🕷️ Crawler Inspector

URL Lookup

Direct Parameter Lookup

Raw Queries and Responses

1. Shard Calculation

Query:
Response:
Calculated Shard: 109 (from laksa131)

2. Crawled Status Check

Query:
Response:

3. Robots.txt Check

Query:
Response:

4. Spam/Ban Check

Query:
Response:

5. Seen Status Check

ℹ️ Skipped - page is already crawled

📄
INDEXABLE
✅
CRAWLED
1 day ago
🤖
ROBOTS ALLOWED

Page Info Filters

FilterStatusConditionDetails
HTTP statusPASSdownload_http_code = 200HTTP 200
Age cutoffPASSdownload_stamp > now() - 6 MONTH0 months ago
History dropPASSisNull(history_drop_reason)No drop reason
Spam/banPASSfh_dont_index != 1 AND ml_spam_score = 0ml_spam_score=0
CanonicalPASSmeta_canonical IS NULL OR = '' OR = src_unparsedNot set

Page Details

PropertyValue
URLhttps://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa
Last Crawled2026-04-19 04:16:24 (1 day ago)
First Indexed2019-12-18 23:31:52 (6 years ago)
HTTP Status Code200
Meta TitleConsumer Protection Laws and Regulations Report 2026 USA
Meta DescriptionThis article focuses on consumer protection laws and regulations in the USA, exploring enforcement, investigation of potential breaches, appeals, and more.
Meta Canonicalnull
Boilerpipe Text
Consumer Protection Laws and Regulations USA 2026 ICLG - Consumer Protection Laws and Regulations - USA Chapter covers common issues in consumer protection laws and regulations, including substantive provisions, enforcement action, current trends and anticipated reforms. Published: 10/04/2026 Chapter Content Free Access 1. General 2. Protections in Relation to the Quality , Function and Safety of Goods and Services 3. Prohibitions Relating to “Conduct” Against Consumers 4. Specific Applications of the Rules and Protections 5. Other Protections/Prohibitions 6. Investigation of Potential Breaches 7. Enforcement 8. Appeals 9. Current Trends and Anticipated Reforms 1. General 1.1        What legislation, regulations and guidelines are relevant to consumer protection in your jurisdiction? United States law protects consumers at the federal and state levels.  Select federal consumer protection statutes, which apply nationwide, include the Federal Trade Commission Act (“FTC Act”), the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), the Gramm-Leach-Bliley Act (“GLB Act”), the Truth in Lending Act, the Fair Credit Reporting Act (“FCRA”), the Fair Debt Collection Practices Act, the Equal Credit Opportunity Act (“ECOA”), the Identity Theft and Assumption Deterrence Act, the Children’s Online Privacy Protection Act (“COPPA”), the Telephone Consumer Protection Act (“TCPA”), the Video Privacy Protection Act, the Federal Tort Claims Act, the Consumer Product Safety Act (“CPSA”), the Federal Food, Drug and Cosmetic Act (“FDCA”), the Magnuson Moss Warranty Act, the Lanham Act, and the Securities Exchange Act of 1934. Previously, under the Biden administration, the Federal Trade Commission (“FTC”) and the Consumer Financial Protection Bureau (“CFPB”) pursued an expansive consumer protection agenda, with a focus on rulemaking to complement enforcement actions.  Newer rule initiatives focused on addressing unfair and deceptive business practices related to multi-level marketing schemes, for-profit colleges, “gig” employment opportunities, telemarketing, automotive “junk fees”, government impersonation, and commercial surveillance.  The Trump administration has since significantly reduced consumer protection enforcement. For example, the CFPB withdrew nearly 70 guidance documents in 2025, citing the administration’s mandate to eliminate regulations and reduce costs for businesses.  The One Big Beautiful Bill Act, signed by Trump on July 4, 2025, nearly halved the CFPB’s budget, cutting its cap of Federal Reserve operating expenses from 12 per cent to 6.5 per cent. Federal regulations also continue to evolve alongside the increasingly online consumer marketplace.  For example, the FTC instituted a regulation that prohibits selling or purchasing fake consumer reviews or testimonials without clearly disclosing the relationship to consumers.  16 CFR 465.  This aims to prevent companies from deceiving consumers through the use of fake reviews, suppression of negative reviews, and paying for positive reviews.  The FTC is also evaluating how best to combat and prevent the harmful effects of Artificial Intelligence (“AI”).  For example, the FTC ran an exploratory challenge named “Voice Cloning Challenge” to encourage the development of multidisciplinary approaches – from products to polices to procedures – aimed at protecting consumers from AI-enabled voice cloning harms.  Top submissions include proposals from organisations and professors at universities, which will split $35,000 in prize money.  In another example, the FTC sued to stop Air AI from using deceptive claims about business growth, earnings potential, and refund guarantees to bilk millions from small businesses. In 2025, the FTC shifted from the Biden-era emphasis on broad rulemaking toward more targeted and case-by-case investigations, focusing on anticompetitive and sector-specific enforcement in areas such as healthcare and tech.  For example, the FTC secured a historic $2.5 billion settlement with Amazon over allegations that the company used deceptive sophisticated subscription traps designed to manipulate consumers into enrolling in Prime memberships without their knowledge and made it unduly hard to cancel those subscriptions.  The FTC also ordered the nation’s largest pet cremation business, Gateway Services, Inc., to stop enforcing restrictive noncompete agreements that bind nearly 1,800 workers.  FTC Chairman Andrew N. Ferguson sent letters to several large healthcare employers and staffing firms urging them to conduct a comprehensive review of their employment agreements – including any noncompete or other restrictive agreements – to ensure they are appropriately tailored and comply with the law. At the federal legislative level, Section 230 of the Communications Decency Act, which generally protects online platforms from liability for user-generated content, remains the subject of great debate.  Its original justification – to encourage the growth and development of the internet in its early years – is no longer valid.  With more and more dangerous platforms proliferating online, in the AI space and otherwise, many now believe platforms should be held accountable for the consumer and other harms they enable.  Despite this growing view, it remains to be seen whether any legislative change will follow.  A narrower interpretation of immunity might also be successfully advanced in courts, given that the increasingly digital world in which we now live and work could not have been anticipated when Section 230 was passed. In addition to federal law, most states have one or more consumer protection statutes that prohibit unfair and deceptive business practices within their borders.  States with the broadest, most flexible prohibitions thus affording the greatest consumer protections include California, Connecticut, Hawaii, Illinois, Massachusetts, New York and Vermont.  Perhaps the best-known examples of state consumer protection statutes are California’s Consumers Legal Remedies Act (“CLRA”) and New York’s General Business Law.  Powerful examples of state privacy legislation are the Illinois Biometric Information Privacy Act (“BIPA”), and the California Consumer Privacy Act (“CCPA”). 1.2        What is the definition of “consumer” (i.e., who does consumer protection law protect)? Consumer protection laws safeguard purchasers of goods and services against defective products and deceptive, fraudulent business practices.  The definition of “consumer” is statute-specific and varies depending on the nature of the goods or services being regulated.  For example, under the Uniform Commercial Code (“UCC”), a collection of laws adopted by most states to regulate interstate commercial transactions, “‘consumer’ means an individual who enters into a transaction primarily for personal, family, or household purposes”.  UCC § 1-201.  Under the Dodd-Frank Act, which overhauled financial regulation after the Great Recession of 2007–09, “‘consumer’ means an individual or an agent, trustee, or representative acting on behalf of an individual”.  12 USC § 5481(4).  Under the FCRA, which restricts the use of information held by consumer reporting agencies, the term simply “means an individual”.  15 USC § 1681(a)–(c).  The TCPA protects businesses as well as natural persons against telephone solicitation.  47 USC § 227. Under state law, the definition of “consumer” may be limited to an “individual who seeks or acquires, by purchase or lease, any goods or services for personal, family, or household purposes” – see , e.g. , Cal. Civ. Code § 1761(d) – but some statutes sweep more broadly.  For example, under the Texas Deceptive Trade Practices and Consumer Protection Act, the definition of consumer includes “an individual, partnership, corporation, this state, or a subdivision or agency of this state who seeks or acquires by purchase or lease, any goods or services”.  Tex. Bus. & Com. Code § 17.45(4). 1.3        Who is/which entities are required to comply with consumer protection law? The entities governed vary by statute.  For example, the FTC Act applies to “persons, partnerships, or corporations, except banks, savings and loan institutions […], Federal credit unions […], common carriers […], and persons, partnerships, or corporations insofar as they are subject to the Packers and Stockyards Act”.  15 USC § 45(a)(2).  The Dodd-Frank Act applies to “any person that engages in offering or providing a consumer financial product or service”, as well as affiliates of such persons.  12 USC § 5481(6).  State consumer protection laws typically provide broad prohibitions that apply to anyone engaged in commercial conduct.  For example, the Connecticut Unfair Trade Practices Act provides that “[n]o person shall engage in unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce”.  Conn. Gen. Stat. § 42-110b(a).  Many statutes, however, carve out specific exceptions.  For example, the Pennsylvania Unfair Trade Practices and Consumer Protection Law imposes a standard of strict liability on businesses but contains an exemption for media entities that publish deceptive advertisements in good faith and without knowledge of the deception.  73 Pa. State. § 201-3. 1.4        Which agency/agencies is/are responsible for enforcing consumer protection law (i.e., who is the investigator and who is the adjudicator)? Various federal agencies enforce consumer protection laws, including the FTC, the CFPB, the Federal Communications Commission (“FCC”), the Consumer Product Safety Commission (“CPSC”), the Food and Drug Administration (“FDA”), and the United States Department of Agriculture (“USDA”).  Some federal enforcement may begin to see new limits in the coming years.  For example, the One Big Beautiful Bill Act, signed on July 4, 2025, reduced the CFPB’s operating budget by nearly half.  At the state level, each Attorney General (“AG”) investigates and enforces consumer protection laws; in some states, District Attorneys also have the authority to prosecute consumer protection claims.  In California, the Department of Consumer Affairs has an internal division that is authorised to investigate consumer complaints and enforce state consumer protection laws. Many state consumer protection laws also include a private right of action, empowering consumers to vindicate rights in court parallel to, or independent of, government action.  These private actions serve as a critical “gap” filling measure to ensure greater legal compliance and accountability than regulatory action alone could achieve.  In some states, individuals are required to give advance notice of the alleged deceptive practices to the business, prior to filing in court.  This creates a safe harbour period during which the business may address the individual’s claims and avoid legal liability or other penalties. 2. Protections in Relation to the Quality , Function and Safety of Goods and Services 2.1        Please describe any protections regarding the quality and function of goods and services acquired by consumers. At the federal level, agencies such as the FDA and USDA promulgate regulations regarding the quality and function of goods and services such as foods, drugs, and agriculture.  At the state level, the UCC, which has been almost universally adopted, contains provisions relating to express and implied warranties.  See UCC §§ 2-313–2-315.  Some state statutes have requirements pertaining to the quality of goods.  For example, California’s CLRA prohibits “[r]epresenting that goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that they do not have or that a person has a sponsorship, approval, status, affiliation, or connection that the person does not have”.  Cal. Civ. Code § 1770(a)(5).  Many states also recognise common law claims for fraud or breach of express and implied warranties. Turning to the safety of goods and services, at the federal level, the CPSA exists: “(1) to protect the public against unreasonable risks of injury associated with consumer products; (2) to assist consumers in evaluating the comparative safety of consumer products; (3) to develop uniform safety standards for consumer products and to [minimise] conflicting State and local regulations; and (4) to promote research and investigation into the causes and prevention of product-related deaths, illnesses, and injuries.”  15 USC § 2051(b).  The Motor Vehicle Safety Act “prescribe[s] motor vehicle safety standards”.  49 USC § 30101(1).  The FDCA seeks to ensure the safety of food, drugs, medical devices and cosmetics.  See 21 USC §§ 301 et seq .  There are also numerous federal laws dealing with the safety of various agricultural products.  See , e.g ., 21 USC §§ 451 et seq . (relating to poultry inspection and safety); and 21 USC §§ 601 et seq . (relating to meat inspection and safety).  In addition, there are various state laws to ensure the safety of consumer goods and services.  See , e . g ., California Sherman Act, Cal. Health & Safety Code § 109875 et seq . (California’s version of the FDCA, establishing parallel state regulation of the safety of food, drugs, medical devices and cosmetics); 16 Tex. Admin.  Code §§ 82.1 et seq . (relating to barber shop regulations); and id . §§ 83.1 et seq . (relating to cosmetology regulations). State and federal laws also affect safety through labelling and disclosure requirements.  For example, California Proposition 65 provides that “[n]o person in the course of doing business shall knowingly and intentionally expose any individual to a chemical known to the state to cause cancer or reproductive toxicity without first giving clear and reasonable warning to such individual”.  Cal. Health & Safety Code § 25249.6.  Many states also recognise relevant common law claims, including, for example, product liability and negligence. 2.2        Please outline the substantive tests for these protections. The substantive tests vary depending on the goods or services, as well as the regulations or guidelines at issue.  Under the UCC, if the seller makes any promise or provides a description or model relating to the goods, the goods must conform.   See UCC § 2-313.  The goods must also: “pass without objection in the trade”; “in the case of fungible goods, [be] of fair average quality”; be “fit for the ordinary purposes”; “run, within the variations permitted by the agreement”; be “adequately contained, packaged, and labelled”; and “conform to the promise or affirmations of fact made on the container or label if any”.  Id . § 2-314(2).  Furthermore, if the seller had reason to know the buyer was acquiring the goods for a particular purpose, the goods must be fit for that purpose.  See id . § 2-315.  Other state law substantive tests vary by jurisdiction. For safety, the substantive tests vary depending on the governing law or regulation and range from specific to broad.  For example, the CPSC broadly prohibits the sale of consumer products that contain a defect which could create a substantial product hazard and products that create an unreasonable risk of serious injury or death.  However, there are also very specific requirements for some products.  For example, it is deemed a substantial hazard for “[c]hildren’s upper outerwear in sizes 2T to 16” to “hav[e] one or more drawstrings”.  16 CFR § 1120.3(b)(1).  The related “standard prohibits drawstrings at the hood and neck area of children’s upper outerwear” and imposes specific limitations on the use of drawstrings in the waist or bottom of children’s upper outerwear.  See (Hyperlink) 2.3        What types of goods and services are covered by the protections? All goods and services sold to the American public for individual use are subject to state and federal laws which regulate their transparency, fitness for sale, and potential for fraud.  The types of legal protections afforded depend on the good or service and the source of protection.  For example, the UCC applies to commercial goods.  See UCC § 2-102.  The FDA promulgates Current Good Manufacturing Practice regulations for the quality of drug products.  See 21 CFR Part 210; 21 CFR Part 211.  The USDA sets quality standards for various agricultural products including meat, eggs, fruits, and vegetables.  See , e.g. , 21 USC § 606 (relating to the inspection of meat products). Regarding consumer safety, the blend of federal, state, and local laws, regulations, guidelines, and ordinances covers a wide range of consumer products and services.  Together with the availability of common law claims, few if any consumer products or services escape safety protections. 2.4        Are there any exceptions to these protections? Exceptions are sometimes available and vary by law or regulation.  For example, the UCC generally applies to all commercial sales of goods, but parties may contractually modify the protections available to businesses.  See , e.g. , UCC § 2-316 (relating to the exclusion or modification of warranties).  As set forth in question 2.3, few if any consumer products or services are excluded altogether from safety protections. 2.5        What remedies are available for a breach of the protections in relation to the quality, function and safety of goods and services? If a breach of these protections involves a product defect or risk of a safety hazard to consumers, the remedies can involve enforcement by a federal or state regulatory agency.  For example, when a defective product regulated by the FDA has entered the marketplace, the agency can issue a recall.  See , e.g. , 21 USC § 3501.  Similarly, the USDA has authority to detain and seize defective products for which it has regulatory authority.  See id . §§ 672–73.  Violations of FDA or USDA regulations may also result in criminal or civil penalties.  