The Essential Guide to FTC Compliance, Investigations, and Enforcement

The Federal Trade Commission Act (the “FTC Act”) is a federal statute that appears in the U.S. Code at 15 U.S.C. §§41 through 58. The FTC Act creates and empowers the Federal Trade Commission (the “FTC” or, in its own publications, the “Commission”) to regulate trade to prevent unfair and deceptive acts and practices affecting consumers. As relates to e-commerce and internet advertising, Section 5 of the FTC Act prohibits making false and misleading statements to consumers in any form, including display ads, text and email communications, publisher or merchant websites, and labels and other product packaging. The FTC Act enables the FTC to investigate and prosecute businesses and people who engage in deceptive advertising.

The FTC has expounded on the FTC Act with a series of publications and rules that apply to merchants and advertisers. Some of these rules address specific advertising practices, such as the use of testimonials and other endorsements in advertising. Others apply to high-risk products or verticals, including business opportunities and weight loss products. These rules and publications are available on the FTC’s website, and we go into several in more depth below.

In addition to the FTC Act, the FTC has been put in charge of enforcing several U.S. laws that apply to advertising and e-commerce. These include the CAN-SPAM Act of 2003, 15 U.S.C. §7704 et seq., the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §6501, et seq., the Consumer Review Fairness Act (“CRFA”), 15 U.S.C. §45(b), the Restore Online Shoppers’ Confidence Act (“ROSCA”) regarding negative options, 15 U.S.C. §8401 et seq., and the Fair Credit Reporting Act (“FCRA”), 15 USC §1681 et seq. Thus, in addition to unfair or deceptive advertising, the FTC can investigate and enforce violations of these statutes.

Certain business activities present increased risk of an FTC investigation or FTC lawsuit—often because the FTC has determined that this activity is historically rife with unfair, deceptive, or otherwise non-compliant practices. As affects e-commerce merchants and those in the performance marketing industry, these areas of increased risk can be divided into four categories: (1) advertising practices (meaning, the substance of the advertising), (2) advertising methods (as in method of delivery), (3) billing practices, and (4) offers or verticals. This section focuses on the first category, high-risk advertising practices, and how to ensure compliance in your advertising content.

Advertising is any claim about the advertised product or service made to a consumer, regardless of whether that claim is made in a display ad, in a promotional email, on a website, on a radio or television commercial, in a video sales letter (“VSL”), on an Amazon marketplace listing, on product packaging or labels, on a billboard or in-store signage, or through any other means. Simply put, any time you make a claim about your product, you need to be able to back it up with proof. The type of proof, or “substantiation,” required is often dictated by the nature of the claim, and the more specific the claim is, the more nuanced the substantiation needs to be. The following are just a few examples that, together, demonstrate a spectrum of substantiation:

We recommend maintaining a “substantiation file” of all support for your product benefit claims and placing it in a secure location such that it will not be lost or deleted. The time to locate substantiation for your advertising claims is concurrent with—that is, at the same time as—your advertising. If you do so, you will have peace of mind from an FTC compliance perspective that you can back up everything you tell consumers about your product. Do not wait until you are facing an FTC investigation or FTC lawsuit to try and reverse engineer support for your advertising claims.

An endorsement is any advertisement or indication of sponsorship for your product by a third party. An endorsement can be as overt as a celebrity spokesperson saying “I endorse this product,” to something as subtle as an Instagram influencer posting a picture of herself with your product in her purse. A testimonial is a specific type of endorsement wherein the third party speaks to their own experience with the product, such as “I lost thirty pounds using this product.” Even before/after pictures can serve as a testimonial to the product’s effectiveness.

The FTC takes endorsements and testimonials very seriously. Any endorsement that does not disclose that the third party received something of benefit (e.g., money, commissions, equity in your company, or even free product) is considered false and misleading and therefore a violation of the FTC Act. Similarly, testimonials that are misleading in any manner—for example, by photoshopping before/after pictures, or attributing a testimonial to a non-customer or even a fake customer—are not compliant. In response to the growing use of social media influencers to advertise products, the FTC issued updated endorsement guidelines, which provide tips on disclosing sponsorship or payment when posting testimonials online, including by influencers on social media.

The key to ensuring your endorsements and testimonials are compliant is to make certain that they are (a) truthful and (b) transparent. Regarding truthfulness, do not say or do anything that would exaggerate or otherwise misstate the results the endorser experienced as a result of using the product. As for transparency, clear and conspicuous disclosure that the endorser was compensated is required.

When space is limited for disclosures, like in social media posts, disclosures such as #ad or #promotion may be adequate, depending on the circumstances. In situations where a product reviewer received free product in exchange for a review, that must be disclosed in the review itself.

Best practices for complying with the law governing endorsements and testimonials is in flux due to continually changing technology and internet advertising practices. Thus advice from experienced FTC defense lawyers is recommended for businesses facing these issues.

