Welcome to Wiley's update on recent developments and what's next in consumer protection at the Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), and the state level. Check out our new FTC Consumer Protection and Enforcement Series where we provide practical insights into emerging FTC priority areas for consumer protection and data privacy enforcement. Recent posts include The Fair Credit Reporting Act – Who Is Covered and How to Comply; PADFA Enforcement – What Companies Need to Know; Practical Tips for When Your Company Gets an FTC CID; and Kids' Online Safety Is a Top Priority.
Wiley has also launched a Trump Administration Resource Center and Resource Guide to track Executive branch priorities during the second Administration of President Trump. With Wiley's deep-rooted understanding of Washington and today's evolving regulatory landscape, the Resource Center and Resource Guide provide critical insights, actionable intelligence, practical solutions, and guidance across key industries to help businesses stay ahead of the curve and manage challenges in 2025 and beyond. Please reach out to any of our authors with any questions about recent Trump Administration actions and the potential impact on regulations or enforcement activity.
To subscribe to this newsletter, click here.
Federal and State Regulatory Announcements
FTC Issues RFI on Employee Noncompete Agreements. On September 4, the FTC issued a RFI regarding Employer Noncompete Agreements in order to better understand the scope of noncompete agreements, “as well as to gather information to inform possible future enforcement actions.” Noncompete agreements are contractual terms that typically prohibit a worker from working for or starting a competing business after the end of the worker's employment. The FTC is requesting information from employees and employers facing hiring difficulties due to noncompete agreements. The RFI also asks what reasons employers have given for using noncompete agreements. Comments are due no later than November 3.
California AG Issues Consumer Alert on the State's Automatic Renewal Law. On September 4, the California Attorney General (AG) issued a consumer alert about California's Automatic Renewal Law, which requires businesses to obtain consent before charging California residents for services, subscriptions, and plans that continue until the consumer cancels them. The law also applies to free trials for services or products that become subscriptions that continue until the consumer cancels them.
Colorado Extends Effective Date of AI Law. On August 28, the Colorado Governor signed Senate Bill 25B-004 into law to change the effective date of Colorado's AI Act from February 1, 2026, to June 30, 2026, to allow the Colorado legislature to consider further amendments to the AI Act.
California AG Warns Consumers of Text-Based Scams Targeting Taxpayers. On August 27, the California AG issued a warning to consumers about ongoing texting scams targeting California taxpayers. According to the California AG, “[t]ax fraud scams are a part of a larger universe of government imposter scams, which occur when a person claims to be a government employee in order to obtain a victim's personal information or for financial gain.” Specifically, the California AG states that these texts purport to originate from the State of California Franchise Tax Board (FTB) and solicit personal information from consumers so that they may receive their tax refund. According to the FTB, consumers should “[v]erify any suspicious messages by contacting the agency identified directly and visiting official pages only.”
Select Federal Enforcement Actions
FTC Finalizes Order Against AI Content Detector for Allegedly Misleading Marketing. On August 28, the FTC approved a final order against a company marketing a product that it claimed could be used to detect AI-generated content for alleged violations of the FTC Act. The FTC's April 2025 complaint alleged that the company misled consumers by claiming that its product was 98% accurate when independent testing showed that its accuracy was 53%. The company agreed to injunctive relief and compliance reporting.
FTC and DOJ Settle with Entertainment Company for Alleged Violations of COPPA. On September 2, the U.S. Department of Justice (DOJ), upon referral from the FTC, filed a complaint and stipulated order in the U.S. District Court for the Central District of California against an entertainment company for alleged violations of the FTC Act and Children's Online Privacy Protection Rule (COPPA). DOJ and the FTC allege that the company failed to mark its content as “Made for Kids” when it uploaded its videos to YouTube and that the failure to make that distinction allowed the company to collect personal data from children under 13. The company agreed to pay a $10 million civil penalty in addition to changing its policies for uploading such content and other injunctive relief.
FTC and DOJ Settle with Robot Toy Maker for Alleged Violations of COPPA. On September 2, DOJ, upon referral from the FTC, filed a complaint and stipulated order in the U.S. District Court for the Northern District of California against a robot toy maker for alleged violations of the FTC Act and COPPA. DOJ and the FTC allege that the company failed to notify parents and obtain their consent before collecting, or causing a third party to collect, geolocation data from children. The company agreed to pay $500,000 in addition to injunctive relief.
FTC and Utah AG Settle with Adult Content Sites for Allegedly Misleading Practices. On September 3, the FTC and the Utah AG filed a complaint and stipulated order in the U.S. District Court for the District of Utah against a company that operates adult content websites and its affiliates for alleged violations of the FTC Act and Utah Consumer Sales Practices Act. The complaint alleges that the companies failed to block users and promptly review and remove videos and photos featuring child sexual abuse material, despite policies that indicated lack of tolerance for such materials, and failed to keep records of its efforts to verify the age and identity of individuals featured in posted content. The defendants agreed to pay $15 million in addition to injunctive relief.