See , e.g. , id . §§ 333 & 335b.  Under the UCC, “[t]he measure of damages for breach of warranty is the difference at the time and place of acceptance between the value of the goods accepted and the value they would have had if they had been as warranted”.  UCC § 2-714(2).  At common law, remedies may include replacement of the defective product, damages, or contractually agreed-to liquidated damages, in circumstances where damages are difficult to calculate. Individuals may also pursue monetary and injunctive relief in states that provide a private right of action.  For example, California’s CLRA authorises private civil actions against companies that use “unfair methods of competition and unfair or deceptive acts or practices”, including “[r]epresenting that goods or services are of a particular standard, quality, or grade […] if they are of another”.  Cal. Civil Code. § 1770(a)(7).  Remedies available under the CLRA are wide-ranging, and include monetary damages, punitive damages, restitution, and injunction, as well as attorneys’ fees.  Id . at § 1780(a).  Consumer-plaintiffs often bring parallel claims under California’s Unfair Competition Law (“UCL”), which offers similar protections against deceptive business practices.  Under the UCL “the primary form of relief available […] to protect consumers from unfair business practices is an injunction”.  In re: Tobacco II Cases , 46 Cal. 4th 298, 319, 93 Cal. Rptr. 3d 559, 575 (2009).  Under the UCL and CLRA, as well as California’s False Advertising Law (“FAL”), consumers may also pursue public injunctive relief, which has the primary purpose and effect of stopping unlawful acts that threaten the general public.  McGill v. Citibank, N.A ., 2 Cal. 5th 945, 955, 216 Cal. Rptr. 3d 627, 633 (2017). For safety violations, remedies include product recalls or seizures and civil or criminal penalties.  Individuals may also seek injunctive relief and/or compensatory and punitive damages through a private civil action (individual or class action). 2.6        Who has or which agencies have standing to initiate proceedings for a breach? If a breach of the protections in relation to the quality or function of goods involves a product defect or risk of a safety hazard to consumers, then various federal and state agencies may have the authority to initiate proceedings for the breach.  For example, under certain circumstances, the CPSC, FDA and USDA have authority to request (and in some cases, mandate) the removal of defective products from the marketplace.  In addition, these agencies may coordinate with the Department of Justice (“DOJ”) to bring enforcement actions which may result in civil or criminal penalties.  The USDA’s Food Safety Inspection Service may also bring an enforcement action that results in a food establishment’s loss of ability to produce, sell, or distribute its products in commerce.  See 9 CFR § 500.6.  For breaches of warranty under the UCC or common law, the injured party may bring a civil action to seek damages or injunctive relief.  Individual consumers may also initiate individual or class action proceedings for a breach of state statutory or common law duties. 2.7        Describe at least two examples of public or private enforcement of these protections in the last five years, including the conduct/alleged conduct, result and penalties imposed. Public and private enforcement relating to product quality and function has been active over the past five years. On the federal level, the FTC has targeted deceptive user interface designs and hidden fees. These practices are known as “dark patterns” and “junk fees”, respectively.  In September 2025, the FTC secured a landmark $2.5 billion settlement with Amazon.com, Inc. after alleging that Amazon used sophisticated dark patterns to trick consumers into enrolling in automatically renewing Prime subscriptions without informed consent and made cancellation unduly difficult.  The settlement enjoins Amazon from employing these practices, including the use of misleading prompts such as “No, I don’t want Free Shipping”.  See (Hyperlink) At the state level, in early 2025, the Connecticut AG obtained a $1.5 million judgment against Carvana LLC, an online car dealer, resolving claims that Carvana delayed sending title documents to buyers, failed to advance timely payments to sellers, and provided poor customer service.  The complaint alleged deceptive and wilful unfairness under the Connecticut Unfair Trade Practices Act.  The judgment requires Carvana to comply with state title and registration requirements, strengthen customer service systems, and use “best efforts” to accurately describe specific features of the automobiles it sells.  See State of Conn. v. Carvana LLC (No. HHD-CV25-6196604-S) (Conn. Superior Court, Hartford Judicial District).  In an example of successful private enforcement, in late 2024, consumers achieved a $9.2 million class action settlement to resolve claims involving Dr. Dennis Gross brand skin care products advertised as containing collagen when they did not contain collagen.  This is one of the largest false advertising settlements ever in the skincare industry, providing consumers with nearly full restitution, up to $380 per consumer.  The company also agreed to no longer sell products labelled as “+ collagen” unless they in fact contained collagen, relief that will benefit consumers worldwide.  See Kandel, et al., v. Dr. Dennis Gross Skincare, LLC (No. 1:23-cv-01967-ER) (S.D.N.Y.). Product-safety enforcement has been similarly robust. For example, in early 2025, Fitbit agreed to pay $12.25 million to resolve CPSC’s allegations that it failed to promptly report that its popular smartwatch products frequently overheated and severely burned some consumers.  In a statement following resolution of these claims, the CPSC emphasised its commitment to holding companies responsible for continuing to sell dangerous products despite knowing these products can cause serious injury or death.  In addition to the financial penalty, Fitbit must maintain internal controls and procedures to ensure the company complies with the CPSA. Private litigation has also targeted safety issues.  In In re: Procter & Gamble Aerosol Products Marketing & Sales Practices Litigation , consumers alleged that various aerosol personal care products were contaminated with benzene, a known carcinogen, and that P&G failed to properly disclose the risk to consumers.  The parties reached an $8 million settlement to resolve the allegations, providing monetary payment to consumers based on the number of products they purchased.  P&G also agreed to buttress its health and safety practices by implementing material testing, “finished product” testing, and other measures to monitor for benzene contamination in the future.  See In re: Procter & Gamble Aerosol Products Marketing & Sales Practices Litigation , No. 2:22-MD-03025 (S.D. Ohio).  Another high-profile example of private enforcement is a consumer class action recently filed against Apple, alleging that the Apple Watch Sport Band products contain perfluorohexanoic acid, a toxic perfluoroalkyl and polyfluoroalkyl substance (“PFAS”), in hazardous amounts that substantially exceed Apple’s own internal standards and other thresholds for safety by 40.8 times.  See Cavalier et al. v. Apple Inc. , No. 5:2025-cv-00713 (N.D. Cal.).  Apple has moved to dismiss the action, and the court has not yet ruled.  Finally, in January 2026, a federal court certified a Rule 23(b)(3) class in mass litigation alleging that 9Lives, Kibbles ‘n Bits, and Meow Mix misled consumers by marketing their products as healthful despite containing titanium dioxide and packaging that contained, or risked containing, PFAS.  See Jeruchim v. J.M. Smucker Co. , No. 22-cv-06913-WHO, 2026 U.S. Dist. LEXIS 12228 (N.D. Cal. Jan. 22, 2026).  The court’s strong certification order may help pave the way for class certification in the Apple PFAS matter and other PFAS-related cases still in earlier stages. 3. Prohibitions Relating to “Conduct” Against Consumers 3.1        Please describe any protections/prohibitions relating to the conduct of persons or businesses (e.g., manufacturers/retailers) which sell or supply goods and services to consumers (“Conduct”). For example, misleading and deceptive Conduct, unconscionable Conduct, etc. The most generally applicable federal consumer protection statute regulating conduct in the United States is the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce”.  15 USC § 45(a)(1).  The federal Lanham Act also contemplates civil lawsuits for false advertising that “misrepresents the nature, characteristics, qualities, or geographic origin” of goods or services.  15 USC § 1125(a)(1)(B).  Most states have adopted statutes that prohibit unfair or deceptive business and debt-collection practices.  For example, California has three statutes prohibiting unfair or deceptive business practices: the CLRA, which streamlines class certification and provides for both legal and equitable relief; as well as the UCL and FAL, which limit available remedies to injunctive relief and restitution. 3.2        Please outline the substantive tests for the above-mentioned protections/prohibitions. Under federal law, a deceptive practice is one that “misleads the consumer acting reasonably in the circumstances, to the consumer’s detriment”.  See FTC’s Policy Statement on Deception (1983), (Hyperlink) .  A practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition”.  15 USC § 45(n). The FTC also has the authority to promulgate Rules under the FTC Act that specify particular acts or practices that are unfair or deceptive.  In some cases, Congress directs the FTC to promulgate a specific Rule.  Selected Rules enforced by the FTC include the following: the Business Opportunity Rule imposes disclosure requirements for business opportunity sellers to prospective buyers, in order to provide buyers with sufficient information to assess the risks of a business opportunity; the CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing Act) Rule defines the criteria for ascertaining the “primary purpose” of a commercial e-mail, requiring warning labels on commercial e-mails that have sexually explicit material and prohibiting charging a fee and other opt-out barriers; the COPPA Rule implements COPPA by imposing rules on operators of websites and online services that either have actual knowledge that they collect information on children under 13 on their services or are directed to children under 13; the Franchise Rule requires franchisors to provide specific disclosures to franchisees, so they have sufficient information to properly make an investment in a franchise; the Health Breach Notification Rule requires vendors of personal health records and related entities to notify consumers after a breach involving unsecured information, with specific requirements for timing, method and the content of the notification; and the Made in USA Rule states that marketers making unqualified claims that their products are made in the United States should be able to prove those claims. Analogous state law claims such as the California statutes described in question 3.1 employ a “reasonable consumer” test that evaluates false and misleading business practices from the vantage of an ordinary consumer.  See , e.g. , Williams v. Gerber Prods. Co. , 523 F.3d 934, 938 (9th Cir. 2008). 3.3        What types of goods and services are covered by these protections/prohibitions? Is the payment of a price for these goods/services always required for their enforceability? The FTC Act covers all goods and services “in or affecting commerce”, 15 USC § 45(a)(2); most state protections against unfair or deceptive practices also apply broadly across the spectrum of commercial goods and services.  Payment of a price for goods or services is not always required for enforceability under state law.  California’s UCL, for example, provides a private right of action for corporate entities to sue their business competitors for unfair or deceptive practices.  While the plaintiff corporation must demonstrate economic loss to its business caused by the defendant company’s unfair or deceptive practices, it need not have tendered money directly for goods or services offered by the defendant. 3.4        Are there any exceptions/exemptions to the protections/prohibitions relating to Conduct? The FTC Act does not apply to banks, savings and loan institutions, federal credit unions, common carriers, or non-profit entities, among others.  See 15 USC § 45(a)(2). 3.5        What remedies are available for a breach of the protections/prohibitions relating to Conduct? At the federal level, unfair or deceptive acts or practices proscribed under § 18(a)(1)(B) of the FTC Act are subject to a statutory civil penalty of $50,120 per violation if the FTC can demonstrate (1) the perpetrator of the unfair or deceptive practices had actual knowledge that their conduct was in violation of the FTC Act, and (2) the FTC had already issued a written decision that such conduct was unfair or deceptive.  Additionally, many state consumer protection laws provide remedies for victims of false and deceptive conduct, including statutory damages, restitution, and injunction relief.  Typically, these lawsuits proceed as class actions. 3.6        List at least two examples of public or private enforcement of the protections relating to Conduct in the last five years, including the breach/alleged breach, result and penalties imposed. Public and private enforcement over the past five years reflects the breadth of conduct targeted, as well as significant penalties imposed.  In September 2025, Amazon reached a $2.5 billion settlement with the FTC to resolve claims that it violated the Restore Online Shoppers’ Confidence Act by failing to (i) clearly disclose Prime subscription terms, (ii) obtain informed consent from customers before charging them, and (iii) offer a simple mechanism for cancellation.  Under the settlement, Amazon will pay a $1 billion civil penalty and issue $1.5 billion in refunds to approximately 35 million affected consumers.  The civil penalty is the highest ever assessed in a case involving an FTC rule violation, and the refund amount is the second-highest restitution award for a commission action. Another major example of public enforcement occurred in December 2025, when Maplebear Inc. (Instacart) agreed to a $60 million settlement with the FTC related to allegations that it deceptively advertised “free delivery” on first orders while charging a service fee and failed to clearly disclose subscription terms.  The settlement requires Instacart to stop misrepresenting delivery costs and to clearly disclose any restrictions on its money-back guarantees, along with other forward-looking measures to increase transparency for consumers. State regulators have also been active.  In January 2026, the California Department of Financial Protection and Innovation imposed a $500,000 penalty on crypto-backed loan company Nexo Capital Inc. to resolve claims it failed to obtain a valid licence while making high-risk loans to California consumers, and for overcollateralising loans to California borrowers.  The settlement also requires Nexo to transfer all funds belonging to California residents to a properly licensed entity. Private enforcement has produced substantial results as well.  In April 2023, a federal court in New York granted final approval of a $7.8 million settlement, the highest ever settlement for a false advertising claim concerning preservatives.  The settlement resolved claims that Celsius falsely advertised its popular drink products as having “no preservatives” despite the presence of citric acid.  Class members received reimbursements of up to $250, and the Company agreed to remove the challenged label claim.  Hezi, et al. v. Celsius Holdings Inc ., No. 1:21-CV-9892-VM (S.D.N.Y.).  In October 2024, consumers secured a $9.2 million settlement, resolving claims that Dr. Dennis Gross brand skincare products were falsely advertised as containing collagen when they did not.  One of the largest ever false advertising settlements in the skincare industry, it provided  consumers with nearly full restitution, up to $380 per person.  The company also agreed to no longer use the “+Collagen” labelling unless the products actually contain collagen.  Kandel, et al., v. Dr. Dennis Gross Skincare LLC , No. 1:23-cv-01967-ER (S.D.N.Y.). 4. Specific Applications of the Rules and Protections 4.1        How do the rules and protections apply in relation to online marketplaces? Consumer protection regulation is increasingly focused on online marketplaces as consumers spend more time and money online.  As discussed in question 2.7, “junk fees” in online marketplaces are increasingly subject to public and private enforcement actions.  Similarly, undisclosed auto-renewal provisions and predatory “dark patterns” (digital design tricks designed to encourage consumer purchases or data sharing without consumer awareness) are targets of enforcement actions and new legislation. 4.2        How do the rules and protections apply in relation to social media? Consumer protection law plays a central role in combatting the harms perpetuated by social media.  Regulators and private plaintiffs increasingly pursue claims involving predatory and illegal data tracking and sharing, undisclosed paid advertising content, and design choices that drive consumer addiction.  As of early 2026, multiple state and federal actions allege that major platforms intentionally engineered addictive features, such as infinite scroll, autoplay and reward systems, to keep children habitually engaged in ways that harm their mental health, in violation of consumer protection laws.  See, e.g ., Social Media Cases , No. JCCP5255 (L.A.S.C.). The intersection of AI and social media is another emerging focus.  For example, in early 2026, the California AG announced an investigation into widespread reports of non-consensual, sexually explicit “deepfakes” images used to harass women online.  The reports involve Grok, the chatbot developed by Elon Musk’s company xAI, Inc. and widely used on X (formerly Twitter). 4.3        How do the rules and protections apply to pricing practices? State and federal regulators are adapting to companies’ predatory pricing schemes with the initiation of new laws targeting deceptive practices.  In 2024, California’s “Honest Pricing  Law” went into effect, a price transparency law that makes it illegal for businesses to advertise a price for a good or service that does not include all associated fees or charges (with the exception of certain taxes and shipping costs).  Additionally, in 2025, the FTC engaged the Rule on Unfair or Deceptive Fees, which prohibits bait-and-switch pricing and other tactics used to hide total prides and mislead people about fees, particularly in the live-event ticketing and short-term lodging industries.  