- within Energy and Natural Resources and Strategy topic(s)
- with readers working within the Insurance industries
Welcome to Wiley’s update on recent developments and what’s next in consumer protection enforcement and regulation. We cover developments with the Federal Trade Commission (FTC or Commission), the Consumer Financial Protection Bureau (CFPB or the Bureau), and state Attorneys General (AGs), as well as self-regulatory advertising challenges decided by BBB National Programs’ National Advertising Division (NAD). Please reach out to any of our authors with any questions about recent regulatory or enforcement activity on the federal or state level.
To subscribe to this newsletter, click here.
Select Federal Enforcement Actions
FTC Settles with Payment Processor for Allegedly Facilitating Fraudulent Merchant Processing. On September 8 and 11, the FTC filed a complaint and stipulated order, respectively, to settle allegations against a payment processing company for alleged violations of the FTC Act. The FTC alleged that the company processed payments for entities that allegedly served as fronts for fraudulent businesses despite red flags, such as significantly high chargebacks, and used tactics designed to increase approval rates for transactions associated with sham merchants. The defendant agreed to pay $12 million in addition to injunctive relief.
FTC Settles With Global Payment Processor for Allegedly Deceptive Practices. On September 3 and 4, respectively, the FTC filed a complaint and stipulated order in federal court to settle allegations against a global payment processor and several subsidiaries for alleged violations of the FTC Act and Telemarketing Sales Rule. The FTC alleged that the defendants opened and maintained accounts for merchants they knew, or should have known, were engaged in overseas deceptive tech support schemes. The defendants agree to pay $4.85 million in addition to injunctive relief.
FTC Finalizes Orders with Three Companies Regarding Alleged Deceptive AI Advertising Claims. On August 27, the FTC announced that it had finalized consent orders with a media company and two marketing firms, resolving alleged violations of the FTC Act. The May 2026 complaints alleged that the defendants claimed to offer an artificial intelligence (AI)-powered “Active Listening” service to small businesses that could target ads based on consumers’ real‑time conversations captured from smart devices and claimed that consumers had consented to this data collection. The FTC alleged that instead, the service relied on resold email lists from data brokers that included data collected without consumer consent. Under the settlements, the defendants agreed to pay a total of approximately $930,000 in monetary penalties in addition to injunctive relief.
Select State Enforcement Actions
Texas AG Wins Partial Summary Judgment Against Social Media Platform for Violations of State Children’s Privacy Law. On September 10, the Texas AG announced that a Texas state court granted its motion for partial summary judgment against a social media platform for violations of the Texas Deceptive Trade Practices Act. In its 2025 complaint, the Texas AG alleged that the company misled consumers by representing that it would remove certain content that violated its Community Guidelines and filter out content that was inappropriate for minors when the “Restricted Mode” was enabled, even though such content was not consistently removed and the “Restricted Mode” was often unsuccessful at filtering inappropriate content. Texas plans to pursue relief and penalties at the upcoming trial.
Colorado AG Sues Financial Technology Company for Alleged Deceptive App Designs and Unlawful Lending Practices. On August 27, the Colorado AG filed a complaint against a financial technology company for alleged violations of Colorado’s lending and consumer protection laws. Specifically, the complaint alleges that the company unlawfully provided high-cost payday loans to consumers and used deceptive app designs to push a majority of the app’s consumers into paying a tip or expedite fee. According to the complaint, the app designs complicated the process to select no tip, displayed messages such as “[t]ip to pay it forward” to steer users towards tipping, and misrepresented that the tips would go to other users rather than directly to the company. The complaint seeks restitution, civil penalties, and other injunctive relief.
Washington AG Settles with Company for Allegedly Impersonating Government Agency. On September 10, the Washington AG agreed to a $522,409 settlement with a company for allegedly impersonating a government agency and sending solicitations seeking money to renew annual report filings required by the Washington government. According to the press release, the company sent more than 190,000 solicitations that deceptively appeared to be bills from a government agency.
California DFPI Issues Desist and Refrain Order Against Debt Relief Services Company for Allegedly Misrepresenting Services. On September 8, the California Department of Financial Protection and Innovation (California DFPI) issued a desist and refrain order against a debt relief services company after the company allegedly advised at least one California consumer that it would “pay bills and negotiate lower rates on their behalf,” when in fact it did not. The desist and refrain order prohibits the company and its officers, employees, and agents from engaging in deceptive acts or practices with respect to consumer financial products or services.
California DFPI Issues Desist and Refrain Order Against Debt Collector for Allegedly Engaging in False, Deceptive, and Misleading Debt Collection Practices. On September 8, the California DFPI issued a desist and refrain order against a debt collection company after the company allegedly engaged in false, deceptive, and misleading debt collection practices in contacting two California residents. According to the filing, the communications with the California consumers “conveyed the impression that they originated from a law office and that litigation had already commenced or was imminent,” but no legal action or judgment had been filed. The debt collection company also allegedly had not applied for a debt collector license with the California DFPI. The desist and refrain order prohibits the company and its officers, employees, and agents from engaging in further deceptive acts or practices with respect to consumer debt collection.
California DFPI Issues Desist and Refrain Order Against Finance Lender and Broker for Allegedly Operating Without a License. On September 8, the California DFPI issued a desist and refrain order against a finance lender and broker for allegedly operating in California without a license. The desist and refrain order prohibits further operation without first obtaining a license.
CPPA Fines Virginia Lead Generator for Failing to Register as a Data Broker. On September 1, the California Privacy Protection Agency (CPPA) announced a decision requiring a Virginia-based lead generation company to pay a $36,400 fine after the company failed to register on the CPPA’s Data Broker Registry. The decision also requires the company to post metrics about privacy rights on its website, access the CPPA’s Delete Request and Opt-out Platform, and process future deletion requests through that system.
