• Prominently-displayed bold-type boxed warnings on the principle display panel of foods and beverages with specific warnings depending on the product’s nutritional profile. For example, for sugar-sweetened beverages, the warning must state as follows:

• Investigation by the National Institutes of Health (NIH) into the dangers associated with “ultra-processed foods”.
• Development of a national campaign for education and awareness through the Centers for Disease Control and Prevention (CDC).

As written, the Act includes significant advertising prohibitions as well, such as the following:

• Prohibit advertising of “junk food”, defined as products subject to warning label requirements per the Act, in a manner directed toward children.
• Prohibit advertising of “junk food” to the general population without including the relevant mandatory health or nutrient label warnings, as described above.

Violation of this prohibition will be treated as a rule violation under the Federal Trade Commission Act, meaning that the FTC could pursue civil penalties for first time offenders.

There will undoubtedly be much discussion among consumer brands as to how best to respond to the Act. As our readers may know, several of the nation’s largest food and beverage companies committed years ago to an industry self-regulation initiative called the Children’s Food and Beverage Advertising Initiative, which restricted advertising directed at children 12 years and under for foods meeting certain nutritional criteria. Further, many of these same companies already use “Facts Up Front” - a front-of-pack labeling disclosure to provide specific nutritional information, as shown below.

Will taking the next step and expressly telling the consumer that a particular product may contribute to obesity, diabetes, and tooth decay make a difference? We may find out.

The bill, as written, has no shortage of broad and undefined terms. To determine whether advertising directed at children is false or misleading, the bill, among other changes, amends New York’s general false advertising statute, New York General Business Law § 350 (“NY GBL § 350”), to require courts to consider the following factors:

• Whether the advertising “targets a consumer who is reasonably unable to protect their interests because of their age, physical infirmity, ignorance, illiteracy, inability to understand the language of an agreement, or similar factor.” Here, “‘consumer’ is defined as a person who is targeted by an advertisement, or those acting on such a person’s behalf.”
• Whether the advertising constitutes “an unfair act, practice or conduct.”
• “An act, practice, or conduct” is considered “unfair” to a consumer where it: “(a) causes or is likely to cause substantial injury to such consumer; (b) cannot be reasonably avoided by such consumer; and (c) is not outweighed by countervailing benefits to such consumer or to competition.”
• Courts must give special consideration to advertisements “concerning a food or food product” directed at children. In determining “whether any advertising concerning a food or food product is false or misleading,” courts must also consider factors including—but not limited to—the following: “(a) subject matter; (b) visual content; (c) use of animated characters or child-oriented activities and incentives; (d) music or other audio content; (e) age of models; (f) presence of child celebrities or celebrities who appeal to children; (g) language; (h) competent and reliable empirical evidence regarding audience composition and evidence regarding the intended audience; (i) physical location of advertisement, including, but not limited to, proximity to schools or other institutions frequented by children; (j) medium by which the advertisement is communicated, including, but not limited to, social media; or (k) other similar factors.”

The bill fails to define several key terms, including “unhealthy foods,” and “ignorance,” to name just a few. Further, the bill directs that courts consider not only whether advertising is directed to children, but also whether advertisements target persons unable to protect their interests due to “illiteracy” or “ignorance.” The bill would also provide a private right of action for consumers “targeted by an advertisement, or those acting on such a person's behalf.”

Although subject to constitutional challenges similar to those filed relative to NY’s soon-to-be-effective dietary supplement age restrictions, if passed, this amended version of NY GBL §350 would further open the litigation floodgates against food and beverage companies. Impacted stakeholders should consider advocacy strategies individually or via trade associations to ensure that their viewpoints are considered at the legislative level.

What’s the issue?

Although it exempts protein powders, protein drinks and other protein foods unless they contain ingredients promoted for weight loss or muscle building specifically, the language is otherwise very broad, making compliance a challenge. Here are just some of the friction points:

• Age-Gating, Including At Delivery: Retailers must verify the age of individuals purchasing covered products. Valid verification documents include an individuals’ driver’s license, state ID or passport. For sales that are delivered, retailers are tasked with implementing age verification processes at the point of delivery. Most common carriers have processes to age-gate at age 21; however, age-gating at 18 is not broadly offered or will cost extra. Neither the law nor guidance offer direction for sales completed via direct selling companies or through delivery services such as Doordash or similar.
• “Covered Products” Effectively Includes Every Possible Means of Labeling, Categorizing, or Promoting the Products – Including Those Outside the Manufacturer’s Control: The law explicitly states that covered products containing certain ingredients, such as steroids, green tea extract, garcinia cambogia, or creatine, cannot be sold to minors. Moreover, products whose labeling includes statements or imagery that imply health benefits related to weight loss or muscle enhancements are also subject to this new law - targeting not just ingredients, but how products are presented to consumers. As such, even if the manufacturer does not include an express weight loss claim on the label, if a retail platform categorizes it under “weight loss” on its website, this could cause the product to be covered.
• Enforcement and Penalties: The law allows the New York Attorney General to bring an action to stop a violation and impose civil penalties of up to $500 per violation. While the law does not expressly provide for a private right of action, impacted stakeholders should anticipate that interested parties may conduct “secret shopping” campaigns and provide any relevant findings to the AG’s office.

Legal Challenges

In December 2023, the Natural Products Association filed suit seeking to stop implementation of the law on constitutional grounds. More recently, another dietary supplement trade association, the Council for Responsible Nutrition (CRN),also filed suit. Highlights of CRN’s complaint include the following:

• Constitutional Challenge: CRN contends that the law infringes on constitutional principles by imposing restrictions that infringe on lawful commercial speech. CRN claims that the law unduly restricts lawful commercial speech by targeting “all representations concerning covered products, regardless of their accuracy.”