The FTC has also been increasingly focused on policing the predatory tactic of “strikethrough pricing”, which creates a false sense of urgency for consumers who are baited by a supposedly limited-time discount. 4.4        How do the rules and protections apply to dark patterns or online choice? As noted in question 4.1, the counteraction of “dark patterns” is a critical goal of enforcement agencies and private litigants in combatting fraud in the online marketplace.  The FTC recently issued guidance titled “Bringing Dark Patters to Light”, which explains the deceptive nature of these predatory psychological tricks and provides recommendations for businesses to avoid deceptive tactics.  State regulators, including California and Connecticut, have likewise focused on the abatement of dark patterns as critical to enforcement of their respective state privacy regimes.  4.5        How do the rules and protections apply in relation to green claims? A growing number of consumers are looking to buy environmentally friendly, “green” products, whether designated as “natural”, “non-toxic”, “sustainable”, “compostable”, or otherwise.  Many companies have responded to the demand not by improving their products, but by “greenwashing” – using labels or advertising that overstate or misrepresent environmental benefits.  To guide marketers and prevent deception, the FTC developed the Green Guides, which detail general principles for environmental claims, how consumers interpret “green” claims, and what substantiation or qualification is required.  Some states, like California, have specifically incorporated the Green Guides into their consumer protection laws.  In an example of successful private enforcement, in 2024, consumers settled class action claims against the manufacturers of ChapStick products that were labelled as “100% Natural” or made with “100% Naturally Sourced Ingredients”, despite containing various synthetic ingredients. The settlement requires GlaxoSmithKline and Pfizer to cease using these claims unless accurate, providing forward-looking relief that benefits consumers nationwide.  See Moore v. GlaxoSmithKline Consumer Healthcare Holdings (US) LLC et al. (No. 4:20-cv09077) (N.D. Cal.). 4.6        How do the rules and protection apply in relation to consumer representations? The consumer protection rules and regulations are squarely aimed at false and deceptive representations.  These protections apply across marketplaces, including in-store and online purchases.  These laws generally apply to representations that are false or misleading, rendering many statements actionable even if a company can make an argument of literal truth – so long as a statement has the tendency or likelihood to mislead the general public, the statement may be in violation of consumer protection laws. 4.7        How do the rules and protection apply in relation to scams? Scams are another primary focus of the consumer protection regulatory scheme.  As a result of increasing cryptocurrency scams, the Federal Bureau of Investigation, the DOJ, and D.C. federal prosecutors launched a joint task force in late 2025, the Scam Center Strike Force.  The task force’s “Crypto Seizure Team” has already seized more than $400 million in cryptocurrency.  State regulators are likewise focused on cryptocurrency scams.  For example, the Massachusetts AG filed suit against Bitcoin Depot in early 2026 alleging that the company, which operates ATMs where consumers can exchange cash for cryptocurrency, is aware that scammers use its kiosks to move money and defraud victims, but chooses to ignore the activity in furtherance of profits.  See Commonwealth v. Bitcoin Depot Inc. (No. 2684CV00328) (Suffolk County Superior Court). 5. Other Protections/Prohibitions 5.1        Does consumer law in your jurisdiction have any other prohibitions/protections not covered by the questions above? If so, please describe these prohibitions/protections. In addition to the federal consumer protection laws discussed above, state and local governments regulate consumer protection in a variety of ways, ranging from false advertising law, to unfair business practice regulation, to food safety requirements for local restaurants, to product labelling, privacy, biometrics and AI.  For example, many local health departments conduct restaurant inspections to ensure compliance with food safety requirements.  Another prominent example is California Proposition 65, which requires warnings for products with certain chemicals known to cause cancer or reproductive harm. Due to the growing concern over corporate abuse of consumer data, states are increasingly enacting data privacy regulations.  Illinois enacted the BIPA, which institutes collection, use and sharing limits for companies that handle the biometric information of Illinois residents.  The CCPA and the California Privacy Rights Act (“CPRA”) impose a range of protective measures for consumers.  Other important state privacy laws include: the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act (“CPA”), which was recently amended to safeguard geolocation data and require consent for resale of sensitive consumer information; the Utah Consumer Privacy Act (“UCPA”); the New Jersey Data Protection Act (“NJDPA”); and the Oregon Consumer Privacy Act (“OCPA”), which was recently updated to further safeguard the sale and processing of personal data if such data belongs to a consumer under the age of 16.  Given their importance to companies carrying out business in the United States, the remainder of this section will focus on these requirements.  California also recently enacted the Genetic Information Privacy Act, following in the footsteps of Illinois’ BIPA, which protects consumers’ genetic information from misuse and unauthorised disclosure. Additionally, states are increasingly focused on regulating AI. Colorado became the first state to enact comprehensive AI regulation with the passing of the Colorado Artificial Intelligence Act in May 2024, which focused on preventative protections for consumers from algorithmic discrimination.  Other states are beginning follow suit.  For example, the Texas Responsible Artificial Intelligence Governance Act (“TRAIGA”) went into effect on January 1, 2026, affording similar AI-focused protections. 5.2        Please outline the substantive tests for the above-mentioned protections/prohibitions. Several examples follow.  In California, the CCPA (as amended by the CPRA) applies to for-profit businesses that collect personal information from or about Californians and either: (1) have a gross annual revenue over $25 million; (2) buy, sell, or share personal information of 100,000 or more consumers or households; or (3) derive 50% or more of their annual revenue from selling California residents’ personal information.  Under the updated law, consumers have new rights, including the right to correct personal information that a business has shared about them and the right to limit the disclosure of sensitive personal information collected about them. California’s data privacy laws contain a limited private right of action for certain data breaches and are otherwise enforced by the state AG and California Privacy Protection Agency.  In contrast, the below states’ statutory protections do not afford individuals a private right of action, though many states’ attorneys general welcome consumer reports regarding potential violations. In Virginia, the VCDPA applies to persons that conduct business in Virginia or offer products or services targeted to residents in Virginia and: (1) control or process the data of at least 100,000 consumers; or (2) control or process the personal data of at least 25,000 consumers and derive more than 50% of their revenue from the sale of personal data.  The scope of Colorado’s law is very similar to Virginia’s, however, it only applies to data controllers, not data processors (although it defines data controllers more broadly). In Utah, the UCPA applies to controllers and processors that: (1) conduct business in Utah or produce a product or service targeted to consumers who are Utah residents; (2) have an annual revenue of $25 million or more; and (3) meet at least one of the following thresholds: (i) during a calendar year, control or process the personal data of 100,000 or more consumers; or (ii) derive over 50% of the entity’s gross revenue from the sale of personal data and control or process personal data of 25,000 or more consumers.  This renders the UCPA narrower than other state privacy laws. In New Jersey, the NJDPA requires companies to provide clear privacy notices and implement adequate mechanisms for consumers to exercise their rights.  To evaluate high-risk data activities, like targeted advertising or profiling, organisations must also conduct data protection assessments to evaluate potential harm to consumers.  The NJPDA applies to any business or organisation processing personal data of 100,000+ residents, or anytime revenue is derived from selling the data of 25,000+ residents. 5.3        Are there any exceptions/exemptions? Certain states’ data privacy laws apply only to for-profit businesses (e.g., California, Virginia), while others apply more generally, including to entities such as nonprofits (e.g., New Jersey, Oregon).  The laws also typically exempt entities that are subject to certain federal laws described above, such as the Health Insurance Portability and Accountability Act (“HIPAA”), the GLB Act and the FCRA.  Notably, non-HIPAA health apps (e.g., fitness, fertility apps) are not exempt and are increasingly targets of enforcement activity.  California offered an initial exemption for employee and business-to-business commercial information, though it expired in December 2022. 5.4        What remedies are available for a breach of these protections? In many states, only the AG can issue penalties.  However, some states, like California, provide for a private right of action.  Across states, civil penalties can range from $2,663 for a one-time unintentional violation of the CCPA to up to $20,000 for a single violation of Colorado’s privacy law. 5.5        List at least two examples of public or private enforcement of these protections in the last five years, including the breach/alleged breach, result and penalties imposed. In early 2026, a federal judge in California granted final approval of a $30 million settlement resolving consumer claims that Google and YouTube illegally collected children’s data for targeted resale.  Of note, the settlement followed an important appellate decision holding that the plaintiffs’ state privacy claims were not preempted by the federal COPPA.  See Hubbard v. Google LLC (No. 5:19-cv-07016) (N.D. Cal.). In another example of successful private enforcement, in late 2025, an Illinois federal judge granted final approval of a $12.1 million settlement in a BIPA class action against gas station chain Speedway LLC.  More than 7,000 current and former employees alleged that the company collected and shared their fingerprint data through a time-clock system without proper consent.  See Howe v. Speedway LLC (No. 1:19-cv-01374) (N.D. Il.). In late 2024, the California Privacy Protection Agency announced an investigative sweep focused on data brokers’ compliance with the registry requirements of the state’s Delete Act, which imposes registry requirements and data deletion and disclosure obligations on data brokers.  Since then, the Agency has brought at least nine enforcement actions.  Most recently, in early 2026, it announced a $45,000 fine levied against Datamasters, a marketing firm that compiles and redistributes lists of people with serious health conditions (Alzheimer’s disease, drug addiction, bladder incontinence, etc.).  In addition to the financial penalty, Datamasters must also stop selling the personal information of California residents, effectively removing the company from the state marketplace. In an example of non-monetary, pre-litigation enforcement, in January 2026, General Motors and OnStar entered into a consent agreement with the FTC to resolve allegations that the companies failed to obtain drivers’ consent before sharing geolocation and driver behaviour data with consumer reporting agencies.  The final order imposes a five-year ban on General Motors and OnStar’s ability to disclose sensitive consumer data to consumer reporting agencies.  It also imposes a 20-year requirement to obtain express consent before collection, using, or sharing connected vehicle data (with exceptions for emergency responders). 6. Investigation of Potential Breaches 6.1        What powers does/do the consumer authority/authorities in your jurisdiction have to investigate potential breaches of consumer law? Describe the key steps in a typical investigation. The FTC has the power “[t]o gather and compile information concerning, and to investigate from time to time the organization, business, conduct, practices, and management of any person, partnership, or corporation engaged in or whose business affects commerce”.  15 USC § 46(a).  The FTC is increasingly using investigational hearings and compulsory investigations against AI related issues, such as algorithmic discrimination, AI-generated deception, and impersonation fraud.  For example, in 2025, the FTC launched an inquiry into AI chatbots acting as companions, including: Alphabet, Inc.; Character Technologies, Inc.; Instagram, LLC; Meta Platforms, Inc.; OpenAI OpCo, LLC; Snap, Inc.; and X.AI Corp.  The FTC is interested in particular on the impact of these chatbots on children and what actions companies are taking to mitigate potential negative impacts, limit or restrict children’s or teens’ use of these platforms, and comply with the COPPA Rule.  As part of its inquiry, the FTC sought information about how the companies: monetise user engagement; process user inputs and generate outputs in response to user inquiries; develop and approve characters; measure, test, and monitor for negative impacts before and after deployment; mitigate negative impacts, particularly to children; employ disclosures, advertising, and other representations to inform users and parents about features, capabilities, the intended audience, potential negative impacts, and data collection and handling practices; monitor and enforce compliance with company rules and terms of services (e.g., community guidelines and age restrictions); and use or share personal information obtained through users’ conversations with the chatbots.  In 2025, the FTC also signalled that it would use existing federal law to address algorithmic discrimination in automated decision-making services regarding hiring, lending, and tenant screening. The FTC also has the “power to require by subpoena the attendance and testimony of witnesses and the production of all such documentary evidence relating to any matter under investigation”, also known as a Civil Investigative Demand (“CID”).  Id . § 49.  An FTC investigation typically begins when the FTC sends a CID to an investigative target.  The CID does not require approval by the Commission as a whole; rather, at least one Commissioner signs off on the issuance of the CID.  The target may have a meet-and-confer with the staff designated on the CID to attempt to negotiate the scope of the CID.  The target may file a motion to quash within 20 days, which is initially ruled on by a single Commissioner and may be appealed to the FTC.  16 CFR § 2.10.  The CID usually requests documents, testimony, and in many cases, particularly more recently, investigational hearings, which are similar to depositions.  See 16 CFR § 2.7.  At the conclusion of the investigation, staff will either recommend closing the investigation or the filing of a complaint.  If staff recommend a complaint, the FTC can grant a period of time for the staff to negotiate a settlement.  If a matter is still not resolved, the FTC has the option of filing a complaint in an administrative forum before an administrative law judge (“ALJ”) or directly in federal court. State attorneys general also use investigative tools and multistate coalitions, including CIDs and formal inquiries, to mitigate AI-related harms, such as algorithmic bias, deception, and fraud.  For example, Texas AG Ken Paxton opened an investigation into AI chatbot platforms, including Meta AI Studio and Character.AI, for potentially engaging in deceptive trade practices and misleadingly marketing themselves as mental health tools.  Similarly, New York AG Letitia James and a bipartisan coalition of 41 attorneys general from other states sent a letter to 13 Big Tech companies, including Meta, Microsoft, and OpenAI, urging them to implement safeguards on AI chatbots to protect children and vulnerable people. 6.2        How is an investigation triggered (e.g., ex officio , whistleblower or complaint)? Investigations may be triggered in various ways – through consumer complaints, information provided by an internal whistleblower, press articles, Congressional referrals, social media posts, or the initiative of a Commission employee.  Sometimes, the FTC “sweeps” an entire industry to ensure compliance with the law. 6.3        Describe any complaints procedure for (i) consumers, and (ii) businesses. The FTC encourages consumers to file a complaint whenever they have been the victim of fraud, identity theft, or other unfair or deceptive business practices.  Consumers can file complaints online at (Hyperlink) or by calling 1-877-FTC-HELP.  The FTC is actively encouraging consumers to report AI-powered scams.  In addition to the FTC’s standard reporting mechanism, the FTC maintains a separate reporting mechanism for “misconduct by technology platforms”.  Consumer organisations or other advocacy groups often also file complaints or petitions with the FTC.  Consumer groups have filed complaints with the FTC alleging unfair or deceptive practices with respect to, for example, Facebook’s facial recognition practices, Instagram influencers’ failure to disclose that they were being paid for endorsements, and companies’ allegedly unfair practices with respect to scoring individuals for employment and other purposes.  These complaints are often sent to the FTC’s Office of Secretary and Commissioners’ offices.  Businesses can also file complaints with the FTC through these same channels.  Another path for business complaints is through a self-regulatory organisation such as the Better Business Bureau National Programs (“BBBNP”).  When a business files a complaint about a competitor’s advertisement with the Better Business Bureau (“BBB”), it has specialised procedures to resolve these issues.  If it finds that an advertisement violates its guidelines, and the Company declines to remedy the violation, the BBB can refer the matter to the FTC for enforcement.  