McCormally

FTC Says Testimonial Guides Due for Overhaul

The FTC announced proposed revisions to the Guides Concerning the Use of Endorsements and Testimonials in Advertising (“Guides”).  In January 2008, the FTC sought public comment on the benefit of updating the Guides, which have remained unchanged since 1980. 

The Commission determined the Guides needed an update to incorporate principles that have been established through more recent FTC enforcement actions.  Additionally, several proposed revisions result from a better understanding of how consumers interpret testimonials. 

Two items are of particular note.  First the FTC has long held the position that an endorser can be held liable for misleading claims and has brought several cases, with mixed results, including one against former Los Angeles Dodger, Steve Garvey.  The proposed revisions seek to make this principle clear. 
 
Second, the proposed revisions would require that testimonials that do not describe a typical consumer experience be accompanied by a clear and conspicuous disclosure of the results that consumers can generally expect.  Currently, the Guides only require that testimonials be accompanied by a disclaimer that the depicted results are atypical if they are not reflective of expected results.  The proposed change would require all marketers to conduct some type of proof of “generally expected results” prior to publishing an advertisement, and disclosure of the typical experience a consumer could expect to receive.  We have seen such a requirement of a more particular disclaimer in some weight loss consent decrees, (see Weight Watchers and Jenny Craig), although this has not been the norm.  But such an approach generally may have been on the FTC's mind for some time.  In 2002, former BCP Director Howard Beales indicated he thought the Guides' approach of allowing an "atypical" disclaimer discouraged research and disclosure as to what was an expected consumer experience.

The FTC is seeking public comment on the proposed revisions before January 20, 2009.