ABA Section of Antitrust LawConsumer Protection Committee

Consumer Protection Update August 2015

Presented by

D. Reed Freeman, Jr. Heather Zachary Patrick Bernhardt

Agenda

1. Federal Trade Commission2. CBBB National Advertising Division3. State Law 4. Private Litigation

2

Federal Trade CommissionDevelopments

3

Recent Developments at the FTC• Commissioner Joshua D. Wright resigned as of August 24th

– Somewhat unexpected—he was appointed in 2013– Leaves Commission with 3-1 democratic majority

• FTC continues outreach to businesses and stakeholders on privacy, data security, and debt collection – “PrivacyCon” announced for January 14, 2016

• FTC staff recommended that the FDA reconsider its regulatory framework for homeopathic products– The comment was submitted in response to an FDA request for public

comment and precedes an FTC workshop on September 21st related to homeopathic advertising

– Staff noted that the FDA’s framework may appear to conflict with the FTC’s advertising substantiation doctrine

• FTC seeks public input on review of contact lens and eyeglass rules

4

FTC v. Wyndham Hotels and Resorts, LLC, No. 14-3514 (3d Cir. Aug. 24, 2015)

• Third Circuit affirmed the district court’s holding that the FTC may regulate companies’ data security practices under its unfairness authority – The court cited the statutory history of the FTC Act and the

FTC’s development of its unfairness authority over time

– It rejected arguments that the plain meaning of “unfair” imposes additional requirements that are independent of the statutory elements (e.g., requirements that conduct must be unscrupulous or unethical)

– The court also stated that practices may be “unfair” even if the company itself is a victim of a breach, as long as the harm was foreseeable and the company’s conduct is likely to cause substantial injury

5

FTC v. Wyndham Hotels and Resorts, LLC, No. 14-3514 (3d Cir. Aug. 24, 2015)

• The Third Circuit also:– Rejected the argument that the FTC’s authority would be

overly broad if it could extend to the regulation of cybersecurity practices

– Concluded that Congress did not exclude the FTC’s authority by enacting the FCRA, GLBA, and COPPA• The court noted that such privacy laws did not contradict the

FTC’s authority to regulate data security practices• Rather, the other statutes expanded the scope of the FTC’s

authority and required the FTC to issue regulations

– Concluded that the FTC’s exercise of its authority did not contradict its earlier statements that it lacked authority to impose so-called “fair information practice policies”

6

FTC v. Wyndham Hotels and Resorts, LLC, No. 14-3514 (3d Cir. Aug. 24, 2015)

• The court concluded that Wyndham had fair notice that its specific cybersecurity practices could be inadequate– The court explained that the “ascertainable certainty

standard” does not apply

– “The relevant question is not whether Wyndham had fair notice of the FTC’s interpretation of the statute, but whether Wyndham had fair notice of what the statute itself requires.”

– In describing the statutory requirements, the court stated that “[w]hile far from precise, this standard informs parties that the relevant inquiry here is a cost-benefit analysis . . . Fair notice is satisfied here as long as the company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute.”

7

FTC Continues Enforcement of International Safe Harbor Frameworks

• On August 17th, thirteen companies settled allegations that they misrepresented their certification under the U.S.-EU or U.S.-Swiss Safe Harbor Frameworks– Seven companies allegedly failed to renew their

certifications– Six companies allegedly never applied for membership in

the programs

• The FTC has brought over 37 such enforcement actions since 2009

8

FTC v. Vemma Nutrition Co., et al., No. CV-15-01578 (D. Ariz.)

• On August 21st, the FTC obtained a temporary restraining order to stop an alleged multi-level marketing “pyramid scheme”

• The complaint alleged that defendants made false claims about potential earnings, failed to disclose the company’s structure, and furnished affiliates with false and misleading recruiting materials– The company allegedly claimed that individuals could earn as

much as $50,000 per week selling health and wellness drinks

– The company also allegedly encouraged consumers to invest $500 to $600 for an “Affiliate Pack,” to purchase $150 in products each month, and to enroll other affiliates

• The TRO halted the allegedly deceptive practices, froze defendants’ assets, and appointed a temporary receiver

9

FTC v. Money Now Funding, LLC et al., No. CV-13-01583 (D. Ariz.)