Claims that products are “Made in the U.S.A.” are regulated by the FTC. Just because you are a U.S. business does not mean you are able to make this claim with abandon. The FTC requires that products advertised as “Made in the U.S.A.” be “all or virtually all” made in the United States. It is deceptive—and therefore a violation of the FTC Act—to sell merchandise advertised or marked as “Made in the U.S.A.” (or a similar phrase) if it has been entirely or substantially made, manufactured, or produced outside of the United States. Of course many products have components that are sourced internationally, and in those cases the question is whether the final product sold to consumers has been substantially transformed with processes in the United States. If you’re confident you meet these criteria and choose to use a “Made in the U.S.A.” designation in connection with your product, you need to have substantiation on file to support these claims, including supplier and manufacturing records showing the product was made, or substantially transformed, in the United States.

For years, a popular internet advertising technique has been to pressure customers into completing a sale with suggestions that supply is running out, a sales price will soon increase, or an exclusive invitation to participate in the offer will expire. However, such “pressures” are often demonstrably false—upon refresh of the page a week later, the limited supply remains the same, the sale never ends, and the invitation code always works. Because any effort to deceive or trick a customer into making a purchase, no matter how trivial, is a violation of the FTC Act, the FTC regularly takes action against companies engaging in false pressures.

Internet advertising as we know it would not exist without the availability of stock photography, but certain uses of stock photography can land you in trouble with the FTC. Specifically, when stock photography featuring a model (as opposed to background, landscapes, or abstract graphics) is used in conjunction with your product, it can lead consumers to believe the model is a bona fide user of the product. The issue is whether the stock photography is used in a manner that suggests or implies certain product benefits. For example, if your offer is for an online learning course and you use stock photography featuring a model sitting at a computer, the image is merely illustrative of the product but does not promise certain benefits from using it. By contrast, if your offer is for a weight loss product and you use stock photography featuring a slender model in a bikini with a measuring tape around her waist, it suggests that she has actually used the product to lose weight and attain her good figure. Because the model did not use your product, the use of the stock photography in the second example is false and misleading and therefore non-compliant.

Another common misuse of stock photography is to depict a fictional spokesperson or “face” of the offer. If it is clear from your advertising that the spokesperson is fictional (e.g., Progressive’s “Flo” or Jack in the Box’s “Jack”), then it is not misleading. However, if you use stock photography to depict someone identified as the CEO of your company, the inventor of your product, or a doctor endorsing the product, you’re deceiving consumers by leading them to believe the depicted persons are real. As such, it’s a violation of the FTC Act.

The advertising practices discussed in the preceding section deal with advertising content. By contrast, advertising methods involve the means by which the advertising content is delivered. Advertising methods include paid search, display advertising, email advertising, and so forth. The following are some of the advertising methods that are heavily regulated and/or frequently targeted by the FTC, meaning they come with increased risk.

Not every business has the time or resources to master the complex ins and outs of advertising on the internet. The affiliate advertising industry was created as a solution to this problem—businesses who sought to promote their products (often called “Advertisers”) could engage others with high-trafficked websites or specific advertising skills (interchangeably referred to as “Affiliates” or “Publishers,” but we will use the term “Affiliate” here) to help them do so. However, the need to engage and manage a stable of Affiliates presented its own problem—while large companies such as Target and Amazon have the staff to oversee in-house Affiliate programs, other businesses do not. Thus, Affiliate “Networks” grew in popularity as a means of connecting Advertisers with a stable of anonymous Affiliates who drive traffic to Advertiser’s offers through various means.

The risks inherent in Affiliate advertising are an issue of scale. It is impossible for every Advertiser, or every Network for that matter, to oversee the advertising actions of each Affiliate. This problem is compounded by Affiliates who intentionally conceal their websites and other advertising methods from Networks and Advertisers so as to prevent their methods from being stolen—the “secret sauce” of advertising, if you will. Moreover, the competitive nature of internet advertising provides ample incentive for Affiliates to go rogue—that is, to engage in risky and non-compliant advertising practices and methods to obtain a competitive edge over other affiliates promoting the same offer. The Rogue Affiliate willfully violates the FTC Act and other regulations even though he or she has often signed an affiliate agreement attesting to their legal compliance.

The FTC takes the position that the Advertiser and Network are responsible for the actions of the Rogue Affiliate, even if the Advertiser and Network did not know of the misconduct, did not authorize the misconduct (or even prevented it in their agreements), or did not know or have a direct relationship with the Rogue Affiliate. According to the FTC, if the Advertiser benefitted from the Rogue Affiliate’s misconduct, it should be responsible for reimbursing the affected consumers for the sales or other income the Advertiser generated as a result of the Rogue Affiliate. In our experience, the FTC has seldom initiates enforcement actions against Rogue Affiliates. Accordingly, there is little perceived downside to the Rogue Affiliate in engaging in non-compliant advertising practices and methods.

If you are an Advertiser, in addition to reviewing your own content for compliance, you need to stay informed about the advertising activities of those working for you. Often, this can be accomplished through simple internet searches for your own offer. This responsibility includes a need to review Affiliate conversion rates for any aberrations. If one Affiliate is able to drive unlimited traffic to your offer while others struggle to do so, you owe it to yourself and your customers to investigate whether that Affiliate is padding its conversion rate through unauthorized content and methods. By engaging in Affiliate advertising, you are assuming a certain amount of risk, but this risk can be mitigated by careful and consistent review of all your campaigns.