• Lack of Scientific Basis: The complaint challenges the legislative intent behind the law which aims to prevent eating disorders among minors. CRN argues that while it is a “noble and worthwhile goal,” there is “absolutely no evidence” demonstrating a causal link between covered products and eating disorders, citing the state’s lack of substantiation for its claims. For example, CRN cites studies that support the safety of prebiotic fiber supplements (which would be subject to the law) for combating childhood obesity.
• Economic and Practical Burdens: CRN further argues that the law’s overly broad definitions and the lack of specificity could post significant economic challenges for the industry. CRN notes that “[w]ithout any guidance from the State, but substantial financial penalties for violations, the act compels retailers and marketers to err on the side of restricting sales of products with lawful claims.”

Looking forward:

While New York leads the charge as the first state to enact this type of legislation, there are indicators that other states may be considering similar paths. At present, California, Massachusetts, New Jersey and Rhode Island all have bills pending at various stages. These bills all have varying and inconsistent language, which could further increase the complexities of selling these products nationwide.

On Friday, FTC staff put another stake in the ground when it sent a letter to the Direct Selling Association (“DSA”), doubling down on its reframing of the longstanding Koscot test for determining whether a business is an illegal pyramid scheme – a reframing that Judge Barbara Lynn soundly rejected in the Neora matter, as we previously discussed here. Also on Friday, the FTC sent a separate letter to the Direct Selling Self-Regulatory Council (“DSSRC”), taking issue with the independent body’s issued guidance on income disclosure statements.

We discuss these two letters in more detail below, but note the following key takeaways:

• Advisory opinions and letters such as the ones discussed below reflect the views of the current staff and are not official Commission positions. The Commission is not bound by these opinions, and future staff may rescind or modify them at any time (as illustrated below by staff’s disavowal of its 2004 Advisory Opinion, upon which many in the direct selling industry have relied over the years).
• Regardless of Commission staff’s opinions, Section 5 and associated case law ultimately control. Commission staff undoubtedly intends to raise the bar for compliance while attempting to improve its litigation position in future matters (and possibly avoiding a repeat of the Neora loss), but courts must ultimately look to the law and relevant precedent in determining whether a practice is unfair or deceptive under the FTC Act.

Repudiation of “Primary Source” Test

In 2004, when DSA sought guidance regarding FTC staff’s analysis of a pyramid scheme, staff clarified in a letter that “[t]he critical question for the FTC is whether the revenues that primarily support the commissions paid to all participants are generated from purchases of goods and services that are not simply incidental to the purchase of the right to participate in a money-making venture.” In other words, if compensation was “primarily” based on recruitment rather than product sales, the operation would be considered a pyramid scheme. This Advisory Opinion is well-known within the direct selling industry and has been cited in multiple complaints and decisions over the last 20 years, including in the recent Neora decision.

In last week’s letter to DSA, Division of Marketing Practices Associate Director Lois Greisman restated a position expressed during the Neora trial and at recent industry events that the “primary source” test for differentiating a legitimate business from an illegal pyramid scheme does not exist, and that industry has misinterpreted the 2004 Staff Advisory Opinion. The letter cites language in certain decisions such as Koscot, Noland, and Vemma to suggest that the dispositive inquiry for a pyramid analysis is whether a compensation plan incentivizes recruiting and/or relies on recruiting to unlock significant rewards – a position the agency advanced (and lost) in the Neora case.

While acknowledging that many FTC complaints and court decisions use the “primarily” or “primary source” language, the staff letter discounted that language as related to “litigation decisions” and/or “not key holdings in the decisions” and stated that the 2004 letter is no longer valid and therefore rescinded.

The disavowal of the 2004 Advisory Opinion demonstrates a shift in staff’s thinking on pyramid scheme standards, but – importantly – does not change applicable law. The FTC’s position did not hold in Neora, and future litigation will determine whether other courts accept the FTC’s reframing.

DSSRC IDS Guidance

The DSSRC, a national advertising self-regulatory program administered by BBB National Programs, is tasked with monitoring and addressing earnings and product claims made by the direct selling industry, and issuing guidance on lawful advertising and marketing practices. For example, DSSRC’s “Guidance on Earnings Claims for the Direct Selling Industry,” which was first issued in July 2020 and subsequently revised in 2022, lays out guiding principles for making truthful and non-misleading claims, including that companies refrain from making lavish lifestyle claims and focus on the overall “net impression” communicated by any product or earnings claims.

In fall 2023, DSSRC issued a new document, “Guidance on Income Disclosure Statements for the Direct Selling Industry,” to provide guiding principles to help direct selling companies develop income disclosure statements, which are commonly used in the industry to provide prospective participants with earnings and other key information that consumers may wish to consider.

In last week’s letter to DSSRC, FTC staff raised several concerns with this new IDS Guidance. For example, Ms. Greisman took issue with the Guidance’s discussion of business costs, arguing that all costs – mandatory and optional – must be tracked and accounted for when determining whether earnings claims have a “reasonable basis.” But this position does not account for the manner in which direct selling companies allow sellers to determine how to build their businesses and which costs to incur. DSSRC’s Guidance takes the balanced approach that companies should disclose mandatory costs, but that non-incidental expenses should be evaluated on a case-by-case basis, thus acknowledging that different sellers may engage in a variety of different marketing techniques.

FTC staff also argued that even supplemental income claims may be misleading if most people are not making any money net of expenses. But this position ignores the low entry costs associated with a direct sales opportunity, and does not acknowledge that industry calculations of expected earnings, whether measured as averages or medians, do not account for the significant variability in the amount of time and effort invested in building sales businesses.

The letter also takes the position that any representations regarding substantial earnings must be qualified “at a minimum [by] a clear, prominent, and unavoidable presentation of the typical participant’s revenue minus expenses—all of which must be substantiated.” But FTC staff provides no support or precedent for why an appropriately qualified earnings claims could not be made based on gross earnings where the claim makes that fact clear and reiterates that expenses vary by seller.