• The FTC obtained court orders to stop marketers from allegedly selling business or work-at-home opportunities that cost consumers more than $7 million– The scheme allegedly targeted seniors and sold worthless

sales leads with deceptive claims of potential earnings– Defendants also allegedly manipulated credit card network

rules by changing product names, office locations, and merchant identities

• The FTC obtained monetary judgments of $7.3 million against 12 defendants and smaller amounts from others

• The orders bar defendants from selling business opportunities, engaging in telemarketing, and engaging in misconduct alleged by FTC

10

In re New Consumer Solutions LLC (Mole Detective), File No. 132 3210

• The defendant settled allegations that it made false or unsubstantiated claims related to a set of “melanoma detection” apps– Apps allegedly instructed users to photograph a mole and

input other information, and then the apps would analyze and determine low, medium, or high risk

– The FTC alleged that the marketers lacked adequate evidence to support such claims

• The settlement bars defendant from making any further allegedly deceptive health or efficacy claims, imposes data and recordkeeping provisions, and includes judgment for nearly $60,000

11

FTC v. Zadro Health Solutions, Inc., No. 8:15-CV-1314 (C.D. Cal.) and FTC v. Angel Sales,

Inc., No. 1:15-cv-06542 (N.D. Ill.)• Two marketers of ultraviolet light “disinfectant” devices settled

allegations that they made false and unsubstantiated claims about the devices’ ability to eliminate fungus and bacteria such as MRSA, E.coli, and Salmonella– The “shUVee” and “Nano-UV” devices allegedly appeared in national

retailers including skymall.com, amazon.com, walgreens.com, target.com, brookstone.com, and wayfair.com

– Defendants allegedly did not have scientific evidence to support the claims

– Allegedly false claims included statements such as “the UV light reaches all the way into shoes to the toes where the bacteria live” and “safely kill 99.99% of targeted bacteria . . . in 10 seconds.”

• The settlements impose judgments of $656,423 and $629,359 and, among other things, prohibit defendants from making allegedly false or unsubstantiated claims for any device regarding its disinfectant efficacy

12

FTC v. First Time Credit Solution, Corp. (FTC Credit Solutions), No. CV15-01921 (C.D. Cal.)

• Operators of alleged “bogus credit repair scheme” settled charges that they misled Spanish-speaking consumers into paying thousands of dollars to improve credit– The complaint alleged that the defendants claimed a

nonexistent affiliation with the Commission and falsely promised that they could remove negative information from consumers’ credit reports and improve credit scores

– The complaint also contained allegations that defendants violated the Credit Repair Organizations Act by charging consumers up front for credit repair services

• The settlements require the four defendants to pay $2.4 million and, among other things, permanently bar them from selling or advertising credit repair services or selling or benefitting from customers’ personal information

13

FTC v. Sequoia One, LLC et al., No. 2:15-cv-01512 (D. Nev.)

• The FTC filed a complaint against a data broker that allegedly sold financial information obtained from payday loan applications to a scam operation– Defendants allegedly sold the information of more than 500,000

consumers to an entity that made unauthorized charges of at least $7.1 million

– Information allegedly was collected through purchased applications as well as the company’s own payday loan websites

– The complaint alleges that defendants had knowledge of the scheme and assisted the scammers to hide fraud by using fine-print disclosures and misleading tactics

• Three defendants agreed to judgments of $7.1 million and $3.7 million, as well as prohibitions on selling or otherwise benefitting from customers’ personal information

14

CBBB National Advertising DivisionDevelopments

15

Abbott Nutrition/Similac Infant Formula

• Mead Johnson & Company, LLC, challenged claims related to its Enfamil Human Milk fortifier Acidified Liquid that appeared on Similac’s website and in various sales materials and advertisements

– Express claims allegedly included a statement that “A recent study showed that acidification decreased the cellular and nutritional content of human milk. Acidification can destroy white blood cells in human milk, which are associated with immune protection. This acidic environment can decrease total protein levels by denaturing the casein proportion. Also, acidification causes human milk’s lipase activity, an important part of fat digestion, to be reduced.”

– NAD acknowledged that the alleged claims were directed to sophisticated medical professionals and that this is a factor in determining reasonable messages conveyed by advertising, but it noted that even a sophisticated audience is entitled to truthful and accurate messages.