The FTC has taken an interest in cases involving online sweepstakes, prizes, promotions, and gaming, which are subject to FTC consumer protection statutes and a multitude of state laws. In particular, the FTC regulates sweepstakes as potential deceptive practices under the FTC Act. The FTC will view a sweepstakes as deceptive unless it includes the name and address of the sponsor, duration of the sweepstakes, the prizes given away, the retail value of the prizes, and the odds of winning. The rules must also disclose eligibility requirements, entrance conditions, and any other limitations. Furthermore, the FTC has taken expansive views of what constitutes requisite prizes and “chance” for the purpose of sweepstakes. Companies creating any type of online sweepstakes, prize, promotion, or lottery-type offer should carefully review the offers for compliance, including under the FTC Act and related state laws and cases.

The United States has multiple laws governing the sending of unsolicited commercial email, otherwise known as spam. Most notably, the U.S. federal government has enacted the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, 15 U.S.C. §§7701 et seq. (“CAN-SPAM”). CAN-SPAM applies to all commercial emails that are sent to any computer used in or affecting interstate or foreign commerce, including computers outside of the U.S. The FTC has been charged with the enforcement of CAN-SPAM, even though private ISPs also have standing to sue under the statute.

CAN-SPAM prohibits a person or business from sending an email or having another person send an email with: (1) false or misleading header information, such as the use of domain names or “friendly from” lines that pretend the email is from someone other than the sender (e.g., from “Oprah Winfrey”); or (2) deceptive subject lines that mislead the recipient about the content of the email (e.g., “Your $1M Prize is Waiting for You!”). CAN-SPAM also regulates the registration of sending domains and sending email accounts using false contact information, or false or unauthorized use of IP addresses.

Additionally, to comply with CAN-SPAM, a person or business sending an email, or having another person (such as an Affiliate) send an email, must comply with the following:

• Identification as Advertisement—the body of the email must conspicuously identify the email as an advertisement.
• Postal Address—the body of an email must identify a valid physical postal address for the advertiser or for both the advertiser and the sender.
• Unsubscribe Link—the sender must provide a conspicuous unsubscribe link in the body of the email and must honor opt-out requests within 10 days of receipt.

When it comes to FTC enforcement, the FTC is particularly prone to investigating so-called “aggravated violations” of CAN-SPAM. These violations include circumstances where emails are obtained through harvesting websites, the email list is generated through automatic means, or the emails “spoof” the known contacts or friends of the recipient (where the contact information of recipients is often obtained through criminal hacking). Aggravated violations can greatly increase the amount of damages recoverable in an enforcement action.

(Note: In addition to CAN-SPAM, several states and foreign entities have enacted anti-spam legislation. This article speaks only to the compliance requirements of CAN-SPAM and not any other regulation, such as California’s Anti-Spam Act, which may differ.)

Various laws and regulations govern telemarketing, most significantly, the Federal Telephone Consumer Protection Act, 47 U.S.C. §227 (“TCPA”) and the rules under the Telemarketing and Consumer Fraud and Abuse Prevention Act (“TCFPA”), 15 U.S.C. §87, and specifically the Telemarketing Sales Rule, 16 C.F.R. §310 (“TSR”). Additionally, many states have adopted their own telemarketing laws, which may impose additional restrictions on telemarketing. In order to avoid exposure to the risk of lawsuits, civil penalties, and possibly even criminal charges, telemarketers must familiarize themselves with these laws.

The TCPA contains several restrictions on making commercial phone calls, the most important of which are summarized below.

• The TCPA prohibits using an automatic telephone dialing system (“ATDS”) to call any mobile phone number without the prior written consent of the called party.
• The TCPA prohibits using an ATDS to send text messages without the prior written consent of the texted party.
• The TCPA prohibits calling a residential or mobile phone number using an artificial or prerecorded voice to deliver a message without the prior written consent of the called party.
• The TCPA prohibits sending unsolicited fax advertisements.

The TCPA allows a person who has received calls or text messages in violation of the TCPA to bring a lawsuit to recover up to $500 in statutory damages per call (or up to $1,500 in statutory damages per call if the defendant acted willfully or knowingly). Additionally, the TCPA authorized the FTC to create the Do Not Call Registry, which is discussed below. The TCPA allows a person who has received more than one call in 12 months in violation of the Do Not Call Registry provisions to recover up $500 in statutory damages per call (or up to $1,500 in statutory damages per call if the defendant acted willfully or knowingly). Finally, an aggrieved person can seek to represent both him/herself and other similarly affected call recipients in a civil class action, and seek to recover up to $1,500 for each call to each affected person.

Entities such as lead generators, which do not actually place phone calls, may still come within the scope of the TCPA if they broker consumer leads generated by, or resulting in, phone calls. Such liability may arise in several ways. As an example, if an affiliate of a lead generator places a call promoting the lead generator’s own goods or services, the lead generator may face TCPA liability under traditional agency principles. As another example, even when a lead generator acts as a pass-through to a third party advertiser, the lead generator may face an indemnification claim by the advertiser if the advertiser places a violative call based on misinformation regarding consent.

