FTC Section 5 Privacy: Unfair and Deceptive Data Practices

Deception is the promise-keeping theory: a representation or omission likely to mislead reasonable consumers on a material point. Privacy policies claiming data is never shared while pixels fire to ad platforms, 'anonymized' claims for re-identifiable data, fake encryption assurances, all classic deception. Unfairness needs no broken promise: a practice is unfair if it causes or is likely to cause substantial injury consumers cannot reasonably avoid, not outweighed by countervailing benefits, the theory behind pure data-security cases (unpatched systems, default passwords) and behind actions targeting harmful data practices consumers never see, like selling precise location traces revealing visits to clinics and shelters. Most complaints plead both, and the practical lesson is symmetrical: say what you do, and do not do what a reasonable person would find indefensible even if you never said otherwise.

The doctrine's spine: Eli Lilly (2002, first privacy-promise case, Prozac patient email exposure); BJ's Wholesale and Wyndham (unfairness for weak security, with the Third Circuit's 2015 Wyndham decision confirming FTC authority); LabMD (11th Circuit trimming vague injunctions, orders now specify controls); Facebook (2012 order, then the record $5 billion penalty in 2019 for violating it); Equifax ($575M+ with CFPB and states). The modern wave: GoodRx and BetterHelp (2023, health data to advertisers, HBNR's first use plus Section 5); Epic Games ($520M combining COPPA and dark patterns); Kochava and the location-data actions; Rite Aid (2023, unfair AI, facial recognition misidentifying customers, with algorithmic remedies); Amazon Alexa and Ring (children's recordings, employee access). Each order writes rules the next company inherits.

The standard privacy/security order runs about 20 years and includes: prohibited misrepresentations (the conduct clause); a mandated comprehensive privacy or security program with documented risk assessment and controls; biennial third-party assessments filed with the FTC; incident reporting to the Commission; recordkeeping and compliance monitoring; and increasingly, executive certifications, named officers annually attest to compliance, converting corporate promises into personal exposure. Recent orders add specific remedies: data and algorithm deletion, bans on sharing health data for advertising (GoodRx, BetterHelp), multi-year facial-recognition bans (Rite Aid). Violating any term triggers per-violation civil penalties, Facebook's $5 billion was an order-violation case, which is why the first order is the expensive thing to acquire.

Almost certainly, if you are a for-profit company in or affecting US commerce. Section 5 reaches corporations regardless of sector, with carve-outs for banks and credit unions (prudential regulators), common carriers in that capacity, insurers to the McCarran-Ferguson extent, and true nonprofits (though the FTC has pursued nominally nonprofit shells). It applies alongside sectoral laws: a HIPAA-covered entity can face OCR and FTC theories on the same facts, and the FTC's Health Breach Notification Rule deliberately covers the health-app world HIPAA misses. Foreign companies serving US consumers are reachable. The practical point: there is no 'we are unregulated' zone in US consumer data, Section 5 is the floor under everyone.

Five visible fronts. Health data: HBNR enforcement plus Section 5 against apps and telehealth platforms sharing with advertisers. Sensitive location data: actions and settlements against brokers (Kochava litigation, X-Mode/InMarket orders) over precise traces to sensitive places. Dark patterns: manipulative consent and cancellation flows, from Epic's $245M dark-pattern component to click-to-cancel rulemaking. AI: deceptive AI claims, model-training data practices, and algorithmic disgorgement as a remedy. Children and teens: COPPA enforcement at scale and scrutiny of engagement-optimized design. Commission priorities shift with administrations, but these dockets are grounded in litigated orders and rules, which do not evaporate with leadership changes.