***

With these two letters, FTC staff has unmistakably turned up the heat on the direct selling industry and reiterated that it will not cede ground based on its loss in the Neora trial. Yet the agency can’t make law by proclamation – that will be for a judge or jury to decide.

Guest Speakers:

• New York Attorney General Letitia James

• Jane Azia, Consumer Frauds and Protection Bureau Chief

• Jarret Hova, Executive Division Senior Advisor

Please join us for a webinar featuring special guest speakers New York Attorney General Letitia James, and her staff members Jane Azia, Chief of the Consumer Frauds and Protection Bureau, and Jarret Hova, Senior Advisor in the Executive Division, as they join Kelley Drye State Attorneys General practice Co-Chair Paul Singer, Special Counsel Abby Stempson, and Senior Associate Beth Chun. The guest speakers will focus on consumer protection and potential legislative reforms surrounding New York consumer protection laws.

Register here.

The event is not open to members of the press.

Reyneri discussed basic concepts of advertising law, highlighting the recent endorsement guides amendments which were discussed in more detail in a later panel. He also pointed to recent FTC developments such as its use of notice of penalty offense authority in an effort to obtain monetary relief post-AMG. Reyneri reminded the audience that the .com Disclosures are in the process of being updated, and also highlighted the rulemaking for Junk Fees.

VanGelderen started her presentation by noting that marketers are increasingly spending money on behavioral research, which she explains shows that people use decision-making shortcuts when overloaded with information, have time pressures, or are making trivial decisions relying on heuristics to simplify decisions. She said that people choose the first product that minimally meets needs. VanGelderen then went on to describe some of their office’s positions on recent advertising cases.

Senate Bill 478 (Junk Fees)

Likely the hottest topic discussed during the panel, VanGelderen provided some insight into how the California AG’s office views the new junk fee law, which we covered here. She reminded the audience that the legislative intent was to prohibit drip pricing and that bait and switch and unbundling of prices was already deceptive under the AG’s previous authority. The purpose of the new law was to prevent ambiguity.

VanGelderen provided several examples of fees that California would find deceptive:

• A 4% sustainability fee on all transactions would be deceptive if disclosed separately from the rest of the price.
• Advertising a $0 delivery fee when there is actually a $3 service charge that helps operations would also be deceptive where the service itself was delivery.
• A 5% surcharge to help pay for increased costs due to a government mandate (she framed as a “protest fee”) would also be deceptive if not included with the total price.

In a question by AG staff from Illinois, it was mentioned that a similar junk fee law may be considered in that state as well, so clearly deceptive fees continue to be on the minds of more than just California.

Labeling

VanGelderen discussed multiple recent labeling cases and the office’s view of the rulings:

• The California AG’s office wrote an amicus brief in a 2018 case on appeal related to the vitamin brand “One a Day,” but which included a recommended dosage of two gummies for certain products. VanGelderen agreed with the court’s ruling that this was an issue because reasonable consumers were unlikely to review all the details on the bottle before purchasing.

• VanGelderen highlighted another case, in which white baking chips were shown on a bag; even though the bag didn’t say the chips were made of white chocolate, VanGelderen’s and the appellate court’s view were that this was misleading in part because consumers don’t look at ingredient labels.

• Finally, she described a case where Manuka honey was labeled as 100% despite only being 60-70% Manuka honey. The court found the label permissible in part because FDA guidelines allowed it and that consumers would understand it is impossible to make a honey 100% derived from one source. But VanGelderen said she disagreed with this outcome -- though she admitted it is currently the law, she alluded that it may have come out differently in state court.

Nontraditional Marketing

VanGelderen described some of the more recent actions by the California AG’s office that shed light on the office’s views of advertising claims. For instance, in People v. Johnson & Johnson, et al., she described the company’s surgical mesh “surround sound marketing campaign” to create demand from patients. California considered these education awareness events and brochures to be marketing materials because the intent was to sell mesh, and alleged the company downplayed or concealed serious health risks obtaining a $362 million verdict.

In People v. Ashford et al., California said that using telemarketers branded as admission counselors was deceptive where the sales environment incentivized representatives to mislead consumers (potential students) about the costs of attendance, ability to obtain certain jobs, and transferability of credits.

Bottom line: To stay in line with California (and many other states) positions on advertising, remember:

• Consumers may not look at the entire label – so consider accordingly.
• Advertising can take many forms, including consumer education.
• Don’t mislead customers about existence of fees, or what a fee is for.

Starting January 1, 2024, in an action brought by the California AG pursuant to Consumer Laws, the court can award disgorgement in addition to other remedies already provided for in those statutes, which include the often confused remedy of consumer restitution. The difference between the two remedies is one of focus; restitution focuses on how much the victims were harmed by the conduct, while disgorgement focuses on what the wrongdoer gained as a result of the illegal conduct. Of importance, disgorgement does not require a showing of the specific harmed consumers that need to be compensated, making it an attractive, flexible remedy for enforcers.

When determining whether to award disgorgement, the court shall take into account the amount of civil penalties and consumer restitution awarded, “in addition to other appropriate factors.” Currently, the California AG has authority to seek civil penalties of $2500/violation. The funds recovered as disgorgement shall be deposited into the new Fund, established in the State Treasury. Monies in the Fund may, upon appropriation by the legislature, be used by the AG to provide restitution to victims of acts or practices for which consumer restitution has been ordered but not paid in an action brought by the AG pursuant to the Consumer Laws. Should the AG recover funds from a defendant after payment from the Fund has been made, the AG can reimburse the Fund.