As one example, the Children’s Advertising Review Unit, a subdivision of the BBBNP, referred the company Musical.ly (predecessor to TikTok) to the FTC for allegedly violating COPPA, and the FTC subsequently brought an enforcement action. 6.4        What is the timeline for a typical investigation? A typical FTC investigation will take at least one year, and often longer. 6.5        Are there criminal penalties for non-compliance with a consumer law investigation? If so, provide examples where such penalties have been imposed. Usually, the FTC does not have the authority to seek criminal penalties.  However, the FTC’s Criminal Liaison Unit assists prosecutors with criminal consumer fraud cases, often by sharing evidence of knowledge of fraud that is developed through the FTC’s civil investigations.  In 2021, prosecutors who partnered with the FTC obtained 30 convictions or guilty pleas in new or pending cases.  See (Hyperlink) .  As one example of civil and criminal cooperation, in 2017 the FTC and DOJ jointly brought civil and criminal charges, respectively, against Western Union alleging consumer fraud, aiding and abetting wire fraud, and failing to have an effective anti-money laundering programme.  Western Union entered a global settlement that included a $586 million judgment, a permanent injunction and a deferred prosecution agreement.  More recently, in 2025, the FTC and DOJ weighed in on the applicability of antitrust laws to environmental, social, and governance initiatives by filing a Statement of Interest in a multistate antitrust case against asset managers BlackRock, State Street, and Vanguard, a case led by Texas AG Ken Paxton.  The FTC has also recently included in their 2025 antitrust guidelines, jointly released with the DOJ, that no-poach agreements and wage fixing could lead to criminal charges against both individuals and companies. 6.6        Can investigations be resolved by way of commitments or undertakings? Yes, and this is typical.  FTC investigations are usually resolved by a consent order.  Violations of administrative consent orders subject defendants to civil penalties.  15 USC § 45(l).  Violation of federal orders can lead to remedies within a judge’s discretion, including contempt of court. 7. Enforcement 7.1        How does/do the consumer authority/authorities seek to enforce consumer law (e.g., by administrative decision or by commencing proceedings in court)? Enforcement by the FTC may be achieved through administrative action, judicial action, or both. 7.2        Is/are the consumer protection authority/authorities bound by a time limit to commence proceedings on breaches? There is no statute of limitations when the FTC seeks an injunction in connection with ongoing conduct.  There is a five-year statute of limitations for seeking civil penalties, 28 USC § 2462, and a three-year statute of limitations for redress that the Commission would seek in connection with a rule violation.  15 USC § 57b(d). 7.3        Where regulators/enforcement bodies have a choice of enforcement tools/powers, what considerations do they take into account in determining which tools/powers to use? The FTC’s choice of administrative or federal court largely depends on the types of remedies it is seeking.  If the FTC is seeking civil penalties, it must work with the DOJ or another federal agency with direct authority to litigate civil penalties in federal court, such as the CFPB.  Civil penalties are not available in an administrative proceeding.  If the FTC is seeking disgorgement or restitution and the case involves the violation of an FTC Rule, the FTC is entitled to this relief in federal district court directly.  If the FTC is seeking disgorgement or restitution in other matters, it would have to allege that the law violation was “dishonest or fraudulent”, and would first have to file an administrative action before being able to seek disgorgement or restitution.  For purely injunctive relief, the FTC often files actions administratively because any violation of the administrative action would subject defendants to civil penalties. 7.4        Describe the relevant rules and procedures that must be followed by such bodies (e.g., administrative, judicial). In the administrative forum, the ALJ presides over adjudications with broad power to compel testimony from parties and non-parties alike.  These powers include issuing subpoenas, taking depositions or causing them to be taken, compelling admissions, holding settlement conferences, making initial decisions, and holding parties in contempt if they fail to comply with the ALJ’s orders.  16 CFR § 3.42.  In a federal district court, proceedings are governed by the Federal Rules of Civil Procedure, which allow parties to conduct discovery and gather evidence, from both parties and non-parties.  For example, Rule 45 allows for subpoenas that can compel testimony, the production of documents, electronically stored information or other tangible items.  Fed. R. Civ. P. 45(a). 7.5        Is there a right to a stand-alone action and follow-on right of action within consumer law? Who has standing to bring these actions? While there is no private right of action under the FTC Act, some federal consumer laws provide a private right of action.  Many state laws also provide for private rights of action.  For example, California’s FAL empower aggrieved consumers to vindicate their rights in court, and the CCPA provides that “[a]ny consumer whose nonencrypted and nonredacted personal information […] is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action”.  Cal. Civil Code § 1798.150(a)(1).  Plaintiffs can pursue damages and injunctive or declaratory relief.  Id .  Illinois’ BIPA also provides a private right of action.  Individual consumers may also bring state common law claims, such as for negligence, fraud, or product liability. Individual consumers must have standing to enforce violations of these laws.  There are three elements generally required to establish standing: “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.”  Spokeo, Inc. v. Robins , 578 U.S. 330, 338 (2016).  Any injury in fact must also be “concrete and particularized”.  Id . at 339. 7.6        Is there a statute of limitations for bringing stand-alone or follow-on actions? Private actions have statutes of limitations, which vary depending on the specific claim.  Three or four years is typical under state consumer laws. 7.7        Describe how interactions with other regulations and/or regulators are dealt with by the consumer protection authority. In balancing federal and state authority, the historic police powers of the states are not to be superseded by federal law unless that was the clear and manifest purpose of Congress.  See Rice v. Santa Fe Elevator Corp. , 331 U.S. 218, 230 (1947).  Federal law may preempt state law by express provision or by implication through field or conflict preemption.  Several federal consumer statutes prohibit states from imposing new or additional labelling “requirements”.  See, e.g. , 21 USC § 360k(a); 7 USC § 136v(b).  But the statutory language is silent regarding states’ ability to provide remedies for violations of federal law.  Courts have held that this statutory construction does not prevent consumers from claiming relief under state laws for violations of federal standards and their state parallels.  See Astiana v. Hain Celestial Grp., Inc. , 783 F.3d 753, 757 (9th Cir. 2015).  This framework facilitates collective enforcement of state and federal violations by state attorneys general, federal regulatory authorities, as well as aggrieved consumers.  In public actions, state and federal regulators are increasingly partnering to prosecute high-stakes consumer fraud.  In mid-2024, the FTC issued a report detailing the FTC’s law enforcement cooperation with state attorneys general nationwide and presenting best practices to ensure continued effective collaboration regarding consumer fraud.  See (Hyperlink) .  In one example in furtherance of those efforts, in late 2025, 21 states joined the FTC in a California federal lawsuit accusing Uber of enrolling users into its paid Uber One subscription service without consent and imposing obstacles that deter and prevent consumers cancelling the service.  Allegations include violations of both the FTC Act and several state consumer protection laws, reflecting the joint FTC and state attorneys general prosecution efforts.  See Federal Trade Commission v. Uber Technologies Inc . (No. 3:25-cv-03477) (N.D. Cal.). 7.8        Describe any international or regional cooperative mechanisms (e.g., MOUs) in which your jurisdiction is involved in the enforcement of consumer protection. The FTC joins with more than 100 foreign competition and consumer protection authorities around the world and regularly cooperates with foreign authorities on enforcement and policy matters.  Some examples follow. ICPEN: the International Consumer Protection and Enforcement Network is a coalition of mostly government organisations that enforce fair consumer practices and share information and best practices with each other.  These organisations include the FTC and government offices from other countries, such as Germany, Ireland, Italy, Japan and Mexico.  See FTC, “International Consumer Protection and Cooperation” (Hyperlink) GPEN: the Global Privacy Enforcement Network is an informal network of privacy enforcement authorities that work together to facilitate sharing of information and cooperate on cross-border enforcement of laws protecting privacy.  See FTC, “Multilateral Memorandum of Understanding For Participation In the Global Privacy Enforcement Network System” (2015), (Hyperlink) Bilateral agreements: The FTC has entered into at least 22 bilateral cooperation agreements with foreign consumer protection authorities including Australia, Ireland, Mexico, Spain and several Canadian provinces.  See FTC, “International Cooperation Agreements” (Hyperlink) 8. Appeals 8.1        Describe any appeal processes. In FTC administrative enforcement actions, appeals from the ALJ’s “initial decision” to the full Commission are available to either FTC’s “complaint counsel” or any respondent.  In limited cases, including certain merger cases, an appeal from the ALJ’s initial decision is automatic.  See 16 CFR § 3.52.  Upon appeal, the Commission receives briefs, holds oral argument, and thereafter issues its own final decision and order.  The FTC Rules of Practice allow for the filing of amicus briefs in support of either side of the appeal, with leave of the Commission.  For automatic appeals, the Commission places the appeal on its docket and defines the issues to be briefed by the parties.  See 16 CFR § 3.53.  Unlike appeals in state or federal courts, the Commission reviews the ALJ’s entire decision anew, without deference, including the findings of fact.  See 16 CFR § 3.54(b). The Commission’s final decision is then appealable, but only by any respondent against which an order is issued.  The respondent may file a petition for review with any U.S. court of appeals within whose jurisdiction the respondent resides or carries on business or where the challenged practice was used.  15 USC § 45(c).  The case then proceeds from that point along the same path as cases originally filed in the district courts.  Just as a case coming up for appellate review from a federal district court receives some deference from the appellate court, so too does a final Commission decision.  Specifically, the appellate court reviews questions of law de novo but will not disturb factual determinations of the Commission that are supported by substantial evidence.  If the federal Court of Appeals affirms the Commission’s order, the court enters its own order of enforcement.  The party losing in the court of appeal may seek review by the United States Supreme Court, upon petition for a writ of certiorari.  Otherwise, consumers enforcing state law consumer protection claims may appeal through standard civil processes. 8.2        Can consumers or retailers/manufacturers appeal decisions made by the consumer authority/authorities or by a court? Consumers are not parties to enforcement actions and thus do not have appellate rights from enforcement decisions.  As described above in section 1, there is no private right of action under the FTC Act, and such actions can only be brought by the agency.  The FTC and defendant retailers/manufacturers, however, can appeal administrative enforcement decisions as described in response to question 8.1 above. Consumers (and retailers/manufacturers) have full appellate rights in private civil litigation to which they are parties that are originated in state or federal courts and brought under state law like California’s CLRA or UCL or under federal statutes like ECOA, TCPA, FCRA, etc.  Appeals in private litigation follow the normal court appellate rules, whereby only final judgments or orders that dispose of all claims as to all parties are automatically appealable.  Certain interlocutory orders are subject to discretionary appeal, such as class certification orders, orders denying motions to compel arbitration, “collateral” orders (orders on issues unrelated to the merits of the suit), certain kinds of sanctions orders, attorney disqualification orders, etc. 8.3        Does an appeal suspend the effect of any penalty/the requirement to pay any fine (if applicable)? The effects of an appeal vary based on circumstances.  In administrative actions, a party subject to a cease-and-desist order under § 5 of the FTC Act may apply to the Commission for a stay pending judicial review.  See 16 CFR § 3.56(b).  If, within 30 days after the application was received by the Commission, the Commission either has denied or has not acted on the application, a stay may be sought in a court of appeals where a petition for review of the order is pending.  Id .  An application for stay must state the reasons a stay is warranted and the facts relied upon, and must include supporting affidavits or other sworn statements, and a copy of the relevant portions of the record.  The application must also address the likelihood of the applicant’s success on appeal, whether the applicant will suffer irreparable harm if a stay is not granted, the degree of injury to other parties if a stay is granted, and why the stay is in the public interest.  See 16 CFR § 3.56(c). In court actions seeking injunctive relief, monetary damages, and/or penalties, often an appeal will suspend the defendant’s obligation to pay a penalty.  The payment of penalties will generally be stayed on appeal automatically.  In deciding whether to stay an order awarding injunctive relief pending appeal, federal courts engage in a similar exercise as the Commission in an administrative appeal, balancing four factors: “(1) whether the stay applicant has made a strong showing that he is likely to succeed on the merits; (2) whether the applicant will be irreparably injured absent a stay; (3) whether issuance of the stay will substantially injure the other parties interested in the proceeding; and (4) where the public interest lies.” LabMD, Inc. v. FTC , 678 F. App’x 819 (11th Cir. 2016) (citing Nken v. Holder , 556 U.S. 418, 425-26 (2009) (quotation omitted)). 9. Current Trends and Anticipated Reforms 9.1        What are the recent enforcement trends in your jurisdiction and what key trends do you expect in the next 12 months? Children’s data privacy In early 2025, the FTC unanimously moved to strengthen online privacy protections for children in updating the COPPA.  The Commission established requirements for online providers to obtain legitimate parental consent before disclosing personal information from children under 13 to third parties for targeted advertising.  The new protections also advise against the indefinite retention of children’s data.  Children’s privacy issues are expected to remain an ongoing priority for the FTC, and many expect that additional federal legislation will soon follow to further increase protections.  AI and tech Following its promise to safeguard consumers from the prospective harms of AI, the FTC focused many of its recent enforcement actions on AI-driven consumer harms.  Specific focuses included substantiation of AI claims, the safeguarding of personal data in AI systems, and implementing rigorous standards to prevent AI bias and discrimination.  The FTC emphasised the importance of upholding prior promises to consumers, including those about whether personal data would be used to train AI models. In late 2024, the FTC brought an enforcement sweep termed “Operation AI Comply” that targeted misrepresentations relating to the efficacy of various AI providers’ capabilities.  In one example, the FTC halted company DoNotPay’s misleading claims that the AI service could substitute for the expertise of a human lawyer.  Each company targeted by the sweep either settled with the FTC or was issued a temporary restraining order.  DoNotPay agreed to a proposed Commission order requiring a $193,000 payment and issuance of warnings about the limitations of law-related features on the service. Federal lawmakers are also increasingly concerned about the use of AI in healthcare – particularly when used to deny insurance claims in one fell swoop.  See Bicameral, Bipartisan Letter to Centers for Medicare & Medicaid Services (June 25, 2024) (available at (Hyperlink) ) (led by Representatives Jerrold Nadler, Judy Chu, and Senator Elizabeth Warren).  Healthcare companies are utilising AI tools designed to quickly review insurance claims and issue denials at inflated rates.  This saves insurers money by allowing them to employ fewer medical professionals to review claims, and by reducing the benefits paid, at the expense of their insureds’ well-being.  Insurance denials lead to serious health complications, some of which are fatal.  Several private class action lawsuits have been filed on behalf of insured individuals who were denied coverage due to companies’ use of AI, resulting in the delay or loss of necessary medical care.  See, e.g., Kisting Leung v. Cigna , 2:23-cv-01477-DAD-CSK (E.D. Cal. 2025) (declining to dismiss plaintiffs’ claims under 29 USC § 1132(a)(3) and UCL in a case where consumer plaintiffs challenged Cigna’s use of an algorithm called PXDX to review and deny claims for diagnostic procedures, with claims for violations of ERISA and the UCL); Lokken v. UnitedHealth Group , Inc., 23-CV-03514 (JRT/SGE) (D. Minn. 2025) (declining to dismiss plaintiffs’ claims for breach of contract and breach of the implied covenant of good faith and fair dealing in a case challenging UnitedHealthcare’s use of the nH Predict algorithm to review post-acute care claims); Barrows v. Humana, Inc ., 3:23-cv-00654-RGJ (W.D. Ky. 2025) (declining to dismiss plaintiffs’ claims for breach of contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment, and common law fraud in a case challenging Humana’s use of the same nH Predict algorithm). As discussed in question 6.1, the FTC is increasingly relying on investigational hearings and compulsory process in matters involving AI, and state attorneys general issue their own CIDs, sometimes through multistate coalitions (both in general and in AI-related matters).  