• NAD concluded that the advertising conveyed a message that the acidified product was harmful to infants or otherwise inferior, but that the advertiser lacked evidence to support that claim

– The study allegedly was designed to evaluate effects of acidification on cellular and nutritional composition, not the effects on preterm infants

– The advertisements allegedly contained excerpts of study without stating limitations16

Arthri-D, LLC/Arthri-D3

• The Council for Responsible Nutrition (CRN) challenged alleged claims regarding dietary supplement “Arthri-D3” relating to joint relief

– CRN argued that alleged testimonials and the product name overstated the product’s joint pain relief benefits

– It also argued that the name “Arthri-D3” may convey the misleading message that the product treats arthritis

• The advertiser voluntarily discontinued testimonials, and therefore the NAD did not review express claims

17

DirecTV, LLC

• Comcast Cable Communications, LLC challenged alleged comparative claims relating to signal reliability, service wait times, picture/sound quality, and sports programming– Claims allegedly appeared in a series of ads featuring actor Rob Lowe

and various alter-egos

– Although DirecTV allegedly had a reasonable basis to support claims of 99% signal reliability, it could not support implied superiority claims

• A five-member panel of the NARB recommended that the advertiser discontinue alleged comparative claims in certain advertising that implied DirecTV is superior to cable– The panel noted that “depending on context, even humorous advertisements

can convey messages that require substantiation by the advertiser”

– Its decision was based on its “determination of the net impression reasonably created by the challenged commercials”

18

Inspired Nutrition LLC/Ultimate Bio-Fibrin Dietary Supplement

• The Council for Responsible Nutrition (CRN) challenged claims that a dietary supplement offers “new hope for conquering chronic diseases like MRSA staph, Lyme disease, HIV, Hepatitis, Shingles, Herpes.” Claims allegedly included:– “The Best Enzymes Clinical Studies Show to Dissolve Fibrin Biofilms,

Cysts and Internal Scarring!”

– “Our Monolaurin is able to kill all pathogen bacteria and 14 virus . . .”

– “Nattokinase has advantages over the traditional clot-dissolving drugs, such as activase, urokinase, and streptokinase because its effects last longer – eight to ten hours longer!”

• In response to the NAD’s initial inquiry, the advertiser stated that it would discontinue all challenged claims

19

State LawDevelopments

20

Illinois Governor Vetoes Data Breach Legislation

• On August 21st, Illinois Governor Bruce Rauner vetoed SB 1833, which passed both houses on May 31– The bill would have expanded the definition of “personal

information” to include data such as geolocation, medical, consumer marketing, health insurance, and biometric data

– It also would have required companies to post a privacy policy and to notify the state AG within 30 days of the discovery of a data breach

• Governor Rauner stated that “the unauthorized release of consumer marketing and geolocation information does not pose the same risk of identity theft that justifies the extraordinary and costly security and notice requirements imposed by the Personal Information Protection Act” and proposed specific changes to the legislation

21

People of the State of California ex rel. Dennis Herrera v. MeetMe, Inc. et al., No. 537126

(San Francisco Superior Court, filed Feb. 3, 2014)

• The San Francisco City Attorney (Dennis Herrara) settled charges that social network MeetMe, Inc. did not obtain valid consent to publish photos and personal information from minors with real-time locations– The charges alleged that the practices violated minors’ privacy

rights under California law and were not adequately disclosed in the privacy policy and terms of service

• MeetMe agreed to pay $200,000 and to implement safeguards for users under the age of 18, including:– Not identifying minors’ specific location beyond city and state and

not displaying proximity to other users within one mile– Revising privacy policy and terms to be easier to understand– Consolidating privacy settings and sending “privacy check-up”

notices to users

22

Texas AG Reaches Gift Card Settlement with RadioShack Bankruptcy Estate

• On August 26th, the Texas Attorney General reached a settlement with the bankruptcy estate of RadioShack over $46 million in unused gift cards– The agreement would give priority to some card holders

who would receive full payment, while other card holders would have general unsecured claims

– The agreement also calls for a $500,000 reserve for gift card claims

• The settlement demonstrates the continuing importance of consumer protection issues in the RadioShack bankruptcy

23

Private LitigationDevelopments

24

“Prior Express Consent” under TCPA

• Murphy v. DCI Biologicals Orlando, LLC, No 14-10414 (11th Cir.)– Upheld dismissal of a class action after concluding that the plaintiff gave

“prior express consent” to be contacted by including his cell phone number on a “New Donor Information Sheet”

– The district court had concluded that it lacked jurisdiction under the Hobbs Act to review a 1992 FCC Order interpreting “prior express consent”