California Attorney General Bonta sponsored this bill, declaring that it is a game changer and will allow consumers to get restitution when a business has been successfully prosecuted, but becomes insolvent. Companies should take note that the flexibility to obtain disgorgement will likely give California greater authority to obtain additional monetary recoveries in the state’s actions. Disgorgement however is specific to AG actions which necessarily excludes California District Attorney and private actions. Because a “violation” for penalty purposes and “appropriate factors” under the new statute are undefined, it will be worth watching how California wields this new source for payment when it comes to negotiating resolutions. We also note that several other state AGs already claim disgorgement authority (which the FTC currently lacks). See, e.g., New York and Texas.

As California is a very active state when it comes to consumer protection, one can assume that this new tool will be used to a great extent, and that California will want to quickly ensure that the Fund maintains a robust amount of money to be used in future enforcement matters.

By February 2024, Gmail will start to require that bulk senders:

• Authenticate their email: Bulk senders will have “to strongly authenticate their emails following well-established best practices” outlined by Google.
• Enable easy un-subscription: Bulk senders will have to give Gmail recipients the ability to unsubscribe from commercial email in one click, and they will be required process unsubscribe requests within two days.
• Ensure they’re sending wanted email: Google will enforce a clear spam rate threshold that senders must stay under to ensure Gmail recipients aren’t bombarded with unwanted messages.

Google advises companies “to follow the guidelines in this article as soon as possible. Meeting the sender requirements before the deadline may improve your email delivery. If you don’t meet the requirements described in this article, your email might not be delivered as expected, or might be marked as spam.”

Notably, these are not legal requirements, but given that Gmail remains the most popular email platform with over 1.8 billion users worldwide, these requirements will likely impact most advertisers.

Examination Manual and Chamber of Commerce Challenge

In a March 2022 announcement, the Bureau announced “changes to its supervisory operations to better protect families and communities from illegal discrimination, including in situations where fair lending laws may not apply.” As explained in that press release, the Bureau updated its UDAAP examination manual, which instructs CFPB examiners how to evaluate whether covered entities are engaged in unfair, deceptive, or abusive acts and practices (UDAAP), to “require supervised companies to show their processes for assessing risks and discriminatory outcomes, including documentation of customer demographics and the impact of products and fees on different demographic groups.” The updates instruct examiners to evaluate potential discrimination in all consumer finance markets, including credit, servicing, collections, consumer reporting, payments, remittances, and deposits, and irrespective of whether specific discrimination statutes such as the Equal Credit Opportunity Act (ECOA) apply.

The Chamber of Commerce brought suit to challenge the examination manual on a number of constitutional and statutory grounds, including that the Bureau exceeded its authority by unilaterally attempting to sweep in discriminatory conduct as “unfair” without Congressional authorization.

District Court Decision and Key Takeaways

In the decision on Friday, Judge Barker first acknowledged that the Fifth Circuit already found the CFPB’s funding mechanism to be unconstitutional, but that that decision was pending Supreme Court review. The court nonetheless reached the issue of statutory authority because of a “compelling reason to reach at least one alternative ground for the same relief sought on Appropriations Clause grounds.” The court also found that the examination manual itself was final agency action warranting review under the Administrative Procedure Act because “it obligates agency personnel to act on a particular understanding of unfair act or practice in examining and supervising companies,” namely that they must also consider whether financial institutions have adequately considered potential discriminatory effects in advertising, pricing, and offering financial products and services.

On the crux of the court’s decision on statutory authority, the court applied the “major-questions canon” to hold that the Bureau could not sweep in discrimination under its unfairness authority because:

• “whether the CFPB has authority to police the financial-services industry for discrimination against any group that the agency deems protected, or for lack of introspection about statistical disparities concerning any such group, is a question of major economic and political significance”; and
• state and federal statutes, including the Consumer Financial Protection Act itself, at times authorize regulation of discrimination in clear and precise terms, so the lack of reference to discrimination in connection with the CFPB’s UDAAP authority suggests that it should not be impliedly included.

In so doing, the court also rejected the Bureau’s arguments that relied, in part, on the FTC’s historical and recent use of unfairness to police discriminatory practices. The CFPB had argued, among other things, that the plain language of unfairness clearly covered discrimination (“There has never been an unstated, atextual exception to the prohibition on unfairness for discrimination, just as there is not an unstated exception to unfairness for conduct that happens on Leap Day.”). While the court agreed that the unfairness language in Section 5 of the FTC Act (on which the relevant portion of the Dodd-Frank Act was based) could plausibly be construed to cover discrimination, including disparate impact, the language is not “exceedingly clear” and its history “does not refute its ambiguity.” Without that clear language, the court could not find that Congress intended for unfairness to encompass discrimination.

This decision suggests that the CFPB and FTC may face an uphill battle if they bring similar actions grounded on findings of discriminatory impact on unfairness grounds, as well as in other enforcement actions attempting to broadly construe longstanding statutory authority in new ways. As we discussed here, the FTC last year alleged that Passport Automotive violated the FTC Act by, among other things, engaging in unfair conduct that had a disparate impact on Black and Latino customers. The FTC’s settlement against Passport Automotive required the company to establish a fair lending program with written guidelines specifying the reasons for assessing or not assessing any fee or other charge and objective factors that may be considered in so doing. Nonetheless, the Bureau is likely to appeal the court’s decision and the FTC is similarly unlikely to accept the underlying rationale of the ruling on its face anytime soon. So while the decision marks a substantial setback in the CFPB’s attempts to take expansive views of its statutory authority, the battle of whether the Bureau – and the FTC – can use unfairness principles to combat practices with discriminatory effects will likely continue.

• Collect and verify certain information from “high-volume third party sellers”;
• Suspend sellers that fail to comply;
• Protect the information they collect against breaches and misuse;
• Disclose sellers’ contact information to purchasers; and
• Post a “reporting mechanism” on each seller’s website where consumers can report “suspicious activity.”

