Indeed, the FTC issued its ANPR in December 2021, seeking comment for 60 days. Then, in October of 2022, it released its NPR proposing rule text and seeking comment for another 60 days (until December 16). At this point, it seems possible that the FTC could complete the process shortly after the comment period closes, just a little over a year after it started. That’s because one of the key steps under Mag-Moss – an informal public hearing – is only necessary if the FTC determines that it is, or if an interested party requests one. (See FTC Rules of Practice 1.11.) The FTC has said that no hearing is necessary and, so far, we’re unaware of any hearing requests from stakeholders.

Why is this rule moving so fast? Mainly because, for the most part, it’s a narrow, targeted rulemaking to ban practices that everyone agrees are fraudulent, and that have been the subject of many dozens of FTC cases. It’s also based solely on deception, which is far more straightforward than unfairness. For these reasons, even when the FTC was split 2-2 with the Commission sharply divided, both Republicans voted for this rule, paving the way for quick action and signaling to the public that there’s nothing controversial here.

Means and Instrumentalities

One key aspect of this rulemaking isn’t so simple, however, and requires more attention than it’s getting. Specifically, the proposed rule (which, in four short provisions, bans falsely posing as, or misrepresenting affiliation with, a government entity or business) tacks on a prohibition against providing the “means and instrumentalities” to engage in the banned practices. The NPR explains that means and instrumentalities (aka “M&I”) is a form of direct liability under Section 5 that’s distinct from secondary liability theories not allowed under Section 5. As the NPR states:

[T]he case law describes a form of direct liability for a party who, despite not having direct contact with the injured consumers, ‘passes on a false or misleading representation with knowledge or reason to expect that consumers may possibly be deceived as a result.’ In other words: ‘One who places in the hands of another a means of consummating a fraud or competing unfairly in violation of the Federal Trade Commission Act is himself guilty of a violation of the Act.’ (citations omitted)

In fact, while the FTC doesn’t use the M&I theory every day, it has done so over the years (in both litigated cases and settlements) to challenge the “passing along” of deceptive promotional materials, badges, logos, or other items. Still, the precise contours of this legal theory remain somewhat murky. That murkiness raises special concerns where, as here, rule violations could lead to hefty civil penalties.

Strict Liability?

The confusion here starts with the NPR, which sends mixed messages as to whether knowledge is an element of an M&I violation. The passage from the NPR cited above (referencing “knowledge or reason to expect” consumers may be deceived) suggests that knowledge is required. However, the proposed rule itself doesn’t mention knowledge. Does this mean, then, that a supplier or middleman could be strictly liable if he or she unwittingly passes along misleading claims to purchasers who then uses them to deceive consumers? Yes, it’s possible. Here are some points to consider:

First, knowledge isn’t an element of deception generally, and FTC precedent suggests that it isn’t an element of means and instrumentalities either, at least not technically. For example, the FTC’s recent complaints against ECM Biofilms, Office Depot, and Nerium all include M&I counts that don’t mention knowledge. The same is true in Shell Oil and C. Howard Hunt, two earlier cases that the FTC cites in its NPR.

On the other hand, the facts cited in M&I cases often (though not always) include evidence of knowledge, even if knowledge is absent from the complaint count. In Office Depot, for example, the complaint describes how Support.com (the entity charged with M&I) deliberately furnished Office Depot with a deceptive software program in order to mislead consumers into thinking they needed to buy computer repair services. See also Waltham Watch (court stressed that watch manufacturer knowingly furnished deceptive claims to distributors); Shell Oil (statement accompanying order said Shell knowingly passed along deceptive claims); and Nerium (complaint says Nerium encouraged its partners to make deceptive health claims).

In addition, a 2021 blogpost from former BCP Director Andrew Smith describes means and instrumentalities as “providing a false representation (or a forged or counterfeit item) to another with knowledge that it was possible that the means could be placed in the stream of commerce and passed on to consumers....”

Finally, there’s been debate over the years about the contours of means and instrumentalities, with some Commissioners saying that others are using it as a substitute for “aiding and abetting,” a form of secondary liability not within Section 5 (and that, incidentally, requires proof of knowledge). For example, in his dissent in Shell Oil, then-Commissioner Swindle said that because the claims Shell passed along to marketers were different from the claims ultimately made to consumers, Shell didn’t make its own deceptive claims through intermediaries as required for M&I liability, but at most engaged in aiding and abetting. (See also the partial dissent of then-Commissioner Ohlhausen in the FTC’s case against TRUSTe.)