FTC and Nevada AG Settle with Investment Training Company Executive and Salesperson for Allegedly Deceptive Business Practices. On September 3, the FTC and the Nevada AG filed a stipulated order in the U.S. District Court for the District of Nevada settling alleged violations of the FTC Act, Telemarketing Sales Rule, the Restore Online Shoppers' Confidence Act, and Nevada's deceptive trade practices statute. In a May 2025 complaint, the FTC and Nevada AG alleged that the defendants and their company deceived consumers in claiming to provide training on investing and other financial topics for monthly fees, and marketing their products as easy ways to make money, but had salespeople serve as the educators for these trainings and did not have records of customers successfully using these trainings to make money. The FTC and Nevada AG previously settled with the other defendants. The two remaining individual defendants have agreed to pay a total of $10.5 million in addition to injunctive relief.
FTC Settles with Pet Cremation Company Regarding Noncompete Provisions. On September 4, the FTC issued a complaint and proposed order against a pet cremation company for alleged violations of the FTC Act. The FTC alleges that the company required all employees to sign noncompete agreements regardless of their role at the company, including hourly employees. The company agreed to injunctive relief including to cease enforcing noncompete agreements with its employees.
FTC Settles with Online Marketplace for Alleged Violations of the INFORM Consumers Act. On September 5, the FTC filed a complaint and stipulated order in the U.S. District Court for the District of Massachusetts against an online marketplace for alleged violations of the FTC Act and the Integrity, Notification, and Fairness in Online Retail Marketplace for (INFORM) Consumers Act. The FTC alleges that the company failed to provide consumers with information and reporting tools to help them avoid and report stolen, counterfeit, or unsafe goods while shopping online. The company agreed to pay $2 million in addition to injunctive relief.
Select State Enforcement Actions
California DFPI Issues Action Against Unregistered Service Provider That Allegedly Made Deceptive FDIC Claims. On August 27, the California Department of Financial Protection and Innovation (DFPI) issued a Desist and Refrain Order, Claim for Ancillary Relief, and Notice of Intent to Issue Administrative Penalties against a California financial technology company that allegedly failed to register with the agency, as required by the California Consumer Financial Protection Law (CCFPL). The CCFPL requires companies providing consumer financial products or services, including companies engaging in deposit-taking activities in the state of California, to register with the California DFPI. The California DFPI alleges that the service provider advertised to consumers that Federal Deposit Insurance Corporation (FDIC) coverage of cash deposits to the service provider meant the funds were “safe” and “covered against all risks,” and that constitutes deceptive acts or practices in violation of the CCFPL.
The Desist and Refrain Order instructs the service provider to cease providing consumer financial products or services, and to stop making alleged misrepresentations about the security of cash deposits. The Claim for Ancillary Relief directs the service provider to “identify customers owed funds and pay restitution consisting of the outstanding unpaid balances remaining in the cash management accounts of California customers.” Finally, the Notice of Intent to Issue Administrative Penalties provides notice of the California DFPI's intent to “issue an order assessing administrative penalties against [the service provider] for the statutory amount of two thousand five hundred dollars ($2,500.00) for each violation of the CCFPL.”
Texas AG Sues School Software Company for Data Breach. On September 3, the Texas AG announced a lawsuit against a provider of cloud-based services for K-12 schools. The complaint alleges that the company failed to deploy adequate privacy and data security protections, resulting in a 2024 hack to the company that compromised the data of personal information of hundreds of thousands of students and teachers. The Texas AG seeks monetary and injunctive relief.
Upcoming Events and Comment Deadlines
CFPB Seeks Comment on New Thresholds for Larger Participants in the Automobile Financing, Consumer Reporting, International Money Transfer, and Debt Collection Markets. Comments are due September 22 on four CFPB advance notices of proposed rulemaking (ANPR) that seek comment on raising the thresholds for defining larger participants in the markets for automobile financing, consumer reporting, international money transfer, and debt collection. The Consumer Financial Protection Act authorizes the CFPB to define larger participants in markets for consumer financial products or services, and to supervise larger nonbank entities subject to the law to assess compliance with federal consumer financial laws, obtain information about such entities' activities and compliance systems and procedures, and detect and assess risks to consumers and consumer financial markets. If adopted, the heightened thresholds would greatly reduce the number of nonbank entities subject to supervision in each of the markets discussed above.
CFPB Requests Comment on Proposed Legal Standard Applicable to Supervisory Designation Proceedings. Comments are due September 25 on a CFPB Proposed Rule to adopt a standard definition of “risks to consumers” in the context of Section 1024(a)(1)(C) of the Consumer Financial Protection Act of 2010 (CFPA). Section 1024(a)(1)(C) authorizes the Bureau to supervise a nonbank covered person that the Bureau has reasonable cause to determine, by order, after notice to the covered person and a reasonable opportunity for such covered person to respond, is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services. The proposed rule would explain that “conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services” consists of conduct that: “(a) presents a high likelihood of significant harm to consumers; and (b) is directly connected to the offering or provision of a consumer financial product or service as defined in section 1002 of the CFPA.”
FTC Seeks Comments Regarding Gender Affirming Care for Minors. On July 28, the FTC issued a request for information regarding potential unfair or deceptive trade practices in gender-affirming care for minors. Comments are due by September 26, 2025.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