Given this risk of significant TCPA liability at all levels of the lead generation and call center business models, any entity operating in this space (e.g., call centers, lead generators, and advertisers) should develop a set of thorough written compliance policies, which they should require all business partners and affiliates to review and to acknowledge compliance. Most businesses facing TCPA issues benefit greatly from the advice of experienced FTC defense attorneys on these issues.

Under the Telemarketing Sales Rule (“TSR”), “telemarketing” is a plan, program, or campaign to induce the purchase of goods or services or a charitable contribution through interstate phone calls. Subject to certain exceptions, any business that takes part in telemarketing activities must comply with the TSR and other applicable laws. This is true whether a telemarketer initiates phone calls to consumers or receives phone calls from consumers. Moreover, the TSR applies whether the telemarketer places calls from within the United States or from outside of the country. Finally, to the extent a telemarketing call is placed on behalf of a lead generator or to develop a lead to be brokered by a lead generator, that lead generator arguably falls within the scope of the TSR.

The TSR applies not only to telemarketers, but also to “sellers,” i.e., businesses that provide, offer to provide, or arrange to provide goods or services to consumers in exchange for payment. And contrary to popular belief, charitable solicitations made by for-profit telemarketers are covered by the TSR. Such businesses are referred to as “telefunders,” and they are subject to various regulations. Despite the general breadth of the TSR, some entities are wholly exempt, like non-profit organizations, banks, and common carriers. Please note that even when an exempt entity is involved, a business that contracts with that exempt entity to telemarket its services will still be subject to the TSR.

The TSR sets forth numerous requirements for placing telemarketing calls. Moreover, and not surprisingly, the TSR prohibits sellers and telemarketers from making false or misleading statements to induce sales or donations. First, the TSR requires sellers and telemarketers to provide material information before the consumer pays for the goods or services in a clear and conspicuous manner (for example, cost, quantity, restrictions). The information that must be provided is significant and detailed, and often depends on the type of offer involved or the marketing technique used (for example, negative options, sweepstakes, debt relief offers, and credit card loss prevention offers, all have unique requirements). In addition to the above-described disclosures, before any sales pitch is delivered, a telemarketer must provide prompt oral disclosure in sales calls of the following four items of information clearly and conspicuously: identity of the seller, purpose of the call, nature of the goods, and any prize promotion details.

The disclosure requirements for telefunders soliciting contributions to charities are less severe than with sales calls. Even so, telefunders must still make two clear and conspicuous oral disclosures before soliciting a donation to a charity: (1) the telefunder must identify the charitable organization; and (2) the telefunder must explain that the purpose of the call is to solicit a charitable contribution.

The TSR also prohibits: a) calls to any person who has asked not to receive calls from a particular seller; and b) calls to any number on the National Do Not Call Registry. When a consumer has asked not be called again, sellers must not call that person again. To accomplish this, sellers and telemarketers are responsible for maintaining their own individual Do Not Call lists, which are also called entity-specific Do Not Call lists. The TSR also contains calling time restrictions and restrictions on call abandonment, as well as several exceptions to the Do Not Call requirements, like the established business relationship exception and the written permission exception.

The FTC is charged with enforcing the Consumer Review Fairness Act (the “CRFA”), 15 U.S.C. §45b. The CRFA was enacted in 2016 to address “muzzling”—that is, a growing practice of companies contractually preventing their customers from posting bad reviews, such as with a ban on negative reviews in their terms and conditions. Under the CRFA, it is now illegal to include any provision in your customer terms that:

• prohibits or restricts the ability of the customer to review your business;
• imposes a penalty or fee against the customer for posting a negative review; or
• purports to require your customer to transfer the copyright in all of their reviews about your business to you, so that you can demand they be removed from review sites on the grounds of copyright infringement.

Violations of the CRFA are treated as violations of the FTC Act and are punishable with the same remedies. In addition, if the FTC is not interested in prosecuting you, a state attorney general is provided with the ability to do so in the FTC’s stead.

So what can you do to address false reviews without violating the CRFA? Unlike other FTC-enforced legislation, the CRFA addresses this issue, and says it’s OK to prohibit or remove a review that:

• contains confidential or private information – for example, a person’s financial, medical, or personnel file information or a company’s trade secrets;
• is libelous, harassing, abusive, obscene, vulgar, sexually explicit, or is inappropriate with respect to race, gender, sexuality, ethnicity, or other intrinsic characteristic;
• is unrelated to the company’s products or services; or
• is clearly false or misleading (however, it’s unlikely that a consumer’s assessment or opinion with which you disagree meets the “clearly false or misleading” standard).

While it may seem like a surefire way to protect your reputation, muzzling reviews only causes more trouble than it is worth. Most FTC investigations are initiated by consumer complaints. When you prevent your customers from expressing their honest opinion about your goods and services on your website or consumer review sites, you leave them with little choice but to take their complaints to the FTC, thereby increasing your risk of an FTC investigation.