Litigation is expanding as well.  In February 2026, the nation’s first trial seeking to hold social media companies liable for addicting children began in Los Angeles Superior Court, where thousands of cases are consolidated.  Key executives, including Meta CEO Mark Zuckerberg, are expected to testify.  See Social Media Cases , No. JCCP5255 (L.A. Super. Ct. 2026).  In another example, parents sued OpenAI in August 2025, alleging that ChatGPT encouraged their child to take his own life after the chatbot engaged with him about anxiety, self-harm, and suicide methods.  The case remains in active discovery.  See Raine v. OpenAI, Inc. , No. CGC25628528 (S.F. Super. Ct. 2026). AI-washing The FTC has expressed concern that AI-related marketing claims are often inaccurate, a misleading practice termed “AI-washing”.  Since April 2025, the FTC filed multiple cases alleging that defendants engaged in AI-related deceptive marketing claims, and two of the cases have been resolved – against Workado, LLC and Growth Cave.  In the Workado matter, the company claimed that its AI Content Detector was developed using a wide range of material to make it more accurate for average users; however, the AI model powering the AI Content Detector was trained or fine-tuned to effectively classify only academic content.  As a result of the Growth Cave matter, defendants, including Growth Cave’s co-CEOs, are permanently banned from marketing and selling business opportunities and credit repair programmes as part of the settlement to resolve allegations that their scheme cost consumers nearly $50 million in damages. Similar actions are also being brought in the private sector.  For example, in a consolidated nationwide class action, consumers alleged that Apple falsely represented what the iPhone 16 could do by promoting AI capabilities (“Apple Intelligence”) that did not exist.  The docket reflects that, as of December 2025, the parties reached an agreement in principle to resolve the matter on a class wide basis, with a final settlement expected to be presented for court approval in March 2026.  See Landsheft v. Apple Inc. , No. 25-cv-02668 (N.D. Cal. 2025). Focus on racial equity In recent years, the FTC demonstrated a renewed focus on combatting surveillance, algorithmic bias and other emerging issues that may disproportionately affect communities of colour.  Through its Every Community Initiative, the FTC sought to support consumers in historically underserved communities, which may be disproportionately affected by fraud and other consumer issues.  These efforts included developing specific resources, conducting outreach and events, initiating law enforcement actions, and conducting research to better identify and understand the equity issues.  With the advent of AI, and issues regarding racial bias in AI systems that are now making crucial decisions in housing, health care, and more, the FTC’s enforcement may expand and adapt to tackle these new technological threats to equity.  One such example was the FTC’s 2023 settlement with Rite Aid for the company’s discriminatory use of facial recognition software powered by AI.  The settlement offers companies a framework for assessing their systems for potential AI bias that has a discriminatory impact. Under the current administration, however, it is uncertain whether the FTC will continue to pursue such cases aggressively.  Recent actions, including warning letters to law firms alleging their DEI hiring efforts may constitute unlawful anticompetitive conduct, suggest a shift in enforcement priorities. 9.2        Are there any proposed reforms to consumer law or policy within the next 12 months? The CFPB is expected to continue its shift toward limited enforcement under the Trump administration, following personnel changes, workforce reductions, and abandonment of many enforcement matters in 2025.  For 2026, the bureau has expressed plans to revise many regulations, including: (1) Regulation B, which implements the ECOA; (2) the Section 1071 small business data collection rule; and (3) the final Section 1033 personal financial data rights rule.  But given the administration’s overall priorities and the bureau’s constrained budget, less enforcement activity and rulemaking are expected. The FCC has announced that it will continue its “Delete, Delete, Delete” initiative, aimed at rescinding agency rules and regulations in alignment with the Trump Administration’s larger deregulatory efforts.  While earlier efforts focused on eliminating regulations that the FCC claims are tied to obsolete technologies, many expect that the FCC will move to more substantive deregulation in 2026. Separately, the “Make America Healthy Again” (“MAHA”) grassroots movement is expected to continue to pressure the FDA and state regulators into action.  For example, as of early 2026, at least 18 states have pursued Supplemental Nutrition Assistance Program (“SNAP”) waivers to render certain items, such as soda, candy, and prepared desserts, ineligible for purchase with government SNAP (food assistance) funds.  Select states, such as California and Texas, have adopted new legislation regarding ultra processed foods and warning labels, and this MAHA-attributed trend is expected to continue in 2026.  It remains to be seen whether Health and Human Services Secretary Robert Kennedy will pursue a national food standard or continue to encourage state-level regulation. Production Editor's Note This chapter has been written by a member of ICLG's international panel of experts, who has been exclusively appointed for this task as a leading professional in their field by Global Legal Group , ICLG's publisher. ICLG's in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style, including anti-plagiarism and AI-detection tools. This chapter was copy-edited by Hollie Parker , our in-house editor.
Markdown
[![Basket](https://iclg.com/skin/images/basket.svg)Basket](https://iclg.com/view-basket) [![Newsletter](https://iclg.com/skin/images/mail.svg)Get Email Updates](https://iclg.com/free-newsletter) ![ICLG logo](https://iclg.com/skin/images/glg2024/iclg_logo_header.svg) [Statement on Russia](https://www.glgroup.co.uk/statement-on-russia) [Associations](https://iclg.com/partners) [Videos](https://iclg.com/videos) [Search:![search](https://iclg.com/skin/images/search.svg)](https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa) [![Login](https://iclg.com/skin/images/user.svg)Login](https://iclg.com/free-registration) - [Our Brands:](https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa) - [![ALB](https://iclg.com/skin/images/alb.svg) African Law and Business](https://www.africanlawbusiness.com/) - [![CDR](https://iclg.com/skin/images/glg2024/cdr_dropdown_white.svg) CDR Magazine](https://www.cdr-news.com/) - [![GLI](https://iclg.com/skin/images/glg2024/gli_dropdown_white.svg) Global Legal Insights](https://www.globallegalinsights.com/) - [![ICLG](https://iclg.com/skin/images/glg2024/iclg_dropdown_white.svg) ICLG](https://iclg.com/) - [Home](https://iclg.com/) - [Practice Areas]() - [ALL](https://iclg.com/practice-areas#all) - [Competition](https://iclg.com/practice-areas#3) - [Corporate & Commercial](https://iclg.com/practice-areas#10) - [Disputes](https://iclg.com/practice-areas#11) - [Finance](https://iclg.com/practice-areas#4) - [High Net Worth](https://iclg.com/practice-areas#13) - [Industry](https://iclg.com/practice-areas#15) - [Intellectual Property](https://iclg.com/practice-areas#6) - [Life Sciences & Healthcare](https://iclg.com/practice-areas#14) - [Technology](https://iclg.com/practice-areas#9) - [White Collar Crime](https://iclg.com/practice-areas#12) - [Jurisdictions]() - [ALL](https://iclg.com/jurisdictions#all) - [Africa](https://iclg.com/jurisdictions#africa) - [Asia-Pacific](https://iclg.com/jurisdictions#asia-pacific) - [Central America & the Caribbean](https://iclg.com/jurisdictions#central-america-and-the-caribbean) - [Europe](https://iclg.com/jurisdictions#europe) - [Latin America](https://iclg.com/jurisdictions#latin-america) - [Middle East](https://iclg.com/jurisdictions#middle-east) - [North America](https://iclg.com/jurisdictions#north-america) - [Offshore](https://iclg.com/jurisdictions#offshore) - [Russia & CIS](https://iclg.com/jurisdictions#russia-and-cis) - [Compare & Research](https://iclg.com/compare) - [ICLG News](https://iclg.com/news) - [Briefings](https://iclg.com/briefing) - [Events]() - [GLG Events](https://iclg.com/glgevents) - [Partner Events](https://iclg.com/conferences) - [Contributors](https://iclg.com/contributing-firms) - [Free Newsletter](https://iclg.com/free-newsletter) - [View Basket](https://iclg.com/view-basket) - [Search](https://iclg.com/search) ![The ICLG to: Consumer Protection Laws and Regulations](https://iclg.com/uploads/publications/images/small/rWK5PcIuq2Xu383ZEvGizNHpNq4XIfQH2HH661mp.png) # Consumer Protection Laws and Regulations USA 2026 **ICLG - Consumer Protection Laws and Regulations** - USA Chapter covers common issues in consumer protection laws and regulations, including substantive provisions, enforcement action, current trends and anticipated reforms. Published: 10/04/2026 [ICLG.com](https://iclg.com/) \> [Practice Areas](https://iclg.com/practice-areas) \> [Consumer Protection](https://iclg.com/practice-areas/consumer-protection-laws-and-regulations) \> USA [![Share in E-mail](https://iclg.com/skin/images/social/mail-icon.svg)](<mailto:?subject=Consumer Protection Laws and Regulations - USA&body=https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa> "Send this link in email") [![Share on LinkedIn](https://iclg.com/skin/images/linkedin-icon.svg)](https://www.linkedin.com/cws/share?url=https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa "Share on LinkedIn") [![Share on Twitter](https://iclg.com/skin/images/twitter-icon.svg)](https://www.twitter.com/share?via=ICLG_GLG&url=https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa&text=ICLG%20to:%20Consumer%20Protection%20Laws%20and%20Regulations%20-%20USA "Share on Twitter") [![Share on Facebook](https://iclg.com/skin/images/facebook-icon.svg)](https://www.facebook.com/sharer/sharer.php?u=https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa "Share on Facebook") ## Chapter Content [Free Access]() 1. [1\. **General**]() 2. [2\. **Protections in Relation to the *Quality*, *Function* and *Safety* of Goods and Services**]() 3. [3\. **Prohibitions Relating to “Conduct” Against Consumers**]() 4. [4\. **Specific Applications of the Rules and Protections**]() 5. [5\. **Other Protections/Prohibitions**]() 6. [6\. **Investigation of Potential Breaches**]() 7. [7\. **Enforcement**]() 8. [8\. **Appeals**]() 9. [9\. **Current Trends and Anticipated Reforms**]() ### 1\. **General** **1\.1 What legislation, regulations and guidelines are relevant to consumer protection in your jurisdiction?** United States law protects consumers at the federal and state levels. Select federal consumer protection statutes, which apply nationwide, include the Federal Trade Commission Act (“FTC Act”), the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), the Gramm-Leach-Bliley Act (“GLB Act”), the Truth in Lending Act, the Fair Credit Reporting Act (“FCRA”), the Fair Debt Collection Practices Act, the Equal Credit Opportunity Act (“ECOA”), the Identity Theft and Assumption Deterrence Act, the Children’s Online Privacy Protection Act (“COPPA”), the Telephone Consumer Protection Act (“TCPA”), the Video Privacy Protection Act, the Federal Tort Claims Act, the Consumer Product Safety Act (“CPSA”), the Federal Food, Drug and Cosmetic Act (“FDCA”), the Magnuson Moss Warranty Act, the Lanham Act, and the Securities Exchange Act of 1934. Previously, under the Biden administration, the Federal Trade Commission (“FTC”) and the Consumer Financial Protection Bureau (“CFPB”) pursued an expansive consumer protection agenda, with a focus on rulemaking to complement enforcement actions. Newer rule initiatives focused on addressing unfair and deceptive business practices related to multi-level marketing schemes, for-profit colleges, “gig” employment opportunities, telemarketing, automotive “junk fees”, government impersonation, and commercial surveillance. The Trump administration has since significantly reduced consumer protection enforcement. For example, the CFPB withdrew nearly 70 guidance documents in 2025, citing the administration’s mandate to eliminate regulations and reduce costs for businesses. The One Big Beautiful Bill Act, signed by Trump on July 4, 2025, nearly halved the CFPB’s budget, cutting its cap of Federal Reserve operating expenses from 12 per cent to 6.5 per cent. Federal regulations also continue to evolve alongside the increasingly online consumer marketplace. For example, the FTC instituted a regulation that prohibits selling or purchasing fake consumer reviews or testimonials without clearly disclosing the relationship to consumers. 16 CFR 465. This aims to prevent companies from deceiving consumers through the use of fake reviews, suppression of negative reviews, and paying for positive reviews. The FTC is also evaluating how best to combat and prevent the harmful effects of Artificial Intelligence (“AI”). For example, the FTC ran an exploratory challenge named “Voice Cloning Challenge” to encourage the development of multidisciplinary approaches – from products to polices to procedures – aimed at protecting consumers from AI-enabled voice cloning harms. Top submissions include proposals from organisations and professors at universities, which will split \$35,000 in prize money. In another example, the FTC sued to stop Air AI from using deceptive claims about business growth, earnings potential, and refund guarantees to bilk millions from small businesses. In 2025, the FTC shifted from the Biden-era emphasis on broad rulemaking toward more targeted and case-by-case investigations, focusing on anticompetitive and sector-specific enforcement in areas such as healthcare and tech. For example, the FTC secured a historic \$2.5 billion settlement with Amazon over allegations that the company used deceptive sophisticated subscription traps designed to manipulate consumers into enrolling in Prime memberships without their knowledge and made it unduly hard to cancel those subscriptions. The FTC also ordered the nation’s largest pet cremation business, Gateway Services, Inc., to stop enforcing restrictive noncompete agreements that bind nearly 1,800 workers. FTC Chairman Andrew N. Ferguson sent letters to several large healthcare employers and staffing firms urging them to conduct a comprehensive review of their employment agreements – including any noncompete or other restrictive agreements – to ensure they are appropriately tailored and comply with the law. At the federal legislative level, Section 230 of the Communications Decency Act, which generally protects online platforms from liability for user-generated content, remains the subject of great debate. Its original justification – to encourage the growth and development of the internet in its early years – is no longer valid. With more and more dangerous platforms proliferating online, in the AI space and otherwise, many now believe platforms should be held accountable for the consumer and other harms they enable. Despite this growing view, it remains to be seen whether any legislative change will follow. A narrower interpretation of immunity might also be successfully advanced in courts, given that the increasingly digital world in which we now live and work could not have been anticipated when Section 230 was passed. In addition to federal law, most states have one or more consumer protection statutes that prohibit unfair and deceptive business practices within their borders. States with the broadest, most flexible prohibitions thus affording the greatest consumer protections include California, Connecticut, Hawaii, Illinois, Massachusetts, New York and Vermont. Perhaps the best-known examples of state consumer protection statutes are California’s Consumers Legal Remedies Act (“CLRA”) and New York’s General Business Law. Powerful examples of state privacy legislation are the Illinois Biometric Information Privacy Act (“BIPA”), and the California Consumer Privacy Act (“CCPA”). **1\.2 What is the definition of “consumer” (i.e., who does consumer protection law protect)?** Consumer protection laws safeguard purchasers of goods and services against defective products and deceptive, fraudulent business practices. The definition of “consumer” is statute-specific and varies depending on the nature of the goods or services being regulated. For example, under the Uniform Commercial Code (“UCC”), a collection of laws adopted by most states to regulate interstate commercial transactions, “‘consumer’ means an individual who enters into a transaction primarily for personal, family, or household purposes”. UCC § 1-201. Under the Dodd-Frank Act, which overhauled financial regulation after the Great Recession of 2007–09, “‘consumer’ means an individual or an agent, trustee, or representative acting on behalf of an individual”. 12 USC § 5481(4). Under the FCRA, which restricts the use of information held by consumer reporting agencies, the term simply “means an individual”. 15 USC § 1681(a)–(c). The TCPA protects businesses as well as natural persons against telephone solicitation. 47 USC § 227. Under state law, the definition of “consumer” may be limited to an “individual who seeks or acquires, by purchase or lease, any goods or services for personal, family, or household purposes” – *see*, *e.g.*, Cal. Civ. Code § 1761(d) – but some statutes sweep more broadly. For example, under the Texas Deceptive Trade Practices and Consumer Protection Act, the definition of consumer includes “an individual, partnership, corporation, this state, or a subdivision or agency of this state who seeks or acquires by purchase or lease, any goods or services”. Tex. Bus. & Com. Code § 17.45(4). **1\.3 Who is/which entities are required to comply with consumer protection law?** The entities governed vary by statute. For example, the FTC Act applies to “persons, partnerships, or corporations, except banks, savings and loan institutions \[…\], Federal credit unions \[…\], common carriers \[…\], and persons, partnerships, or corporations insofar as they are subject to the Packers and Stockyards Act”. 15 USC § 45(a)(2). The Dodd-Frank Act applies to “any person that engages in offering or providing a consumer financial product or service”, as well as affiliates of such persons. 