– The Eleventh Circuit agreed and rejected the plaintiff’s argument that the 1992 FCC Order was contrary to the plain language of the statute, because doing so would require setting aside the 1992 FCC Order

• Hill v. Homeward Residential, Inc., No 14-4168 (6th Cir.)– Upheld decision concluding that a plaintiff had given his “prior express

consent” by providing his cell phone number in connection with a debt– Plaintiff argued he did not consent because he did not provide his

number during the initial transaction that resulted in the debt owed, but instead provided the number to the company three years later after he disconnected his landline

25

Data Breach Class Actions• Several putative class action lawsuits were filed in

August arising from recent data breaches• Most notably, Ashley Madison has been hit with

allegations in at least three lawsuits that it failed to adequately protect customer data– On July 20th, Ashley Madison confirmed that it was the victim of

a cyberattack that, according to plaintiffs, included names, addresses, and credit card information of 39 million members

– On August 18th, hackers claimed to have publicly released data that was stolen during the attack

– In addition to allegations regarding the company’s security practices, the complaints also included allegations that the company failed to provide users with timely and sufficient notice of the breach and failed to delete members’ data even after customers paid $19 to have information removed

26

Football Helmet Comparative Claims• In Thiel v. Riddell, Inc. et al., 1:13-cv-07585 (D.N.J.), the court

denied in part a motion to dismiss allegations that Riddell made false or misleading claims that its “Revolution Helmet” reduces the incidence of concussion– Plaintiffs alleged defendants made false or misleading claims about youth

helmets and about Riddell’s “concussion reduction technology,” which referenced a 31% reduction in the incidence of concussion based on a University of Pittsburgh Medical Center (UPMC) study

– The court concluded that plaintiffs did not plausibly allege that accurate characterizations of the UPMC findings were false or misleading, despite assertions that the study had design defects and issues with potential bias

– The court concluded that plaintiffs did state plausible claims with respect to defendants’ youth helmet advertisements (which were not part of UPMC study) and its “concussion reduction technology”

• A related case is pending, namely, Midwestern Midget Football Club, Inc. v. Riddell, Inc., No. 2:15-00244 (S.D. W. Va.)– The court granted a motion to amend in light of In re GNC Corp., 789 F.3d

505 (4th Cir. 2015), which created a stricter standard for “literal falsity” claims27

“Handcrafted” Labeling• In Scott Welk v. Beam Suntory Import Co., No. 15cv328-LAB

(JMA) (S.D. Cal.), the district court dismissed a complaint alleging that Jim Beam bourbon labels were misleading because they contained the word “handcrafted”– The plaintiff alleged that a reasonable consumer would believe that

Jim Beam was created by hand and therefore of higher quality– The court noted that the word “handcrafted doesn’t fit the process

of making bourbon” and that “[m]achines, including stills and other equipment, have always been necessary to make bourbon”

– Therefore, the court concluded that a reasonable consumer would not believe the product is literally created by hand and that the claim was “inactionable as ‘mere puffery’”

• A similar putative class action was filed in Alabama federal court on August 5th against Fifth Generation, Inc., alleging that Tito’s Vodka labels were misleading because they contained the word “handmade”

28

“Natural” Claims• In Franjul et al. v. Kimberly-Clark Corp. et al., No. 1:15-cv-06200 (S.D.N.Y.

filed Aug. 6, 2015), two consumers filed a proposed class action against Kimberly-Clark Corp. for allegedly misleading consumers regarding its Huggies “Pure and Natural” diapers and “Natural Care” wipes

– According to the complaint, “[t]he diapers are neither pure nor natural because they contain unnatural and potentially harmful ingredients such as polypropylene and sodium polyacrylate. Likewise, the wipes are not natural because they contain unnatural and potentially harmful ingredients such as sodium methylparaben and methylisothiazolinone.”

• Similarly, in Langan v. Johnson & Johnson Consumer Cos., Inc., No. 3:13-cv-01471 (D. Conn. filed Oct. 7, 2013), a plaintiff sought class certification in her suit against Johnson & Johnson related to its Aveeno baby bath products that allegedly contained a misleading “natural” label

• Finally, the FDA issued its first-ever warning to cigarette makers for the use of “additive-free” or “natural” in a manner that would lead consumers to believe that such cigarettes pose fewer health risks

29

Questions?

Reed Freeman: reed.freeman@wilmerhale.comHeather Zachary: heather.zachary@wilmerhale.com

Patrick Bernhardt: patrick.bernhardt@wilmerhale.com

30