While some of this gets fairly legalistic, their overarching points are that (1) it’s a big deal to hold someone liable for deceptive claims made by another, and there should be clear legal criteria for doing so; and (2) M&I means that a person or entity has disseminated their own claims through an intermediary.

Bottom Line

The FTC’s bare bones rulemaking proposal doesn’t clear up any of these issues and questions. Further, while my research was hardly exhaustive, it suggests that the case law won’t provide quick and easy answers either. With the rulemaking barreling towards completion with an M&I provision on board, stakeholders who may be concerned about these issues should consider (1) submitting comments to the FTC asking for clarification in the final rule and/or (2) requesting an informal hearing to address these questions. (See here for more information.)

We will also be watching carefully to see whether the FTC includes similar means and instrumentalities provisions in the many other rules it is developing.

We’ve been hearing a lot lately about the FTC’s rulemaking procedures under Section 18 of the FTC Act (also known as “Mag-Moss” rulemaking). Long decried as too burdensome and difficult to use on a regular basis, this tool is now being celebrated for its enormous, untapped potential to establish industry-wide standards and enable the FTC to get monetary relief in its cases, post-AMG. (AMG didn’t affect the FTC authority to obtain monetary relief when it’s enforcing a rule.)

Is the old view or the new one correct? Is Mag-Moss rulemaking really so cumbersome, as many FTC staff and observers have long claimed? Have those burdens been overstated, warranting the enthusiasm we’re now seeing among FTC Commissioners, consumer groups, and Congress? Did the FTC’s changes to its internal rules last July (see below) really “streamline” the process as the FTC claimed?

As suggested by the title to this blogpost, I have an opinion: Mag-Moss is still an uphill climb. However, to enable readers to decide for themselves, I detail below the Mag-Moss process as laid out in the law. Although the FTC’s July changes stripped away some extra steps it had previously imposed under its rules, the hurdles in the law remain formidable.

Background – The Changing Narrative Around Mag-Moss Rulemaking

For decades, the FTC has developed its consumer protection rules in one of two ways: (1) as directed by Congress in federal legislation or (2) under Section 18 of the FTC Act. While rulemakings in the first category generally follow the Administrative Procedures Act, Section 18 requires many more steps.

Most of these steps were added to the law in 1980, in response to perceived overreach by the agency during the Pertschuk era. According to Jeffrey Lubbers, a professor who has analyzed FTC rules developed under Mag-Moss (e.g., the Credit Practices and Used Car rules), the average time it took to complete them was almost six years, with some rules taking even longer. By contrast, the average time to complete rules under the APA (e.g., the COPPA and GLB rules) was less than a year. Due to this dramatic difference, Mag-Moss rulemaking has long been viewed to be extremely cumbersome – not a process to be launched lightly or with the expectation of rapid completion.

During the past year, however, the narrative around Mag-Moss has changed dramatically as the FTC has sought new ways to obtain monetary relief and strengthen its hand in privacy. In March 2021, the FTC formed a task force designed to identify possible candidate for Mag-Moss rulemaking, acknowledging its “bad reputation” but touting its capacity to deter harms through market-wide rules and civil penalties. Then in July, the FTC (by 3-2 vote) announced changes to its internal rules, stating that the changes would “streamline” the Mag-Moss rulemaking process, remove “decades of self-imposed red tape,” and allow the FTC to issue “timely rules” on a wide range of issues, particularly in the area of privacy.

One week later, the President’s Executive Order on Competition encouraged the FTC to issue a rule to address “unfair data collection and surveillance practices” – a call soon echoed in letters from Congress and consumer advocates. Then, on December 9, following a series of policy statements extolling the virtues of rulemaking vs. “whack-a-mole” enforcement, Chair Khan released an ambitious plan to launch multiple Mag-Moss rulemakings to “define with specificity” unfair or deceptive practices – including a range of “abuses stemming from surveillance-based business models.” (Khan also called for multiple rules to define “unfair methods of competition” – an equally bold and controversial move that implicates another part of the FTC Act.)

Presto! In just eight short months of (seemingly lockstep) messaging, the counter-narrative was complete: Mag-Moss rulemaking (lots of it) will enable the FTC to stop industry-wide harms, obtain penalties in a wide range of areas, and regain its leadership on privacy.