A surefire way to attract FTC attention is through high risk billing practices, such as subscription billing and upsells that are not clearly and conspicuously disclosed to consumers before they provide a merchant with their credit card information. When a consumer makes a purchase in a brick and mortar store, the price is communicated to the consumer before they pay for it – and often several times before they hand over cash or credit. For example, the price may be printed or tagged on the item itself, there may be a price displayed on the shelf or other signage adjacent to the product, the consumer notes the price as the item is rung up at the register, the total cost of the shopping trip is communicated verbally by the cashier and visually onscreen to the consumer, and the consumer is given a final opportunity to select “OK” at the pay terminal to approve the amount of the transaction. The aim of ROSCA (discussed below) and FTC Guidelines regarding billing practices is to replicate this real life experience to the extent possible in online transactions. However, billing methods like free trials that convert to subscriptions plans, or subscription plans that begin immediately, present a greater potential for the consumer to be surprised by the amount they end up being charged. Accordingly, these billing practices are high risk.

The FTC defines negative option billing as a plan where the seller discloses an offer to provide merchandise or services to a consumer, and thereafter the consumer is billed for the merchandise or services, unless by a certain date or within a time specified by the seller the consumer cancels the order or otherwise instructs the seller not to send the merchandise. The FTC’s Negative Option Rule (16 CFR Part 425), the FTC Act, and the federal Restore Online Shoppers’ Confidence Act, 15 U.S.C. §8401 (ROSCA), all apply to negative option billing plans and can be enforced by the FTC. Sellers often describe negative option offers as “free trials,” where the consumer receives a product but is only charged if the product is not returned after a certain period of time.

Different rules regarding negative option offers apply in different factual circumstances, but the key requirement is that consumers must affirmatively consent to the terms of the negative option billing plan, which must be conspicuously disclosed to consumers in close proximity to the point where action is taken by the consumer to enter the agreement. Importantly, the key terms, including price and the period of time in which the consumer can cancel the agreement must not only be conspicuously disclosed, but must be disclosed prior to the point where a consumer provides credit card details to the seller.

Some negative option offers also contain subscription billing, where a consumer will continue to be charged (often monthly) for periodic delivery of new products, unless he or she cancels the subscription billing agreement. Just like negative option offers, subscription billing offers must contain details about the amount that will be billed, the frequency of billing, and the manner in which consumers may cancel the subscription.

There are also state laws that regulate subscription billing, like the California Automatic Renewal Law (California Bus. & Prof. Code §17600), which may have additional requirements like post-transaction email summaries of the key terms and the ability to cancel online if the transaction occurred online.

Merchants that want to process credit card transactions must apply to an "acquiring bank" and enter a credit card processing contractual relationship. Acquiring banks have relationships with the card associations (i.e., Visa, MasterCard, etc.), and thus acquiring banks are subject to the various fraud monitoring programs of the card associations. The card associations and acquiring banks have various standards that apply to merchants processing credit cards, and if a merchant falls below a particular standard, the merchant may be terminated. For example, if a significant number of a merchant's customers initiate "chargeback" requests, then the bank may terminate the merchant. Or, if the merchant has a history of defrauding consumers and having credit card processing relationships terminated, then an acquiring bank may deny a merchant's application for a new credit card processing account.

Some unscrupulous merchants attempt to circumvent the rules of the card associations and acquiring banks. For example, the VISA and MasterCard chargeback monitoring programs apply only to merchants with at least 100 chargeback transactions per month, and as a result some fraudulent merchants can manipulate the system and avoid chargeback monitoring by spreading their transactions across multiple merchant accounts and ensuring that no single account has more than 100 chargebacks per month. One technique some merchants have used is opening many shell companies as fronts. The merchant then cuts deals with individuals with good credit scores to be the faces of the shell companies, which apply for merchant accounts. When credit cards are processed, all of the proceeds flow through the shell company and to the true merchant, who may replicate this structure many times with many shell companies. This business practice, referred to as "credit card laundering" by the FTC, is a violation of the FTC Act.

The practice of credit card laundering has become fairly common in the affiliate marketing industry, despite the FTC's position about how it is unlawful. In fact, many internet marketers refer to the people who are the faces of credit card laundering shell companies as "IBOs,” which is short for independent business operation. Despite the self-serving moniker, IBOs are unlawful if the "true merchant" is someone other than the so-called IBO. In other words, if the IBO is not getting the revenues and profits of the business, and if the IBO is not performing any significant work for the business, then the IBO structure is a sham and violates the FTC Act.

It is a high risk business practice for a merchant to conceal its identity to banks in a credit card processing scheme. However, some complex business relationships that are not created for the purpose of circumventing the rules and regulations of banks and card associations may pass muster with the FTC. The analysis needed for determining whether a business is engaging in credit card laundering is a fact-intensive inquiry best conducted with an experienced attorney knowledgeable about FTC guidelines and the credit card processing industry.

“Upsells” are a high-risk advertising method wherein the consumer is encouraged to buy an extra product or service either just prior to completing the primary transaction, or just after. The intent of upsells is to capitalize on the consumer’s already-made decision to make a purchase by encouraging an extra impulse buy, not unlike the magazines, sodas, and candy displayed next to the cash register at the grocery store. Of course, grocery shoppers are well-aware at the time they add that pack of gum to the conveyor belt that it will result in an extra charge. The problem with upsells is that it is not always obvious or clear to the internet user that they are agreeing to purchase an additional item. Because of this tendency to mislead consumers, upsells are a good way to garner bad attention from the FTC.