The law also charges the Federal Trade Commission (FTC), the state attorneys general (AGs), and “other state officials” with enforcement; gives the FTC rulemaking authority; and authorizes substantial civil penalties for violations (as much as $50,120 per violation).

With the effective date upon us, here are some resources to aid companies with compliance:

• Kelley Drye’s blogpost, summarizing the Act’s requirements and providing background on why the law was passed and how the FTC and AGs are likely to enforce it: “New Law Governing Online Platforms And Sellers Takes Effect In June – Are You Ready?”
• The FTC’s guidance for businesses: “Informing Consumers about the INFORM Consumers Act” (see also the FTC’s accompanying business blogpost)
• The FTC’s guidance for consumers: “The INFORM Consumers Act and online marketplaces: What to know”
• The FTC’s warning letters to 50 online marketplaces, underscoring that they must be in compliance “on day one”: “FTC Puts Online Marketplaces on Notice About Their Responsibilities Under the New INFORM Consumers Act”
• Today’s blogpost from the FTC, heralding the arrival of the effective date; stating that online marketplaces must be in “full compliance” and should communicate with third-party sellers about what the law requires; and urging consumers to report violations to the FTC.
• A recording of Kelley Drye’s recent webinar on the Act, featuring Kate and Abby: “INFORM Consumers Act – What Online Marketplaces and Sellers Need to Know.” As we emphasize in the discussion, the Act puts the onus on online marketplaces to ensure compliance, but will also have significant effects on sellers, who must furnish and post key information or risk suspension from selling online.
• The Act itself, for those that want to dive into the nitty gritty.

The bottom line is that, if you’re covered by the law — whether as an online marketplace or a “high-volume third party seller” — you should develop and implement a compliance plan now, train your employees on it, and monitor it for effectiveness. If you have questions, Kelley Drye can help.

Our webinar will feature Kate White (another veteran FTC-er who served as an Attorney-Advisor for former Commissioner Noah Phillips); and Abby Stempson (a former Assistant Attorney General and official at the National Association of Attorneys General). We’ll tell you what the Act requires; how the FTC and State AGs are likely to enforce it; and what you should be doing to get ready. We’ll also answer your questions.

And note that we’re not the only ones blogging about the Act. Last week, the FTC released a blogpost and guidance on INFORM, which we’ll also address in our webinar.

We hope to see you at the webinar!

“Restricted Data Processing” Under the CCPA

Since 2019, Google has offered a number of its services on a “restricted data processing” basis. Where a service is configured for restricted data processing, Google acts as a service provider with respect to personal information (i.e., names, email addresses, online identifiers) that Google collects from advertisers, publishers, and other partners.

Under the California Consumer Privacy Act (CCPA), which first took effect in 2020, a service provider is not permitted to use personal information other than for business purposes associated with offering services. For example, the CCPA does not permit a service provider to resell personal information processed on behalf of a business or to use the information to build profiles about individual consumers for its own commercial benefit.

In documentation available at https://business.safety.google/rdp/, Google explains that when restricted data processing applies, Google will use personal information for business purposes such as ad delivery, reporting and measurement, security and fraud detection, debugging, and to improve and develop product features. Google cites these policies to support its position that it is a “service provider” for many of its advertising-related services, such as Google Ads, Google Analytics, Tag Manager, and Display & Video 360.

What’s changing?

Starting July 1, 2023 – the day that the California Privacy Rights Act (CPRA) amendments to the CCPA become enforceable – Google will no longer offer restricted data processing for the following services in California:

• Any feature that entails uploading customer data for purposes of matching with Google or other data for personalized advertising (e.g., Customer Match)
• Any feature that entails targeting user lists obtained from a third party (e.g., Audience Partner API)
• Any feature that entails creating, adding to, or updating user lists using first-party customer data (e.g., audience building with floodlight tags and audience-expansion features in DV360)

These changes reflect key amendments to the CCPA. In particular, the CPRA amendments define “cross-context behavioral advertising” to mean “targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across” the internet, and prohibit service providers from offering services that involve “sharing” personal information for purposes of “cross-context behavioral advertising.”

The clear but unstated message behind these changes is that Customer Match involves cross-context behavioral advertising. When an advertiser uses the Customer Match service, the advertiser provides Google with a target audience, and Google displays ads to that audience on its search results. Because the service involves targeting ads to consumers on Google based on the consumer’s interactions with the advertiser, Google’s apparent position is that Customer Match is a cross-context behavioral advertising service.

As noted above, advertisers, publishers, and other businesses that share personal information with third parties (such as Google) for cross-context behavioral advertising must offer consumers an opportunity to opt-out of the “sale” and “sharing” of their personal information. In addition, as described in the latest CCPA regulations, these businesses are required to enter into a contract for the “sale” or “sharing” of personal information that requires the third party recipient to comply with the CCPA and provide the same level of privacy protection for consumer data as any business subject to CCPA.

Where can I find the restricted data processing contract?

Google publishes its restricted data processing contract for US state privacy laws at https://business.safety.google/usaprivacyaddendum/.

What about Google Analytics?

Google Analytics is a popular service that allows businesses to gain insights into who visits their digital properties. Google states that it will act as a service provider for Google Analytics as long as the business disables sharing with other Google products and services.

Google offers a variety of privacy-related tools for Google Analytics, including support for deletion requests, here.

What about real-time bidding?