Select NAD Advertising Challenge Case Decisions
NAD Finds Insufficient Support for Claims by Genetic Screening Product Over Product’s Ability to Detect Embryo Disease Risks and Traits. On September 11, NAD found that the maker of a genetic screening product for IVF embryos failed to provide satisfactory evidence that its product could determine the relative cancer and disease risks, heights, IQs, and specific eye and hair colors of potential embryos. Specifically, NAD found the product maker failed to substantiate numerous quantitative estimates displayed in its advertising, including estimated differences in embryos’ predicted heights and IQ scores.
NAD Rejects Popularity, Superiority, and Safety Claims for Baby Monitor. On September 1, NAD recommended that the maker of a baby monitor product that provides real-time data on children’s sleep modify or discontinue claims that the baby monitor was the “most loved,” “internet’s favorite,” “most awarded,” and “smartest” on the market. NAD also recommended the product maker discontinue the claims that the product alerts parents “if anything is wrong” and “keeps a safe environment for your kiddos,” finding the product only provides alerts related to temperature and humidity levels and not all aspects of health.
NAD Recommends Maker of Infant Formula Product Discontinue Certain Nutrition, Ingredient, and Heritage Claims. On August 31, NAD recommended that the maker of an infant formula product discontinue a series of claims that suggested its ingredient composition was nutritionally superior compared to other infant formulas. Specifically, NAD disapproved of claims that the use of whole milk keeps natural fats closer to breast milk and that the product had “[n]o skimming, no shortcuts, just pure, natural whole milk fats…the way nature intended.” NAD also recommended the formula maker modify its “Est. 1962” and “60 years of experience” claims, because these claims referred to the age of the manufacturing facility and production heritage, not the age of the branded formula.
Federal and State Regulatory Announcements
FTC Withdraws 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. On September 9, the FTC announced that it had rescinded the 2021 Statement of the Commission On Breaches by Health Apps and Other Connected Devices (2021 Policy Statement). The 2021 Policy Statement stated, among other things, that the FTC’s Health Breach Notification Rule applied to health apps and connected vehicles that collect consumer health information. In 2024, the Commission updated the Health Breach Notification Rule, including to cover health apps and connected devices such as fitness trackers, and the FTC found that the 2021 Policy Statement “has been superseded by rulemaking.”
FTC Announces Bureau of Consumer Protection Rule Guidance Program. On September 10, the FTC’s Bureau of Consumer Protection (BCP) announced the launch of the BCP Rule Guidance Program, which creates a process for stakeholders “to identify genuine ambiguities in the Commission’s rules, substantive conflicts between a rule and an existing statute or other rule, and other significant issues that may exist within Commission rules.” The BCP plans to review submitted questions and, if staff determines a response is appropriate, will publish guidance regarding the issue. The BCP states that it will not address questions that simply ask staff to restate what the rule states or that attempt to diminish a business’s own compliance responsibilities.
FTC Extends Comment Deadline on Proposed Enforcement Policy Statement Regarding Personalized Pricing. Comments are due September 25 (extended from September 18) on a proposed enforcement policy statement regarding “personalized pricing,” including the use of a consumers' personal data to set prices. The proposed policy statement, released on August 19, states that while Congress has not given the FTC authority to prohibit personalized pricing in all circumstances, the FTC “intends to enforce the law aggressively against any deceptive or unfair personalized pricing practices that violate Section 5 of the FTC Act or any other law enforced by the Commission.” The proposed statement specifies that personalized pricing without adequate disclosures or personal pricing based on data collected without verified consumer consent likely violates Section 5 of the FTC Act. The proposed statement also offers a non-exhaustive list of personalized pricing practices that may violate Section 5.
More Analysis from Wiley
Chambers USA 2026 Recognizes Wiley Lawyers and Practices
Legal 500 US 2026 Recognizes Wiley Practices and Attorneys
82 Wiley Attorneys Recognized in Best Lawyers in America 2027
California Closes Legislative Session with Significant AI and Privacy Developments
Is This Real? Navigating AI Impersonation Under New and Existing Laws
AI-Driven Vulnerability Sharing: Four Takeaways on “Gold Eagle” and Other New Initiatives
TMT Companies Should Prepare for Post-Midterm Congressional Scrutiny – No Matter Who Wins
State Attorneys General Signal Enforcement Priorities for Competitor Collaborations
Colorado Proposes Detailed Rules Implementing New ADMT and Chatbot Laws
A New Framework for AI Data Center Security: NIST SP 800-239
AI, Cybersecurity, and the Expanding Threat Landscape: Key Takeaways from Congressional Hearing
U.S. Supreme Court Allows President to Remove FTC Commissioners
New Jersey Adopts Sweeping New Data Broker Law, Effective Immediately
State Chatbot Laws Are Moving From Transparency to Risk Management
Amidst uncertainty from FTC, states zero in on dynamic and algorithmic pricing
Key Developments With State App Store Accountability Acts, as Texas Act Takes Effect
Connecticut Enacts AI Framework While Colorado Scales Back Landmark AI Law
New AI Executive Order Addresses Frontier Models and Cybersecurity Vulnerabilities
Data Brokers Face Rising Regulatory Pressure From States
AI in Hiring: Evolving Legal Risks Under State and Federal Law
May 19 Deadline for TAKE IT DOWN Act Compliance: Is Your Company Prepared?
President Trump’s “Made in America” Executive Order Seeks to Enforce Accuracy of U.S.-Origin Claims
Managing Agentic AI in Real‑World Use: From Outputs to Actions
Major Changes to Connecticut’s Consumer Privacy Law Will Take Effect July 1, 2026
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