There are three primary types of upsells the FTC investigates. The first type is third-party upsells, where the upsell product is sold by a different merchant than the one conducting the primary transaction. Third-party upsells are extremely high-risk due to the difficulty of adequately disclosing to the consumer that the upsell is offered by a third-party and the consumer’s financial and billing information will be transferred to the third-party.

Third-party upsells are governed by ROSCA, the Restored Online Shoppers Confidence Act. ROSCA comes up in compliance conversations frequently because it governs the “clear and conspicuous” disclosure requirements for negative options. However, ROSCA also has a section that requires additional disclosures for third-party upsells. What ROSCA aims to prevent is the transmission of the consumer’s credit card information to the upsell merchant without the consumer’s informed consent. Because such transfers implicate privacy and banking regulations in addition to ROSCA, they are highly-disfavored.

The second type of upsells are opt-out upsells, where the consumer is automatically enrolled in an upsell unless they take affirmative action to opt-out. Examples include pre-checked boxes opting in to the upsell, or situations where the consumer takes no action to opt-in, but is required to take some action (such as sending an email, making a phone call, or completing a form) to opt-out. The FTC usually takes the position that opt-out upsells are misleading and/or deceptive because they fail to give the consumer the opportunity to refuse to purchase certain products and services. As such, they are very high-risk.

The third type of upsells is opt-in upsells, where the consumer is not enrolled in an upsell unless they take affirmative action to opt-in. Examples include pre-checkout menus provided to the consumer where the consumer has to affirmatively check the box next to each upsell in order to add it to their cart. If the consumer does not check any boxes, the upsell is considered declined.

Historically, opt-in upsells have been considered more compliant than their more aggressive counterparts, but in recent years, the FTC has brought several enforcement actions against companies engaged in post-checkout upsells that appear to be a continuation of the first transaction. Generally, the consumer is taken through checkout to complete the transaction for the original product. However, after completing checkout, the next page in the sales funnel is not a thank-you or confirmation page, but an upsell page containing a call-to-action such as “Wait! Just one more thing to complete your order!” Thus, the consumer reasonably believes that they need to click an additional button to agree to the primary transaction, when, in fact, they are opting-in to the upsell. The FTC’s position is that such opt-in upsells are false and misleading and therefore a violation of the FTC Act.

Over the past twenty or so years, the FTC has filed more enforcement actions regarding specific types of offers than others, such as “be your own boss” business opportunities and weight loss products. In some cases, the FTC has gone so far as to formally announce an attack on a particular type of offer, or issue guidelines specific to sales of certain products. Because these high-risk product categories or verticals are subject to special FTC regulations and attract enhanced FTC scrutiny, they are high risk.

The FTC has jurisdiction to investigate and initiate enforcement actions against companies operating deceptive business opportunity offers. There are two types of business opportunity offers in the eyes of the FTC. First, there is a Business Opportunity Rule that is embodied in a federal regulation and enforced by the FTC. That regulatory definition of business opportunities is rather narrow, covering, in short, sellers that maintain some sort of business relationship with the consumer after the initial payment, to provide locations for equipment, to provide outlets or customers for the buyer of the business opportunity, or to buy back goods or services from the buyer of the business opportunity. There are many requirements for sellers of such business opportunities, such as the requirements to disclose certain documents, refund policies, disclose the names of others who have purchased the business opportunity in the last three years, as well as many other requirements.

The second type of business opportunity under the FTC's jurisdiction is general offers to provide information and other tools to allow a consumer to generate profits. Sometimes business opportunities include ongoing "coaching" services, along with ongoing payments for these coaching services. Some examples of internet business opportunities are offers to teach consumers how to make money a) in ways not disclosed until you purchase the business opportunity, b) buying and selling real estate (i.e., flipping houses), c) using various systems to game the stock market, and d) selling products on Amazon. The FTC often characterizes these sort of offers that violate the FTC Act as "get-rich-quick" schemes. Despite this negative moniker of the FTC, there are many ways to run lawful, FTC-compliant business opportunity offers on the internet, including offers that include ongoing coaching services.

To assess the lawfulness of a business opportunity offer, one must break down all the marketing claims. Most importantly, past claims of income success of other consumers who purchased the business opportunity must be true. Often this data is complex, so it must be presented in a manner that reasonable consumers would understand. Also, claims about the amount of time and money that a consumer will need to invest in the business opportunity in the future are also important. There is some overlap between the analysis of business opportunity offers and the FTC Endorsement Regulation. Specifically, if actors are used to sell a business opportunity (for example, in online videos), then one must disclose the use of actors if there is any implication that the characters played by the actors actually used and had success with the business opportunity. Also, if any actual customers provide testimonials about their success with a business opportunity, those testimonials must be truthful, and if the consumer was compensated (with either money or free product/services), the fact that he or she was compensated must be disclosed.

It should also be noted that the marketing of business opportunities, especially those falling outside the Business Opportunity Rule and viewed by the FTC as potential "get-rich-quick" schemes, are high risk offers. In other words, business opportunities is an area that the FTC knows will always be rife with fraud and deceptive practices, and for that reason the FTC will continually be on the lookout for business opportunity offers that violate the law.