Google also offers services like Display & Video 360 and Authorized Buyers that enable advertisers to respond to bids in real-time for ad inventory across the web. Google indicates that these services continue to operate using restricted data processing but also makes clear that restricted data processing “does not extend to the sending or disclosure of data to third parties that you may have enabled in our products and services.” As a result, publishers issuing bid requests and advertisers responding to publisher bid requests should understand that personal information conveyed to third parties for bidding purposes may not be covered by Google’s restricted data processing terms.

enforcement policy regarding major food allergen labeling and cross-contact prevention. The updated guidance reflects the addition of sesame as a major allergen, discusses how allergens must be disclosed when used as an ingredient in packaged food, and details the preventive controls provisions in 21 CFR § 117 applicable to preventing allergen cross contact. The updated guidance also details the circumstances in which failure to properly declare allergens or prevent cross-contact render a food misbranded or adulterated. Stakeholders have until July 17^th to submit comments.

Although not included in the guidance, FDA’s press release also makes clear the agency’s position regarding recent industry trends of adding sesame to products and declaring it as an allergen rather than taking steps to remove it from products and facilities. The press release states:

The FDA is aware that some manufacturers are intentionally adding sesame to products that previously did not contain sesame and are labeling the products to indicate its presence. While the draft CPG does not specifically address the issue of industry adding sesame to products that did not previously contain it, the draft CPG does address the FDA’s enforcement policy for labeling and cross-contact controls for major food allergens, including sesame. The FDA is engaged with various stakeholders on this issue. The FDA recognizes that this practice may make it more difficult for sesame-allergic consumers to find foods that are safe for them to consume-an outcome that the FDA does not support. (emphasis added)

So, what’s the takeaway? Although the draft guidance is intended as direction to FDA staff, it also provides helpful clues for industry. The updated guidance is far more detailed than the prior version, reflecting a heightened concern about food allergens and, likely, increased enforcement focus.

To prepare for their next FDA facility inspection, packaged food manufacturers should review labels to ensure that ingredient lists are up to date and allergens are declared as required. In addition, reviewing and updating cross-contact prevention controls, employee training, and recall policies will help the next facility inspection go as well as possible.

For food retailers such as supermarkets and restaurants, although local health authorities are the primary inspectors, the updated guidance also serves as a helpful guide for preparation, particularly in light of the allergen updates to the Model Food Code, which articulate best practices for retail food safety.

In January 2023, Beiersdorf moved to dismiss the amended complaint. The company concedes that the formulas are the same. However, the company asserts, among other things, that the product claims are true and therefore the complaint fails because there is no deception. That is, Ms. Akes cannot succeed on her claims because the claims that she points to as the basis for her understanding that the product was specifically designed for facial use, i.e., the use of “FACE”, “oil free” and “won’t run into eyes” are, in fact, true. Beiersdorf points out that Akes does not allege that she looked at the regular version of Coppertone Sport Mineral prior to purchasing the “FACE” version and, therefore, her argument amounts to little more than regret over paying more than she would have liked. The court’s ruling is pending.

Courts have been skeptical of arguments that brands necessarily deceive consumers by packaging the same product at varying price points, e.g., rejecting arguments that infant acetaminophen is deceptively marketed when sold at a higher price as compared to children’s acetaminophen because there was nothing about the packaging that suggested that the products had different formulations. Here, had Akes looked at the 5 oz version, she presumably would have seen that the active ingredient in both was zinc oxide and would have also seen that the ingredient listings and Drug Facts were identical. But, courts are also skeptical of requiring consumers to actually read ingredient lists.

So, what’s a marketer to do? Beiersdorf rightly points out that “[t]here is nothing deceptive about emphasizing different but equally true aspects of a product to different market segments or pricing products differently when sold to different market segments or in different retail channels. This happens every day.” When confronting this issue, companies should keep in mind that differences in branding, packaging, merchandising (store and shelf placement) and other factors can help establish a valid legal basis to support an argument that, even if two products have the same formula, one rightly commands a higher price point.

State AGs began a multistate investigation after the Federal Drug Administration (FDA) warned the company about marketing its online vision tests without appropriate approval. The State AGs claim that their investigation revealed that Visibly deceived consumers, including by: (1) marketing and selling a device without the required clearance or approval from the FDA; (2) marketing unsubstantiated safety and effectiveness claims about its online vision test; and (3) falsely claiming to offer a 100% satisfaction or money back guarantee. Note that while the State AGs’ investigation was pending, Visibly began the process of seeking FDA approval, but they did not have this prior to the investigation.

To resolve these allegations, Visibly agreed to pay $500,000 combined to the participating states. Visibly must among other requirements do the following:

• Comply with consumer protection statutes, the Federal Food, Drug, & Cosmetics Act (FDCA), and FDA authority;
• Align all representations that its products can diagnose, cure, mitigate, treat, or prevent any disease or condition with the FDCA and FDA authority;
• Possess competent and reliable scientific evidence substantiating any claims that its products are comparable to the safety and effectiveness of products offered by doctors’ offices or other FDA approved devices;
• Clearly and conspicuously disclose any terms or conditions for eligibility for a satisfaction guarantee, money back guarantee or other offer of refund to consumers;
• Ensure all optometrists and ophthalmologists who contract with the company are in good standing with applicable states;
• Clearly disclose that providers in any “find a doctor” feature do not endorse its products (unless specifically obtained), and agree to remove doctors upon their request; and
• Provide a disclosure that Visibly’s online vision test is not a substitute for an in-person comprehensive eye examination and urge consumers to seek such exams to determine overall eye health.

Takeaway: Claims on telehealth platforms attract enforcers’ attention due to the sensitive nature of the services and the relative novelty of the technology involved. From the FTC, to the FDA, to State AGs, governmental entities are interested not only in protecting the privacy of telehealth consumers (as shown in the BetterHelp settlement), but also the substantiation of advertising claims. Companies should:

• Substantiate telehealth-related claims.
• Clearly describe any relationships with providers, and ensure providers comply with state licensing laws.
• Make appropriate disclosures regarding limitations of products and services where a failure to disclose may materially affect a consumer’s decision.