12 USC § 5481(6). State consumer protection laws typically provide broad prohibitions that apply to anyone engaged in commercial conduct. For example, the Connecticut Unfair Trade Practices Act provides that “\[n\]o person shall engage in unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce”. Conn. Gen. Stat. § 42-110b(a). Many statutes, however, carve out specific exceptions. For example, the Pennsylvania Unfair Trade Practices and Consumer Protection Law imposes a standard of strict liability on businesses but contains an exemption for media entities that publish deceptive advertisements in good faith and without knowledge of the deception. 73 Pa. State. § 201-3. **1\.4 Which agency/agencies is/are responsible for enforcing consumer protection law (i.e., who is the investigator and who is the adjudicator)?** Various federal agencies enforce consumer protection laws, including the FTC, the CFPB, the Federal Communications Commission (“FCC”), the Consumer Product Safety Commission (“CPSC”), the Food and Drug Administration (“FDA”), and the United States Department of Agriculture (“USDA”). Some federal enforcement may begin to see new limits in the coming years. For example, the One Big Beautiful Bill Act, signed on July 4, 2025, reduced the CFPB’s operating budget by nearly half. At the state level, each Attorney General (“AG”) investigates and enforces consumer protection laws; in some states, District Attorneys also have the authority to prosecute consumer protection claims. In California, the Department of Consumer Affairs has an internal division that is authorised to investigate consumer complaints and enforce state consumer protection laws. Many state consumer protection laws also include a private right of action, empowering consumers to vindicate rights in court parallel to, or independent of, government action. These private actions serve as a critical “gap” filling measure to ensure greater legal compliance and accountability than regulatory action alone could achieve. In some states, individuals are required to give advance notice of the alleged deceptive practices to the business, prior to filing in court. This creates a safe harbour period during which the business may address the individual’s claims and avoid legal liability or other penalties. ### 2\. **Protections in Relation to the *Quality*, *Function* and *Safety* of Goods and Services** **2\.1 Please describe any protections regarding the quality and function of goods and services acquired by consumers.** At the federal level, agencies such as the FDA and USDA promulgate regulations regarding the quality and function of goods and services such as foods, drugs, and agriculture. At the state level, the UCC, which has been almost universally adopted, contains provisions relating to express and implied warranties. *See* UCC §§ 2-313–2-315. Some state statutes have requirements pertaining to the quality of goods. For example, California’s CLRA prohibits “\[r\]epresenting that goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that they do not have or that a person has a sponsorship, approval, status, affiliation, or connection that the person does not have”. Cal. Civ. Code § 1770(a)(5). Many states also recognise common law claims for fraud or breach of express and implied warranties. Turning to the safety of goods and services, at the federal level, the CPSA exists: “(1) to protect the public against unreasonable risks of injury associated with consumer products; (2) to assist consumers in evaluating the comparative safety of consumer products; (3) to develop uniform safety standards for consumer products and to \[minimise\] conflicting State and local regulations; and (4) to promote research and investigation into the causes and prevention of product-related deaths, illnesses, and injuries.” 15 USC § 2051(b). The Motor Vehicle Safety Act “prescribe\[s\] motor vehicle safety standards”. 49 USC § 30101(1). The FDCA seeks to ensure the safety of food, drugs, medical devices and cosmetics. *See* 21 USC §§ 301 *et seq*. There are also numerous federal laws dealing with the safety of various agricultural products. *See*, *e.g*., 21 USC §§ 451 *et seq*. (relating to poultry inspection and safety); and 21 USC §§ 601 *et seq*. (relating to meat inspection and safety). In addition, there are various state laws to ensure the safety of consumer goods and services. *See*, *e*.*g*., California Sherman Act, Cal. Health & Safety Code § 109875 *et seq*. (California’s version of the FDCA, establishing parallel state regulation of the safety of food, drugs, medical devices and cosmetics); 16 Tex. Admin. Code §§ 82.1 *et seq*. (relating to barber shop regulations); and *id*. §§ 83.1 *et seq*. (relating to cosmetology regulations). State and federal laws also affect safety through labelling and disclosure requirements. For example, California Proposition 65 provides that “\[n\]o person in the course of doing business shall knowingly and intentionally expose any individual to a chemical known to the state to cause cancer or reproductive toxicity without first giving clear and reasonable warning to such individual”. Cal. Health & Safety Code § 25249.6. Many states also recognise relevant common law claims, including, for example, product liability and negligence. **2\.2 Please outline the substantive tests for these protections.** The substantive tests vary depending on the goods or services, as well as the regulations or guidelines at issue. Under the UCC, if the seller makes any promise or provides a description or model relating to the goods, the goods must conform. *See* UCC § 2-313. The goods must also: “pass without objection in the trade”; “in the case of fungible goods, \[be\] of fair average quality”; be “fit for the ordinary purposes”; “run, within the variations permitted by the agreement”; be “adequately contained, packaged, and labelled”; and “conform to the promise or affirmations of fact made on the container or label if any”. *Id*. § 2-314(2). Furthermore, if the seller had reason to know the buyer was acquiring the goods for a particular purpose, the goods must be fit for that purpose. *See id*. § 2-315. Other state law substantive tests vary by jurisdiction. For safety, the substantive tests vary depending on the governing law or regulation and range from specific to broad. For example, the CPSC broadly prohibits the sale of consumer products that contain a defect which could create a substantial product hazard and products that create an unreasonable risk of serious injury or death. However, there are also very specific requirements for some products. For example, it is deemed a substantial hazard for “\[c\]hildren’s upper outerwear in sizes 2T to 16” to “hav\[e\] one or more drawstrings”. 16 CFR § 1120.3(b)(1). The related “standard prohibits drawstrings at the hood and neck area of children’s upper outerwear” and imposes specific limitations on the use of drawstrings in the waist or bottom of children’s upper outerwear. *See* [(Hyperlink)](https://www.cpsc.gov/FAQ/Drawstrings-in-Children%E2%80%99s-Upper-Outerwear "https://www.cpsc.gov/FAQ/Drawstrings-in-Children%E2%80%99s-Upper-Outerwear") **2\.3 What types of goods and services are covered by the protections?** All goods and services sold to the American public for individual use are subject to state and federal laws which regulate their transparency, fitness for sale, and potential for fraud. The types of legal protections afforded depend on the good or service and the source of protection. For example, the UCC applies to commercial goods. *See* UCC § 2-102. The FDA promulgates Current Good Manufacturing Practice regulations for the quality of drug products. *See* 21 CFR Part 210; 21 CFR Part 211. The USDA sets quality standards for various agricultural products including meat, eggs, fruits, and vegetables. *See*, *e.g.*, 21 USC § 606 (relating to the inspection of meat products). Regarding consumer safety, the blend of federal, state, and local laws, regulations, guidelines, and ordinances covers a wide range of consumer products and services. Together with the availability of common law claims, few if any consumer products or services escape safety protections. **2\.4 Are there any exceptions to these protections?** Exceptions are sometimes available and vary by law or regulation. For example, the UCC generally applies to all commercial sales of goods, but parties may contractually modify the protections available to businesses. *See*, *e.g.*, UCC § 2-316 (relating to the exclusion or modification of warranties). As set forth in question 2.3, few if any consumer products or services are excluded altogether from safety protections. **2\.5 What remedies are available for a breach of the protections in relation to the quality, function and safety of goods and services?** If a breach of these protections involves a product defect or risk of a safety hazard to consumers, the remedies can involve enforcement by a federal or state regulatory agency. For example, when a defective product regulated by the FDA has entered the marketplace, the agency can issue a recall. *See*, *e.g.*, 21 USC § 3501. Similarly, the USDA has authority to detain and seize defective products for which it has regulatory authority. *See id*. §§ 672–73. Violations of FDA or USDA regulations may also result in criminal or civil penalties. *See*, *e.g.*, *id*. §§ 333 & 335b. Under the UCC, “\[t\]he measure of damages for breach of warranty is the difference at the time and place of acceptance between the value of the goods accepted and the value they would have had if they had been as warranted”. UCC § 2-714(2). At common law, remedies may include replacement of the defective product, damages, or contractually agreed-to liquidated damages, in circumstances where damages are difficult to calculate. Individuals may also pursue monetary and injunctive relief in states that provide a private right of action. For example, California’s CLRA authorises private civil actions against companies that use “unfair methods of competition and unfair or deceptive acts or practices”, including “\[r\]epresenting that goods or services are of a particular standard, quality, or grade \[…\] if they are of another”. Cal. Civil Code. § 1770(a)(7). Remedies available under the CLRA are wide-ranging, and include monetary damages, punitive damages, restitution, and injunction, as well as attorneys’ fees. *Id*. at § 1780(a). Consumer-plaintiffs often bring parallel claims under California’s Unfair Competition Law (“UCL”), which offers similar protections against deceptive business practices. Under the UCL “the primary form of relief available \[…\] to protect consumers from unfair business practices is an injunction”. *In re: Tobacco II Cases*, 46 Cal. 4th 298, 319, 93 Cal. Rptr. 3d 559, 575 (2009). Under the UCL and CLRA, as well as California’s False Advertising Law (“FAL”), consumers may also pursue public injunctive relief, which has the primary purpose and effect of stopping unlawful acts that threaten the general public. *McGill v. Citibank, N.A*., 2 Cal. 5th 945, 955, 216 Cal. Rptr. 3d 627, 633 (2017). For safety violations, remedies include product recalls or seizures and civil or criminal penalties. Individuals may also seek injunctive relief and/or compensatory and punitive damages through a private civil action (individual or class action). **2\.6 Who has or which agencies have standing to initiate proceedings for a breach?** If a breach of the protections in relation to the quality or function of goods involves a product defect or risk of a safety hazard to consumers, then various federal and state agencies may have the authority to initiate proceedings for the breach. For example, under certain circumstances, the CPSC, FDA and USDA have authority to request (and in some cases, mandate) the removal of defective products from the marketplace. In addition, these agencies may coordinate with the Department of Justice (“DOJ”) to bring enforcement actions which may result in civil or criminal penalties. The USDA’s Food Safety Inspection Service may also bring an enforcement action that results in a food establishment’s loss of ability to produce, sell, or distribute its products in commerce. *See* 9 CFR § 500.6. For breaches of warranty under the UCC or common law, the injured party may bring a civil action to seek damages or injunctive relief. Individual consumers may also initiate individual or class action proceedings for a breach of state statutory or common law duties. **2\.7 Describe at least two examples of public or private enforcement of these protections in the last five years, including the conduct/alleged conduct, result and penalties imposed.** Public and private enforcement relating to product quality and function has been active over the past five years. On the federal level, the FTC has targeted deceptive user interface designs and hidden fees. These practices are known as “dark patterns” and “junk fees”, respectively. In September 2025, the FTC secured a landmark \$2.5 billion settlement with Amazon.com, Inc. after alleging that Amazon used sophisticated dark patterns to trick consumers into enrolling in automatically renewing Prime subscriptions without informed consent and made cancellation unduly difficult. The settlement enjoins Amazon from employing these practices, including the use of misleading prompts such as “No, I don’t want Free Shipping”. *See* [(Hyperlink)](https://www.ftc.gov/legal-library/browse/cases-proceedings/2123050-amazoncom-inc-rosca-ftc-v "https://www.ftc.gov/legal-library/browse/cases-proceedings/2123050-amazoncom-inc-rosca-ftc-v") At the state level, in early 2025, the Connecticut AG obtained a \$1.5 million judgment against Carvana LLC, an online car dealer, resolving claims that Carvana delayed sending title documents to buyers, failed to advance timely payments to sellers, and provided poor customer service. The complaint alleged deceptive and wilful unfairness under the Connecticut Unfair Trade Practices Act. The judgment requires Carvana to comply with state title and registration requirements, strengthen customer service systems, and use “best efforts” to accurately describe specific features of the automobiles it sells. *See State of Conn. v. Carvana LLC* (No. HHD-CV25-6196604-S) (Conn. Superior Court, Hartford Judicial District). In an example of successful private enforcement, in late 2024, consumers achieved a \$9.2 million class action settlement to resolve claims involving Dr. Dennis Gross brand skin care products advertised as containing collagen when they did not contain collagen. This is one of the largest false advertising settlements ever in the skincare industry, providing consumers with nearly full restitution, up to \$380 per consumer. The company also agreed to no longer sell products labelled as “+ collagen” unless they in fact contained collagen, relief that will benefit consumers worldwide. *See Kandel, et al., v. Dr. Dennis Gross Skincare, LLC* (No. 1:23-cv-01967-ER) (S.D.N.Y.). Product-safety enforcement has been similarly robust. For example, in early 2025, Fitbit agreed to pay \$12.25 million to resolve CPSC’s allegations that it failed to promptly report that its popular smartwatch products frequently overheated and severely burned some consumers. In a statement following resolution of these claims, the CPSC emphasised its commitment to holding companies responsible for continuing to sell dangerous products despite knowing these products can cause serious injury or death. In addition to the financial penalty, Fitbit must maintain internal controls and procedures to ensure the company complies with the CPSA. Private litigation has also targeted safety issues. In *In re: Procter & Gamble Aerosol Products Marketing & Sales Practices Litigation*, consumers alleged that various aerosol personal care products were contaminated with benzene, a known carcinogen, and that P\&G failed to properly disclose the risk to consumers. The parties reached an \$8 million settlement to resolve the allegations, providing monetary payment to consumers based on the number of products they purchased. P\&G also agreed to buttress its health and safety practices by implementing material testing, “finished product” testing, and other measures to monitor for benzene contamination in the future. *See In re: Procter & Gamble Aerosol Products Marketing & Sales Practices Litigation*, No. 2:22-MD-03025 (S.D. Ohio). Another high-profile example of private enforcement is a consumer class action recently filed against Apple, alleging that the Apple Watch Sport Band products contain perfluorohexanoic acid, a toxic perfluoroalkyl and polyfluoroalkyl substance (“PFAS”), in hazardous amounts that substantially exceed Apple’s own internal standards and other thresholds for safety by 40.8 times. *See Cavalier et al. v. Apple Inc.*, No. 5:2025-cv-00713 (N.D. Cal.). Apple has moved to dismiss the action, and the court has not yet ruled. Finally, in January 2026, a federal court certified a Rule 23(b)(3) class in mass litigation alleging that 9Lives, Kibbles ‘n Bits, and Meow Mix misled consumers by marketing their products as healthful despite containing titanium dioxide and packaging that contained, or risked containing, PFAS. *See Jeruchim v. J.M. Smucker Co.*, No. 22-cv-06913-WHO, 2026 U.S. Dist. LEXIS 12228 (N.D. Cal. Jan. 22, 2026). The court’s strong certification order may help pave the way for class certification in the Apple PFAS matter and other PFAS-related cases still in earlier stages. ### 3\. **Prohibitions Relating to “Conduct” Against Consumers** **3\.1 Please describe any protections/prohibitions relating to the conduct of persons or businesses (e.g., manufacturers/retailers) which sell or supply goods and services to consumers (“Conduct”). For example, misleading and deceptive Conduct, unconscionable Conduct, etc.** The most generally applicable federal consumer protection statute regulating conduct in the United States is the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce”. 15 USC § 45(a)(1). The federal Lanham Act also contemplates civil lawsuits for false advertising that “misrepresents the nature, characteristics, qualities, or geographic origin” of goods or services. 15 USC § 1125(a)(1)(B). Most states have adopted statutes that prohibit unfair or deceptive business and debt-collection practices. For example, California has three statutes prohibiting unfair or deceptive business practices: the CLRA, which streamlines class certification and provides for both legal and equitable relief; as well as the UCL and FAL, which limit available remedies to injunctive relief and restitution. **3\.2 Please outline the substantive tests for the above-mentioned protections/prohibitions.** Under federal law, a deceptive practice is one that “misleads the consumer acting reasonably in the circumstances, to the consumer’s detriment”. *See* FTC’s Policy Statement on Deception (1983), [(Hyperlink)](https://www.ftc.gov/legal-library/browse/ftc-policy-statement-deception "https://www.ftc.gov/legal-library/browse/ftc-policy-statement-deception") . A practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition”. 