The Many Steps in the Mag-Moss Rulemaking Process

Now comes the hard part – actually developing these rules in the “timely” way that’s been promised. Of significance, Mag-Moss requires the FTC to prove that any practice it seeks to regulate is unfair or deceptive under the FTC Act – i.e., it doesn’t expand the FTC’s ability to reach conduct it can’t already reach in its enforcement actions. Here are the statutory requirements in greater detail:

1. FTC publishes Advanced Notice of Proposed Rulemaking (ANPR) for public comment. ANPR must detail FTC’s area of focus and objectives, as well as possible regulatory alternatives. The FTC must send copies of the ANPR to its Congressional oversight committees.
2. FTC publishes Notice of Proposed Rulemaking (NPR) seeking public comment. NPR must set forth the rule text, reasons supporting it, any alternatives, and a preliminary regulatory analysis assessing the costs and benefits of the proposal and alternatives. At the time of publication, FTC must have reason to believe (in the form of FTC cease and desist orders or other evidence of widespread conduct) that the practices are prevalent. FTC must make all comments public. Thirty days prior to publication, the FTC must send copies of the NPR to its Congressional oversight committees.
3. Informal hearings. Any interested person may seek a hearing and present views. If FTC determines there are disputed issues, it must allow participants to submit rebuttal information and cross-examine other persons. (FTC may impose limits on this process but such limits are a basis for court review and reversal – see below.) A presiding officer shall make recommendations as to all relevant and material evidence.
4. FTC publishes Final Rule. Rule must be accompanied by a Statement of Basis and Purpose detailing (1) the prevalence of the practices (2) how they are unfair or deceptive, and (3) the economic effect of the rule. Final regulatory analysis must assess the rule’s costs and benefits and why it was chosen over alternatives. Any person may petition FTC for exemption from the rule.
5. Judicial review. Any person may seek review (in the D.C. Court of Appeals) within 60 days of promulgation. In addition to normal grounds for review under the APA, the court may (1) direct FTC to consider additional submissions (2) set aside the rule if it’s not supported by “substantial evidence” (a potentially different standard than “arbitrary and capricious”) (3) set aside the rule if FTC’s limits on rebuttal or cross examination precluded disclosure of material facts. Court decisions are final, subject only to Supreme Court review.
6. Rule enforcement. When enforcing rules, FTC may seek penalties (now up to $50,120 per violation) and/or consumer redress in federal district court. However, to get penalties, FTC must show the defendant violated the rule with “actual knowledge or knowledge fairly implied,” and must refer the case to DOJ for review and filing.

As noted above, the FTC’s July rule changes stripped away some steps that had been added to the statutory requirements – including the need for a written staff report and provisions allowing the presiding officer to compel in-person attendance and production of documents and written answers to questions. However, even without these added steps, Mag-Moss remains a long and rocky road, especially for (1) complex rules with dozens of mandates, each of which must to shown to be unfair or deceptive, as well as prevalent and (2) controversial matters, which are likely to prompt multiple requests for hearings, cross examinations, rebuttals, exemptions, and court review. The FTC’s foray into “surveillance” and other broad privacy topics could crash into all of these obstacles.

On the other hand, for issues that are more straightforward, Mag-Moss may prove to be a valuable tool. On December 16, just a week after Khan announced her plan to develop multiple Mag-Moss rules, she called for a vote on the first of these efforts – a narrowly-tailored rulemaking to prohibit government and business impersonation fraud. Although Commissioners Phillips and Wilson had dissented strenuously from Khan’s broader plan (with Wilson dubbing it a Rule-a-Palooza), they voted to launch this first rule to deter a pernicious and pervasive fraud that had already been found to be illegal in numerous FTC cases.

We will see in the coming months how the FTC’s rulemaking efforts play out. Will the FTC’s “surveillance” rule reach as broadly as Khan suggested, or will the agency proceed more narrowly as it did for impersonation fraud? Will the FTC issue multiple rulemaking proposals at once, or will it proceed more methodically? Whether the rules are broad or narrow, many or few, the Mag-Moss process ensures that companies will have many opportunities to provide input.

Stay tuned for updates.

Get these and other stories in real time when you subscribe to the Ad Law Access blog here or visit the Advertising and Privacy Law Resource Center here. For a digest of our blog posts, podcasts, events, and other privacy and advertising goings on, please subscribe to our Ad Law and News and Views newsletter here.