The Cannabis Control Board, a subset of the Office of Cannabis Management charged with overseeing marijuana regulations statewide, approved a set of labeling, packaging, and advertising regulations. These new rules are part of a trend of more sophisticated enforcement and regulation in the cannabis industry, particularly for products that may appeal to minors.

What do the new advertising rules accomplish?

In short, the regulations are aimed at protecting public health and preventing advertising that may appeal to younger consumers. They were first issued in September, but took effect in late March. Key provisions on the public health side include:

• Prohibiting advertising that makes certain health claims, including that the products are “curative” or “therapeutic,” or that cannabis can prevent or treat specific illnesses or diseases; and
• Requiring certain health warnings, including that cannabis can be addictive, the potential negative health effects of smoking or vaping, and about certain state resources including its HOPEline.

The Board also took aim at marketing that may appeal to younger people. The legal age to consume cannabis in New York is 21, and regulators have signaled that products targeting children may be a priority for enforcement. Generally, the rules prohibit:

• Cannabis advertising within 500 feet of a school or childcare center; and
• Advertising that is “attractive to individuals under twenty-one” including the use of cartoons, games or toys, bubble-type font, bright or “neon” colors, and imitations of food, soda, drinks, cookies, cereal, and others.

Importantly, the regulations impose affirmative annual reporting and record keeping requirements, including regarding the types of products sold or distributed and documentation showing ongoing compliance. The full guidelines are available here.

What should we expect from regulators to come?

While New York legalized recreational marijuana back in 2021, it took nearly two years for state regulators to begin issuing business licenses. The first sanctioned shop opened early this year, after the OCB began its licensing process. Given that, it is likely the New York market will increase its legal presence and enforcers will continue developing the state’s regulatory scheme.

We’ve covered the FTC’s use of its long dormant Penalty Offense Authority extensively in prior posts (see here, here, here, here, and here). In those posts, we noted several unanswered questions regarding the FTC’s use of that authority, such as whether the FTC can use dated decisions from decades ago to justify civil penalties for first-time offenses occurring today; whether the facts and legal standards in place today are sufficiently similar to those present in these dated decisions to satisfy statutory requirements; and whether companies are afforded sufficient due process under an expansive use of this authority.

These questions remain outstanding today, as we have yet to see the FTC “put to its proof”’ by defending its interpretation of this authority in court. The only relevant activity we’ve seen so far has been in two recent settlements specifically referencing Penalty Offense Notices (DK Automation and WealthPress).

In today’s warning letters, the FTC outlined another broad array of purportedly deceptive practices that the FTC has determined to be unfair or deceptive in prior administrative cases, including:

• making an objective product claim without a reasonable basis consisting of competent and reliable evidence;
• making a health benefits or safety features claim without competent and reliable scientific evidence that has been conducted and evaluated in an objective manner by qualified persons and that is generally accepted in the profession to yield accurate and reliable results, to substantiate that the claim is true;
• claiming that a product is effective in the cure, mitigation, or treatment of any serious disease without possessing and relying upon at least one human clinical trial of the product that (1) is randomized, (2) is well controlled, (3) is double-blinded (unless the marketer can demonstrate that blinding cannot be effectively implemented given the nature of the intervention), (4) is conducted by persons qualified by training and experience to conduct such studies, (5) measures disease end points or validated surrogate markers, and (6) yields statistically significant results;
• misrepresenting the level or type of substantiation for a claim; and
• representing that a product claim has been scientifically or clinically proven without evidence sufficient to satisfy the relevant scientific community of the claim’s truth.

These cited administrative orders focus on a wide variety of product claims, including the biodegradability of certain plastics (ECM Biofilms), efficacy of add-on braking systems, auto fuel-savings devices, and gasoline additives (Auto. Breakthrough Scis., Brake Guard Products, Cliffdale Assocs.), efficacy of hair epilators (Removatron), superiority of microwave ovens (Litton Industries), efficacy of weight loss treatments (Porter & Dietsch), and health claims related to treatment of cancer, erectile dysfunction, heart disease, and other ailments (POM Wonderful, Daniel Chapter One, Thompson Medical, Bristol-Myers Comp., American Home Products).

The notices further encourage companies to reference the FTC’s recently released “Health Products Compliance Guidance,” which – as we noted here – constitutes a sweeping overhaul of the 1998 dietary supplement guidance and a departure from the agency’s prior, flexible interpretation of the “competent and reliable scientific evidence” standard.

We will be watching closely to see how the FTC uses these Penalty Offense Notices in future matters and settlements. In the meantime, we encourage all companies (not only the ones who received notices directly) to review claim substantiation and endorsement practices with an understanding that the FTC staff is continuing its efforts to impose a less-flexible substantiation standard and more stringent disclosure requirements.

The crux of their argument was that the settlement amount went beyond any “reasonable estimate” of consumer damages, and was instead more akin to a penalty. As they explained, Section 19 allows the Commission to obtain refunds for consumers, or the payment of damages, but “expressly precludes ‘the imposition of any exemplary or punitive damages.’” The majority responded with its own statement, maintaining that the settlement was within the Commission’s authority and Section 19 allowed it to collect consequential damages to consumers and honest businesses. The complaint contained no details about the number of consumers or honest businesses that might have been harmed by the conduct at issue. [See here for a longer discussion of the boundaries of the FTC’s Section 19 authority.]

On Thursday, the Commission issued a press release announcing that it had sent checks totaling “nearly $45,000” to affected consumers. One need not have a particular facility with numbers to recognize the significant delta between $753,300 and $45,000. This rather paltry refund amount would seem to give credence to Commissioners Wilson and Phillips’ assertion that the Commission’s settlement was impermissibly punitive in nature. [The press release does say that the Commission will contact another 12,300 consumers who purchased Dreamcloud mattresses and may be eligible for a payment. It is unclear how these consumers may have been affected by the deceptive statements at issue, and it will be interesting to learn how many of these consumers ultimately receive compensation and in what amounts.]