Nutraceuticals and dietary supplements range from medium risk (e.g., daily vitamins) to high risk for certain verticals (e.g., weight loss, addressed more fully below). Within the United States, the advertising, labeling, and sale of foods, drugs, and cosmetics are regulated by the FDA. Through various regulations, including the Dietary Supplement Health and Education Act of 1994 (DSHEA), the FDA distinguishes between “drugs” and “dietary supplements.” Under the DSHEA, dietary supplements include products intended to supplement the diet, such as vitamins and minerals. 21 U.S.C. §321(ff). Drugs require a lengthy and expensive approval process before they can be sold, while supplements do not. Ingredients (and combinations thereof) that fall under the purview of DSHEA are legal for sale and consumption in the United States so long as they are manufactured, labeled, and advertised in accordance with FDA guidelines. Such products do not require a prescription and are legal to purchase over-the-counter or online.

There are important restrictions on the advertising claims that can be made about dietary supplements. The manufacturer or distributor of a dietary supplement must ensure that: (1) the supplement is safe for human consumption; (2) the product benefit claims are not false or misleading; and (3) no product benefit claims indicate the supplement is a treatment or cure for a specific disease or medical condition, or to alleviate the symptoms of such. Part of your ongoing compliance challenge is to ensure that the Products stay on the dietary supplement side of the line and that you do not make product benefit claims that require the Products to be treated as a drug regulated by the FDA.

If the FDA feels you are making unauthorized claims about your supplement, it will issue a warning letter to you and force a recall of your product. However, in more egregious cases – such as where (1) outrageous claims about the product’s benefits are made without the requisite substantiation, (2) the product purports to treat medical issues that only an approved drug can, (3) the product does not contain the active ingredients in the concentration promised in advertising or disclosed on the Supplement Facts label, or (4) the product contains undisclosed ingredients, such as drugs and known allergens – the FTC will get involved. The remedies available to the FTC under the FTC Act far exceed those of the FDA under DSHEA. Thus, if you are a nutraceutical merchant, it is imperative to ensure your product is what it purports to be, including by having the product tested by a third-party lab independent of the supplier, and to limit your product benefit claims to those that are appropriate for supplements and that are substantiated by peer-reviewed clinical studies about your active ingredient(s).

Weight loss is arguably the highest-risk vertical when it comes to FTC enforcement. The FTC has regularly taken action against weight loss offers for over twenty years. In the early 1990s, the FTC initiated enforcement actions against each of the “big” programs – namely, Weight Watchers, Jenny Craig, Medifast, and Nutrisystem. In each case, the FTC accused the defendant of making promises of potential weight loss without adequate substantiation. On January 7, 2014, the FTC held a press conference to announce its renewed initiative against deceptive claims made by marketers of weight loss products. This time, the companies targeted by the FTC were not the blue-chip entities that had been around for decades, but new, internet-based businesses that downplayed the role of diet and exercise and overstated the benefit of their supplements, teas, and “hormone” therapies. The FTC has deemed these “bogus” or “fad” weight loss products and has often referred to the campaigns advertising them as “scams.”

Concurrent with the January 2014 press conference, the FTC updated its weight loss advertising guidelines and created a “Gut Check Reference Guide” for consumers and advertisers. As part of this guide, the FTC compiled a list of seven statements in ads “that experts say simply can’t be true.” These statements include the following claims about advertised weight loss products or programs:

• Causes weight loss of two pounds or more a week for a month or more without dieting or exercise (“I lost 30 pounds in 30 days – and still ate all my favorite foods.”);
• Causes substantial weight loss no matter what or how much the consumer eats;
• Causes permanent weight loss even after the consumer stops using the product;
• Blocks the absorption of fat or calories to enable consumers to lose substantial weight;
• Safely enables consumers to lose more than three pounds per week for more than four weeks (“Take off up to 10 pounds a week safely and effectively. Imagine looking into the mirror two months from now and seeing a slim reflection.”);
• Causes substantial weight loss for all users; or
• Causes substantial weight loss by wearing a product on the body or rubbing it into the skin.

Since January 2014, the FTC’s enforcement actions in the weight loss industry have continued to focus on internet-based businesses as opposed to established brands. Through these actions, the FTC has made it clear that, in order to be compliant with the FTC Act, sellers of weight loss offers must have clinical substantiation for their weight-loss claims. Moreover, because individual weight loss results will always vary, any statement of weight loss must be accompanied by a clear and conspicuous disclosure of the measures the featured individual took to lose weight and the provable average amount of weight a user of the product can expect to lose. For example, if the weight loss product is a nutritional supplement, and “Cindy” is claiming it helped her lose 50 lbs. in six months, but in addition to taking the supplement, Cindy also reduced her caloric intake to 1,000 calories per day and worked out three times a week with a personal trainer, this must be disclosed along with the provable average amount of weight lost by users of the product.