15 USC § 45(n). The FTC also has the authority to promulgate Rules under the FTC Act that specify particular acts or practices that are unfair or deceptive. In some cases, Congress directs the FTC to promulgate a specific Rule. Selected Rules enforced by the FTC include the following: the Business Opportunity Rule imposes disclosure requirements for business opportunity sellers to prospective buyers, in order to provide buyers with sufficient information to assess the risks of a business opportunity; the CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing Act) Rule defines the criteria for ascertaining the “primary purpose” of a commercial e-mail, requiring warning labels on commercial e-mails that have sexually explicit material and prohibiting charging a fee and other opt-out barriers; the COPPA Rule implements COPPA by imposing rules on operators of websites and online services that either have actual knowledge that they collect information on children under 13 on their services or are directed to children under 13; the Franchise Rule requires franchisors to provide specific disclosures to franchisees, so they have sufficient information to properly make an investment in a franchise; the Health Breach Notification Rule requires vendors of personal health records and related entities to notify consumers after a breach involving unsecured information, with specific requirements for timing, method and the content of the notification; and the Made in USA Rule states that marketers making unqualified claims that their products are made in the United States should be able to prove those claims. Analogous state law claims such as the California statutes described in question 3.1 employ a “reasonable consumer” test that evaluates false and misleading business practices from the vantage of an ordinary consumer. *See*, *e.g.*, *Williams v. Gerber Prods. Co.*, 523 F.3d 934, 938 (9th Cir. 2008). **3\.3 What types of goods and services are covered by these protections/prohibitions? Is the payment of a price for these goods/services always required for their enforceability?** The FTC Act covers all goods and services “in or affecting commerce”, 15 USC § 45(a)(2); most state protections against unfair or deceptive practices also apply broadly across the spectrum of commercial goods and services. Payment of a price for goods or services is not always required for enforceability under state law. California’s UCL, for example, provides a private right of action for corporate entities to sue their business competitors for unfair or deceptive practices. While the plaintiff corporation must demonstrate economic loss to its business caused by the defendant company’s unfair or deceptive practices, it need not have tendered money directly for goods or services offered by the defendant. **3\.4 Are there any exceptions/exemptions to the protections/prohibitions relating to Conduct?** The FTC Act does not apply to banks, savings and loan institutions, federal credit unions, common carriers, or non-profit entities, among others. *See* 15 USC § 45(a)(2). **3\.5 What remedies are available for a breach of the protections/prohibitions relating to Conduct?** At the federal level, unfair or deceptive acts or practices proscribed under § 18(a)(1)(B) of the FTC Act are subject to a statutory civil penalty of \$50,120 per violation if the FTC can demonstrate (1) the perpetrator of the unfair or deceptive practices had actual knowledge that their conduct was in violation of the FTC Act, and (2) the FTC had already issued a written decision that such conduct was unfair or deceptive. Additionally, many state consumer protection laws provide remedies for victims of false and deceptive conduct, including statutory damages, restitution, and injunction relief. Typically, these lawsuits proceed as class actions. **3\.6 List at least two examples of public or private enforcement of the protections relating to Conduct in the last five years, including the breach/alleged breach, result and penalties imposed.** Public and private enforcement over the past five years reflects the breadth of conduct targeted, as well as significant penalties imposed. In September 2025, Amazon reached a \$2.5 billion settlement with the FTC to resolve claims that it violated the Restore Online Shoppers’ Confidence Act by failing to (i) clearly disclose Prime subscription terms, (ii) obtain informed consent from customers before charging them, and (iii) offer a simple mechanism for cancellation. Under the settlement, Amazon will pay a \$1 billion civil penalty and issue \$1.5 billion in refunds to approximately 35 million affected consumers. The civil penalty is the highest ever assessed in a case involving an FTC rule violation, and the refund amount is the second-highest restitution award for a commission action. Another major example of public enforcement occurred in December 2025, when Maplebear Inc. (Instacart) agreed to a \$60 million settlement with the FTC related to allegations that it deceptively advertised “free delivery” on first orders while charging a service fee and failed to clearly disclose subscription terms. The settlement requires Instacart to stop misrepresenting delivery costs and to clearly disclose any restrictions on its money-back guarantees, along with other forward-looking measures to increase transparency for consumers. State regulators have also been active. In January 2026, the California Department of Financial Protection and Innovation imposed a \$500,000 penalty on crypto-backed loan company Nexo Capital Inc. to resolve claims it failed to obtain a valid licence while making high-risk loans to California consumers, and for overcollateralising loans to California borrowers. The settlement also requires Nexo to transfer all funds belonging to California residents to a properly licensed entity. Private enforcement has produced substantial results as well. In April 2023, a federal court in New York granted final approval of a \$7.8 million settlement, the highest ever settlement for a false advertising claim concerning preservatives. The settlement resolved claims that Celsius falsely advertised its popular drink products as having “no preservatives” despite the presence of citric acid. Class members received reimbursements of up to \$250, and the Company agreed to remove the challenged label claim. *Hezi, et al. v. Celsius Holdings Inc*., No. 1:21-CV-9892-VM (S.D.N.Y.). In October 2024, consumers secured a \$9.2 million settlement, resolving claims that Dr. Dennis Gross brand skincare products were falsely advertised as containing collagen when they did not. One of the largest ever false advertising settlements in the skincare industry, it provided consumers with nearly full restitution, up to \$380 per person. The company also agreed to no longer use the “+Collagen” labelling unless the products actually contain collagen. *Kandel, et al., v. Dr. Dennis Gross Skincare LLC*, No. 1:23-cv-01967-ER (S.D.N.Y.). ### 4\. **Specific Applications of the Rules and Protections** **4\.1 How do the rules and protections apply in relation to online marketplaces?** Consumer protection regulation is increasingly focused on online marketplaces as consumers spend more time and money online. As discussed in question 2.7, “junk fees” in online marketplaces are increasingly subject to public and private enforcement actions. Similarly, undisclosed auto-renewal provisions and predatory “dark patterns” (digital design tricks designed to encourage consumer purchases or data sharing without consumer awareness) are targets of enforcement actions and new legislation. **4\.2 How do the rules and protections apply in relation to social media?** Consumer protection law plays a central role in combatting the harms perpetuated by social media. Regulators and private plaintiffs increasingly pursue claims involving predatory and illegal data tracking and sharing, undisclosed paid advertising content, and design choices that drive consumer addiction. As of early 2026, multiple state and federal actions allege that major platforms intentionally engineered addictive features, such as infinite scroll, autoplay and reward systems, to keep children habitually engaged in ways that harm their mental health, in violation of consumer protection laws. *See, e.g*., *Social Media Cases*, No. JCCP5255 (L.A.S.C.). The intersection of AI and social media is another emerging focus. For example, in early 2026, the California AG announced an investigation into widespread reports of non-consensual, sexually explicit “deepfakes” images used to harass women online. The reports involve Grok, the chatbot developed by Elon Musk’s company xAI, Inc. and widely used on X (formerly Twitter). **4\.3 How do the rules and protections apply to pricing practices?** State and federal regulators are adapting to companies’ predatory pricing schemes with the initiation of new laws targeting deceptive practices. In 2024, California’s “Honest Pricing Law” went into effect, a price transparency law that makes it illegal for businesses to advertise a price for a good or service that does not include all associated fees or charges (with the exception of certain taxes and shipping costs). Additionally, in 2025, the FTC engaged the Rule on Unfair or Deceptive Fees, which prohibits bait-and-switch pricing and other tactics used to hide total prides and mislead people about fees, particularly in the live-event ticketing and short-term lodging industries. The FTC has also been increasingly focused on policing the predatory tactic of “strikethrough pricing”, which creates a false sense of urgency for consumers who are baited by a supposedly limited-time discount. **4\.4 How do the rules and protections apply to dark patterns or online choice?** As noted in question 4.1, the counteraction of “dark patterns” is a critical goal of enforcement agencies and private litigants in combatting fraud in the online marketplace. The FTC recently issued guidance titled “Bringing Dark Patters to Light”, which explains the deceptive nature of these predatory psychological tricks and provides recommendations for businesses to avoid deceptive tactics. State regulators, including California and Connecticut, have likewise focused on the abatement of dark patterns as critical to enforcement of their respective state privacy regimes. **4\.5 How do the rules and protections apply in relation to green claims?** A growing number of consumers are looking to buy environmentally friendly, “green” products, whether designated as “natural”, “non-toxic”, “sustainable”, “compostable”, or otherwise. Many companies have responded to the demand not by improving their products, but by “greenwashing” – using labels or advertising that overstate or misrepresent environmental benefits. To guide marketers and prevent deception, the FTC developed the Green Guides, which detail general principles for environmental claims, how consumers interpret “green” claims, and what substantiation or qualification is required. Some states, like California, have specifically incorporated the Green Guides into their consumer protection laws. In an example of successful private enforcement, in 2024, consumers settled class action claims against the manufacturers of ChapStick products that were labelled as “100% Natural” or made with “100% Naturally Sourced Ingredients”, despite containing various synthetic ingredients. The settlement requires GlaxoSmithKline and Pfizer to cease using these claims unless accurate, providing forward-looking relief that benefits consumers nationwide. *See Moore v. GlaxoSmithKline Consumer Healthcare Holdings (US) LLC et al.* (No. 4:20-cv09077) (N.D. Cal.). **4\.6 How do the rules and protection apply in relation to consumer representations?** The consumer protection rules and regulations are squarely aimed at false and deceptive representations. These protections apply across marketplaces, including in-store and online purchases. These laws generally apply to representations that are false or misleading, rendering many statements actionable even if a company can make an argument of literal truth – so long as a statement has the tendency or likelihood to mislead the general public, the statement may be in violation of consumer protection laws. **4\.7 How do the rules and protection apply in relation to scams?** Scams are another primary focus of the consumer protection regulatory scheme. As a result of increasing cryptocurrency scams, the Federal Bureau of Investigation, the DOJ, and D.C. federal prosecutors launched a joint task force in late 2025, the Scam Center Strike Force. The task force’s “Crypto Seizure Team” has already seized more than \$400 million in cryptocurrency. State regulators are likewise focused on cryptocurrency scams. For example, the Massachusetts AG filed suit against Bitcoin Depot in early 2026 alleging that the company, which operates ATMs where consumers can exchange cash for cryptocurrency, is aware that scammers use its kiosks to move money and defraud victims, but chooses to ignore the activity in furtherance of profits. *See Commonwealth v. Bitcoin Depot Inc.*(No. 2684CV00328) (Suffolk County Superior Court). ### 5\. **Other Protections/Prohibitions** **5\.1 Does consumer law in your jurisdiction have any other prohibitions/protections not covered by the questions above? If so, please describe these prohibitions/protections.** In addition to the federal consumer protection laws discussed above, state and local governments regulate consumer protection in a variety of ways, ranging from false advertising law, to unfair business practice regulation, to food safety requirements for local restaurants, to product labelling, privacy, biometrics and AI. For example, many local health departments conduct restaurant inspections to ensure compliance with food safety requirements. Another prominent example is California Proposition 65, which requires warnings for products with certain chemicals known to cause cancer or reproductive harm. Due to the growing concern over corporate abuse of consumer data, states are increasingly enacting data privacy regulations. Illinois enacted the BIPA, which institutes collection, use and sharing limits for companies that handle the biometric information of Illinois residents. The CCPA and the California Privacy Rights Act (“CPRA”) impose a range of protective measures for consumers. Other important state privacy laws include: the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act (“CPA”), which was recently amended to safeguard geolocation data and require consent for resale of sensitive consumer information; the Utah Consumer Privacy Act (“UCPA”); the New Jersey Data Protection Act (“NJDPA”); and the Oregon Consumer Privacy Act (“OCPA”), which was recently updated to further safeguard the sale and processing of personal data if such data belongs to a consumer under the age of 16. Given their importance to companies carrying out business in the United States, the remainder of this section will focus on these requirements. California also recently enacted the Genetic Information Privacy Act, following in the footsteps of Illinois’ BIPA, which protects consumers’ genetic information from misuse and unauthorised disclosure. Additionally, states are increasingly focused on regulating AI. Colorado became the first state to enact comprehensive AI regulation with the passing of the Colorado Artificial Intelligence Act in May 2024, which focused on preventative protections for consumers from algorithmic discrimination. Other states are beginning follow suit. For example, the Texas Responsible Artificial Intelligence Governance Act (“TRAIGA”) went into effect on January 1, 2026, affording similar AI-focused protections. **5\.2 Please outline the substantive tests for the above-mentioned protections/prohibitions.** Several examples follow. In California, the CCPA (as amended by the CPRA) applies to for-profit businesses that collect personal information from or about Californians and either: (1) have a gross annual revenue over \$25 million; (2) buy, sell, or share personal information of 100,000 or more consumers or households; or (3) derive 50% or more of their annual revenue from selling California residents’ personal information. Under the updated law, consumers have new rights, including the right to correct personal information that a business has shared about them and the right to limit the disclosure of sensitive personal information collected about them. California’s data privacy laws contain a limited private right of action for certain data breaches and are otherwise enforced by the state AG and California Privacy Protection Agency. In contrast, the below states’ statutory protections do not afford individuals a private right of action, though many states’ attorneys general welcome consumer reports regarding potential violations. In Virginia, the VCDPA applies to persons that conduct business in Virginia or offer products or services targeted to residents in Virginia and: (1) control or process the data of at least 100,000 consumers; or (2) control or process the personal data of at least 25,000 consumers and derive more than 50% of their revenue from the sale of personal data. The scope of Colorado’s law is very similar to Virginia’s, however, it only applies to data controllers, not data processors (although it defines data controllers more broadly). In Utah, the UCPA applies to controllers and processors that: (1) conduct business in Utah or produce a product or service targeted to consumers who are Utah residents; (2) have an annual revenue of \$25 million or more; and (3) meet at least one of the following thresholds: (i) during a calendar year, control or process the personal data of 100,000 or more consumers; or (ii) derive over 50% of the entity’s gross revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. This renders the UCPA narrower than other state privacy laws. In New Jersey, the NJDPA requires companies to provide clear privacy notices and implement adequate mechanisms for consumers to exercise their rights. To evaluate high-risk data activities, like targeted advertising or profiling, organisations must also conduct data protection assessments to evaluate potential harm to consumers. The NJPDA applies to any business or organisation processing personal data of 100,000+ residents, or anytime revenue is derived from selling the data of 25,000+ residents. **5\.3 Are there any exceptions/exemptions?** Certain states’ data privacy laws apply only to for-profit businesses (e.g., California, Virginia), while others apply more generally, including to entities such as nonprofits (e.g., New Jersey, Oregon). The laws also typically exempt entities that are subject to certain federal laws described above, such as the Health Insurance Portability and Accountability Act (“HIPAA”), the GLB Act and the FCRA. Notably, non-HIPAA health apps (e.g., fitness, fertility apps) are not exempt and are increasingly targets of enforcement activity. California offered an initial exemption for employee and business-to-business commercial information, though it expired in December 2022. **5\.4 What remedies are available for a breach of these protections?