This case illustrates the value of having minority commissioners that can provide insight into the operations of the agency and highlight areas worthy of additional scrutiny. Without Commissioners Wilson and Phillips, it will be harder for the public to evaluate the Commission’s work by identifying areas where the agency may be pushing the bounds of its authority.

Overview of the FTC’s Broad View of “Health Information”

BetterHelp is an online counseling service that has registered more than 2 million users since its 2013 inception. When a consumer visits the site, the FTC alleges that she is “immediately prompted to begin” Better Help’s intake questionnaire that asks questions about the consumer’s history of therapy, current mental state, and religious beliefs among other characteristics, and then provides an email address and other information to create an account.

According to the FTC’s complaint, the company violated the FTC Act through its use of advertising pixels or web beacons and by uploading consumers’ “health information” to ad platforms for retargeting and to reach additional prospects. In the FTC’s view, the “health information” that BetterHelp disclosed not only included information about consumers’ past use or current enrollment in the company’s services but also their interest in obtaining therapy. This information was sufficient to “reveal” that consumers were “seeking mental health treatment.”

Specifically, the FTC alleges that the company disclosed consumers’ email addresses, IP addresses, and information about their interest or enrollment in BetterHelp’s services. For instance, BetterHelp made available certain “event” information, such as when consumers “answered certain questions . . . in a certain way” or “when” they enrolled in the company’s services. The FTC also alleges that the company disclosed the contents of certain intake questionnaire responses, such as whether an individual had previously been in counseling and how they answered questions about their financial status.

The complaint implicitly rejects counterarguments that the identifiers at issue were not “personal” information in the first place. For example, BetterHelp “hashed” consumers’ email addresses – converting email addresses “into a sequence of letters and numbers through a cryptographic tool.” The complaint asserts that ad platforms were able to “effectively undo” the hashing and match the underlying email addresses with platform user IDs. The complaint also states, without explanation or qualification, that IP addresses are sufficient to identify individuals, at least within the context of BetterHelp’s practices. The complaint points to a variety of BetterHelp’s past privacy representations, including that the company would “never sell or rent any information you share with us” and that it would share only “anonymous background information” about users. As a result, the FTC alleges, BetterHelp injured consumers and broke its promises that it would not share certain information with third parties or use it for advertising purposes.

No Violation of the Health Breach Notification Rule

Count I of the FTC’s complaint is based on unfairness; it contends that BetterHelp’s failure to employ reasonable measures to protect health information “result[ed] in the improper and unauthorized disclosure of that information to numerous third parties,” which “caused or [is] likely to cause substantial injury to consumers.” To a casual reader, these allegations might seem like they are describing the breach of health information. The FTC, however, did not allege that BetterHelp violated the Health Breach Notification Rule (HBNR). Commissioner Wilson’s concurring statement explains that there are at least two reasons the Commission decided against pursuing an HBNR count: (1) BetterHelp’s conduct ended before the FTC issued its September 2021 HBNR Policy Statement (which we wrote about here); and (2) BetterHelp’s service does not include “records that can be drawn from multiple sources,” as required by the HBNR. This leaves us to wonder whether companies operating in the health space will know whether their apps or services are drawing from multiple sources, subjecting them to potential liability under the HBNR?

The FTC’s Theories of Unfairness

The FTC’s complaint advances at least two theories of consumer injury. First, the complaint alleges that BetterHelp’s disclosure of mental health-related information “is likely to cause [consumers] stigma, embarrassment, and/or emotional distress” and “may also affect [their] ability to obtain and/or retain employment, housing, health insurance, or disability insurance.” Although mental health treatment has been long recognized as deserving special protection, the FTC’s allegations do not distinguish between a consumer’s interest in BetterHelp and the fact that they are receiving mental health services from BetterHelp. This distinction is significant in advertising industry standards and practices, but the FTC’s complaint does not recognize the distinction and offers no limiting principle to apply in other settings or with different types of health information.

Second, the FTC alleges that consumers who enrolled in BetterHelp’s services suffered financial injury. Consumers allegedly paid a “price premium” for the company’s services based on its privacy representations, and “would not have been willing” to pay the going rate for these services had they fully understood the company’s data practices.

These theories of harm underlie the FTC’s two unfairness claims, but the claims do not track with the alleged different injuries. Instead, Count I alleges that BetterHelp’s overall “fail[ure] to employ reasonable measures to protect consumers’ health information” – including insufficient training and third-party contractual data use limitations, and the lack of opt-in consent – was overall unfair. Separately, Count II of the complaint charges that BetterHelp was required to have obtained affirmative express consent before “collecting, using, and disclosing” this information to third parties.

Redress Theory

As part of its settlement, BetterHelp will pay $7.8 million. The proposed settlement order describes the settlement funds as payable to an FTC redress fund, which the FTC explains it will use to “provide partial refunds to people who signed up for and paid for BetterHelp’s services between August 1, 2017 and December 31, 2020.” The legal theory for this relief is not described in the settlement package, although the complaint described the “price premium” BetterHelp theoretically charged for its alleged deceptive privacy assurances. While the Supreme Court’s holding in AMG Capital Management v. FTC prevents the FTC from using its Section 13(b) authority for monetary remedies, parties are free to agree to settlement terms, including regarding redress.

What’s Next?

The FTC is signaling through this settlement and recent actions that using consumer information related to health for advertising purposes without at least enhanced notice and consent risks violations of Section 5. Companies offering health-related products or services should consider:

• If you have a full inventory of the information you’re sharing with third parties through pixels or otherwise.
• Whether you are defining “health information” consistently with where the FTC is drawing lines today.
• Will your existing consumer disclosures withstand the close scrutiny of a regulatory review. For example, do you promise anonymity or privacy?