One of the biggest problems in the weight loss vertical is that the products are easy to obtain, white label, and sell, but the average results are difficult to calculate. Too many merchants foolishly rely on their competitors to do research about the product, and naively copy their advertising claims with the belief they will be able to substantiate them down the road if needed. If you are selling weight loss products, you need to be willing to do the requisite research and studies. Moreover, you need to be willing to sell them in a manner that emphasizes the role of diet and exercise and otherwise complies with the “Gut Check” principles above.

The FTC has initiated several enforcement actions against offers for wrinkle treatments and anti-aging products concerning, in particular, advertising containing unsubstantiated claims about the benefits of such treatments and products. There are a number of factors that have likely led to the FTC’s heightened interest in these offers:

Anti-Aging offers are often replete with unsubstantiatable claims, such as “Look ten years younger!”

The advertising for anti-aging offers is often peppered with claims or diagrams that tend to be scientific or clinical (e.g., “Our proprietary peptides dissolve the dry upper 10% layer of the epidermis, revealing smooth skin underneath,” or “Clinically Proven”), but are, at best, unsupported by peer-reviewed clinical research and, at worst, can be contradicted by basic dermatological principles.

Anti-aging offers often feature doctored before and after photos, or feature stock photography models that have never used the advertised product.

Anti-aging offers are often sold as subscriptions and/or in conjunction with misleading upsells.

In order to run a compliant anti-aging offer, it is imperative to forego such deceptive advertising techniques. Instead, the use of actual users of the product as models, genuine, unretouched before and after pictures, and conservative, provable statements about how the product works are the way to avoid an FTC investigation.

Nutritional supplements advertised to men – such as testosterone “boosters,” male enhancement or erectile dysfunction, or muscle-building products – have seen increased FTC scrutiny, albeit less than weight-loss and anti-aging. As described above, the issue of whether a substance taken in pill form is a supplement or a highly-regulated drug depends, in large part, on whether it is advertised as treating or curing any known disease. The FDA considers both erectile dysfunction and low testosterone production to be diseases that can only be treated by drugs. Over the past several years, the FDA has paid increased attention to products advertised as “male enhancement” or “male performance” supplements, especially those that claim to provide a natural, over-the-counter alternative to popular prescription drugs for erectile dysfunction, such as Viagra. When tested by the FDA, these supplements proved to contain undisclosed chemical compounds such as sildenafil, the active ingredient in Viagra. In other words, the FDA determined these were not “natural” supplements at all, but were spiked with undeclared pharmaceuticals and subject to FDA regulation as drugs. The vast majority of these supplements had been imported from Asia and white-labeled by U.S. merchants who did not conduct independent testing to ascertain their contents.

Notably, however, FTC enforcement actions regarding male enhancement supplements do not usually focus on the products’ content, and enforcement actions concerning only male enhancement products are very rare. There is some credence to the belief that purchasers of male enhancement products are less likely to file formal FTC complaints about them, resulting in fewer enforcement actions. Indeed, many of the FTC enforcement actions that deal with male enhancement products also deal with other high-risk products and practices – for example, a defendant who sold both weight loss and male enhancement supplements on a subscription basis. Thus, it is possible for sellers of male enhancement products to substantially reduce their risk of FTC investigation by focusing entirely on this vertical and avoiding other high-risk areas.

The FTC regulates privacy and security issues under a number of laws, including the general FTC Act, which prohibits unfair and deceptive acts and practices. For example, companies have been targeted for making false and deceptive representations for failing to comply with their own online privacy policies.

The FTC has historically been active in protecting the privacy of children. The FTC enforces the Children’s Online Privacy Protection Act (COPPA), which imposes requirements on operators of websites, apps, or online services directed to children under 13 years of age or where there is knowledge of collection of personal information from a child under 13. COPPA requires websites and apps to post privacy policies with specific provisions about private data concerning children, notify parents directly about the information collection practices of the website or app, and get verifiable parental consent before collecting personal information from their children, or sharing this personal information with others.

The FTC also enforces key international privacy frameworks, such as the EU-U.S. Privacy Shield Framework (which provides a mechanism for companies to transfer personal consumer data from the EU to the US) and the Asia-Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CPBR) System. In addition, the FTC, among other federal agencies, enforces portions of the Gramm-Leach-Bliley Act, which pertains to financial privacy issues, and applies to “financial institutions” such as banks and lenders; under this law, the Financial Privacy Rule, and the Safeguards Rule, financial institutions are subject to requirements for collecting and disclosing customers’ personal financial information and maintaining safeguards to protect that information.

Above, we’ve identified advertising practices, methods, and product verticals that invite heightened FTC scrutiny; however, even if you are engaged in one of these high-risk areas, you can still avoid FTC investigation by mitigating your risk. Mitigation includes substantiating your product benefit claims, using true and accurate testimonials with adequate disclosures, and other practices as described herein. But another important way to mitigate your risk it to avoid compounding it by coupling high-risk practices. For example, if you are selling a high-risk weight loss supplement, you increase your risk of consumer complaints and FTC investigation by using a subscription billing model or affiliate advertising where you have little oversight on the weight loss claims made by the affiliate. Indeed, most FTC lawsuits are based on a combination of high-risk advertising practices, methods and products, as opposed to just one.

If you have an FTC legal matter, call us at 415-955-1155, ext. 120, or contact one of our FTC defense attorneys directly.