** In many states, only the AG can issue penalties. However, some states, like California, provide for a private right of action. Across states, civil penalties can range from \$2,663 for a one-time unintentional violation of the CCPA to up to \$20,000 for a single violation of Colorado’s privacy law. **5\.5 List at least two examples of public or private enforcement of these protections in the last five years, including the breach/alleged breach, result and penalties imposed.** In early 2026, a federal judge in California granted final approval of a \$30 million settlement resolving consumer claims that Google and YouTube illegally collected children’s data for targeted resale. Of note, the settlement followed an important appellate decision holding that the plaintiffs’ state privacy claims were not preempted by the federal COPPA. *See* *Hubbard v. Google LLC* (No. 5:19-cv-07016) (N.D. Cal.). In another example of successful private enforcement, in late 2025, an Illinois federal judge granted final approval of a \$12.1 million settlement in a BIPA class action against gas station chain Speedway LLC. More than 7,000 current and former employees alleged that the company collected and shared their fingerprint data through a time-clock system without proper consent. *See Howe v. Speedway LLC* (No. 1:19-cv-01374) (N.D. Il.). In late 2024, the California Privacy Protection Agency announced an investigative sweep focused on data brokers’ compliance with the registry requirements of the state’s Delete Act, which imposes registry requirements and data deletion and disclosure obligations on data brokers. Since then, the Agency has brought at least nine enforcement actions. Most recently, in early 2026, it announced a \$45,000 fine levied against Datamasters, a marketing firm that compiles and redistributes lists of people with serious health conditions (Alzheimer’s disease, drug addiction, bladder incontinence, etc.). In addition to the financial penalty, Datamasters must also stop selling the personal information of California residents, effectively removing the company from the state marketplace. In an example of non-monetary, pre-litigation enforcement, in January 2026, General Motors and OnStar entered into a consent agreement with the FTC to resolve allegations that the companies failed to obtain drivers’ consent before sharing geolocation and driver behaviour data with consumer reporting agencies. The final order imposes a five-year ban on General Motors and OnStar’s ability to disclose sensitive consumer data to consumer reporting agencies. It also imposes a 20-year requirement to obtain express consent before collection, using, or sharing connected vehicle data (with exceptions for emergency responders). ### 6\. **Investigation of Potential Breaches** **6\.1 What powers does/do the consumer authority/authorities in your jurisdiction have to investigate potential breaches of consumer law? Describe the key steps in a typical investigation.** The FTC has the power “\[t\]o gather and compile information concerning, and to investigate from time to time the organization, business, conduct, practices, and management of any person, partnership, or corporation engaged in or whose business affects commerce”. 15 USC § 46(a). The FTC is increasingly using investigational hearings and compulsory investigations against AI related issues, such as algorithmic discrimination, AI-generated deception, and impersonation fraud. For example, in 2025, the FTC launched an inquiry into AI chatbots acting as companions, including: Alphabet, Inc.; Character Technologies, Inc.; Instagram, LLC; Meta Platforms, Inc.; OpenAI OpCo, LLC; Snap, Inc.; and X.AI Corp. The FTC is interested in particular on the impact of these chatbots on children and what actions companies are taking to mitigate potential negative impacts, limit or restrict children’s or teens’ use of these platforms, and comply with the COPPA Rule. As part of its inquiry, the FTC sought information about how the companies: monetise user engagement; process user inputs and generate outputs in response to user inquiries; develop and approve characters; measure, test, and monitor for negative impacts before and after deployment; mitigate negative impacts, particularly to children; employ disclosures, advertising, and other representations to inform users and parents about features, capabilities, the intended audience, potential negative impacts, and data collection and handling practices; monitor and enforce compliance with company rules and terms of services (e.g., community guidelines and age restrictions); and use or share personal information obtained through users’ conversations with the chatbots. In 2025, the FTC also signalled that it would use existing federal law to address algorithmic discrimination in automated decision-making services regarding hiring, lending, and tenant screening. The FTC also has the “power to require by subpoena the attendance and testimony of witnesses and the production of all such documentary evidence relating to any matter under investigation”, also known as a Civil Investigative Demand (“CID”). *Id*. § 49. An FTC investigation typically begins when the FTC sends a CID to an investigative target. The CID does not require approval by the Commission as a whole; rather, at least one Commissioner signs off on the issuance of the CID. The target may have a meet-and-confer with the staff designated on the CID to attempt to negotiate the scope of the CID. The target may file a motion to quash within 20 days, which is initially ruled on by a single Commissioner and may be appealed to the FTC. 16 CFR § 2.10. The CID usually requests documents, testimony, and in many cases, particularly more recently, investigational hearings, which are similar to depositions. *See* 16 CFR § 2.7. At the conclusion of the investigation, staff will either recommend closing the investigation or the filing of a complaint. If staff recommend a complaint, the FTC can grant a period of time for the staff to negotiate a settlement. If a matter is still not resolved, the FTC has the option of filing a complaint in an administrative forum before an administrative law judge (“ALJ”) or directly in federal court. State attorneys general also use investigative tools and multistate coalitions, including CIDs and formal inquiries, to mitigate AI-related harms, such as algorithmic bias, deception, and fraud. For example, Texas AG Ken Paxton opened an investigation into AI chatbot platforms, including Meta AI Studio and Character.AI, for potentially engaging in deceptive trade practices and misleadingly marketing themselves as mental health tools. Similarly, New York AG Letitia James and a bipartisan coalition of 41 attorneys general from other states sent a letter to 13 Big Tech companies, including Meta, Microsoft, and OpenAI, urging them to implement safeguards on AI chatbots to protect children and vulnerable people. **6\.2 How is an investigation triggered (e.g., *ex officio*, whistleblower or complaint)?** Investigations may be triggered in various ways – through consumer complaints, information provided by an internal whistleblower, press articles, Congressional referrals, social media posts, or the initiative of a Commission employee. Sometimes, the FTC “sweeps” an entire industry to ensure compliance with the law. **6\.3 Describe any complaints procedure for (i) consumers, and (ii) businesses.** The FTC encourages consumers to file a complaint whenever they have been the victim of fraud, identity theft, or other unfair or deceptive business practices. Consumers can file complaints online at [(Hyperlink)](https://reportfraud.ftc.gov/#/assistant "https://reportfraud.ftc.gov/#/assistant") or by calling 1-877-FTC-HELP. The FTC is actively encouraging consumers to report AI-powered scams. In addition to the FTC’s standard reporting mechanism, the FTC maintains a separate reporting mechanism for “misconduct by technology platforms”. Consumer organisations or other advocacy groups often also file complaints or petitions with the FTC. Consumer groups have filed complaints with the FTC alleging unfair or deceptive practices with respect to, for example, Facebook’s facial recognition practices, Instagram influencers’ failure to disclose that they were being paid for endorsements, and companies’ allegedly unfair practices with respect to scoring individuals for employment and other purposes. These complaints are often sent to the FTC’s Office of Secretary and Commissioners’ offices. Businesses can also file complaints with the FTC through these same channels. Another path for business complaints is through a self-regulatory organisation such as the Better Business Bureau National Programs (“BBBNP”). When a business files a complaint about a competitor’s advertisement with the Better Business Bureau (“BBB”), it has specialised procedures to resolve these issues. If it finds that an advertisement violates its guidelines, and the Company declines to remedy the violation, the BBB can refer the matter to the FTC for enforcement. As one example, the Children’s Advertising Review Unit, a subdivision of the BBBNP, referred the company Musical.ly (predecessor to TikTok) to the FTC for allegedly violating COPPA, and the FTC subsequently brought an enforcement action. **6\.4 What is the timeline for a typical investigation?** A typical FTC investigation will take at least one year, and often longer. **6\.5 Are there criminal penalties for non-compliance with a consumer law investigation? If so, provide examples where such penalties have been imposed.** Usually, the FTC does not have the authority to seek criminal penalties. However, the FTC’s Criminal Liaison Unit assists prosecutors with criminal consumer fraud cases, often by sharing evidence of knowledge of fraud that is developed through the FTC’s civil investigations. In 2021, prosecutors who partnered with the FTC obtained 30 convictions or guilty pleas in new or pending cases. *See* [(Hyperlink)](https://www.ftc.gov/enforcement/criminal-liaison-unit/results "https://www.ftc.gov/enforcement/criminal-liaison-unit/results") . As one example of civil and criminal cooperation, in 2017 the FTC and DOJ jointly brought civil and criminal charges, respectively, against Western Union alleging consumer fraud, aiding and abetting wire fraud, and failing to have an effective anti-money laundering programme. Western Union entered a global settlement that included a \$586 million judgment, a permanent injunction and a deferred prosecution agreement. More recently, in 2025, the FTC and DOJ weighed in on the applicability of antitrust laws to environmental, social, and governance initiatives by filing a Statement of Interest in a multistate antitrust case against asset managers BlackRock, State Street, and Vanguard, a case led by Texas AG Ken Paxton. The FTC has also recently included in their 2025 antitrust guidelines, jointly released with the DOJ, that no-poach agreements and wage fixing could lead to criminal charges against both individuals and companies. **6\.6 Can investigations be resolved by way of commitments or undertakings?** Yes, and this is typical. FTC investigations are usually resolved by a consent order. Violations of administrative consent orders subject defendants to civil penalties. 15 USC § 45(l). Violation of federal orders can lead to remedies within a judge’s discretion, including contempt of court. ### 7\. **Enforcement** **7\.1 How does/do the consumer authority/authorities seek to enforce consumer law (e.g., by administrative decision or by commencing proceedings in court)?** Enforcement by the FTC may be achieved through administrative action, judicial action, or both. **7\.2 Is/are the consumer protection authority/authorities bound by a time limit to commence proceedings on breaches?** There is no statute of limitations when the FTC seeks an injunction in connection with ongoing conduct. There is a five-year statute of limitations for seeking civil penalties, 28 USC § 2462, and a three-year statute of limitations for redress that the Commission would seek in connection with a rule violation. 15 USC § 57b(d). **7\.3 Where regulators/enforcement bodies have a choice of enforcement tools/powers, what considerations do they take into account in determining which tools/powers to use?** The FTC’s choice of administrative or federal court largely depends on the types of remedies it is seeking. If the FTC is seeking civil penalties, it must work with the DOJ or another federal agency with direct authority to litigate civil penalties in federal court, such as the CFPB. Civil penalties are not available in an administrative proceeding. If the FTC is seeking disgorgement or restitution and the case involves the violation of an FTC Rule, the FTC is entitled to this relief in federal district court directly. If the FTC is seeking disgorgement or restitution in other matters, it would have to allege that the law violation was “dishonest or fraudulent”, and would first have to file an administrative action before being able to seek disgorgement or restitution. For purely injunctive relief, the FTC often files actions administratively because any violation of the administrative action would subject defendants to civil penalties. **7\.4 Describe the relevant rules and procedures that must be followed by such bodies (e.g., administrative, judicial).** In the administrative forum, the ALJ presides over adjudications with broad power to compel testimony from parties and non-parties alike. These powers include issuing subpoenas, taking depositions or causing them to be taken, compelling admissions, holding settlement conferences, making initial decisions, and holding parties in contempt if they fail to comply with the ALJ’s orders. 16 CFR § 3.42. In a federal district court, proceedings are governed by the Federal Rules of Civil Procedure, which allow parties to conduct discovery and gather evidence, from both parties and non-parties. For example, Rule 45 allows for subpoenas that can compel testimony, the production of documents, electronically stored information or other tangible items. Fed. R. Civ. P. 45(a). **7\.5 Is there a right to a stand-alone action and follow-on right of action within consumer law? Who has standing to bring these actions?** While there is no private right of action under the FTC Act, some federal consumer laws provide a private right of action. Many state laws also provide for private rights of action. For example, California’s FAL empower aggrieved consumers to vindicate their rights in court, and the CCPA provides that “\[a\]ny consumer whose nonencrypted and nonredacted personal information \[…\] is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action”. Cal. Civil Code § 1798.150(a)(1). Plaintiffs can pursue damages and injunctive or declaratory relief. *Id*. Illinois’ BIPA also provides a private right of action. Individual consumers may also bring state common law claims, such as for negligence, fraud, or product liability. Individual consumers must have standing to enforce violations of these laws. There are three elements generally required to establish standing: “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” *Spokeo, Inc. v. Robins*, 578 U.S. 330, 338 (2016). Any injury in fact must also be “concrete and particularized”. *Id*. at 339. **7\.6 Is there a statute of limitations for bringing stand-alone or follow-on actions?** Private actions have statutes of limitations, which vary depending on the specific claim. Three or four years is typical under state consumer laws. **7\.7 Describe how interactions with other regulations and/or regulators are dealt with by the consumer protection authority.** In balancing federal and state authority, the historic police powers of the states are not to be superseded by federal law unless that was the clear and manifest purpose of Congress. *See Rice v. Santa Fe Elevator Corp.*, 331 U.S. 218, 230 (1947). Federal law may preempt state law by express provision or by implication through field or conflict preemption. Several federal consumer statutes prohibit states from imposing new or additional labelling “requirements”. *See, e.g.*, 21 USC § 360k(a); 7 USC § 136v(b). But the statutory language is silent regarding states’ ability to provide remedies for violations of federal law. Courts have held that this statutory construction does not prevent consumers from claiming relief under state laws for violations of federal standards and their state parallels. *See Astiana v. Hain Celestial Grp., Inc.*, 783 F.3d 753, 757 (9th Cir. 2015). This framework facilitates collective enforcement of state and federal violations by state attorneys general, federal regulatory authorities, as well as aggrieved consumers. In public actions, state and federal regulators are increasingly partnering to prosecute high-stakes consumer fraud. In mid-2024, the FTC issued a report detailing the FTC’s law enforcement cooperation with state attorneys general nationwide and presenting best practices to ensure continued effective collaboration regarding consumer fraud. *See* [(Hyperlink)](https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-issues-report-congress-collaboration-state-attorneys-general "https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-issues-report-congress-collaboration-state-attorneys-general") . In one example in furtherance of those efforts, in late 2025, 21 states joined the FTC in a California federal lawsuit accusing Uber of enrolling users into its paid Uber One subscription service without consent and imposing obstacles that deter and prevent consumers cancelling the service. Allegations include violations of both the FTC Act and several state consumer protection laws, reflecting the joint FTC and state attorneys general prosecution efforts. *See Federal Trade Commission v. Uber Technologies Inc*. (No. 3:25-cv-03477) (N.D. Cal.). **7\.8 Describe any international or regional cooperative mechanisms (e.g., MOUs) in which your jurisdiction is involved in the enforcement of consumer protection.** The FTC joins with more than 100 foreign competition and consumer protection authorities around the world and regularly cooperates with foreign authorities on enforcement and policy matters. Some examples follow. ICPEN: the International Consumer Protection and Enforcement Network is a coalition of mostly government organisations that enforce fair consumer practices and share information and best practices with each other. These organisations include the FTC and government offices from other countries, such as Germany, Ireland, Italy, Japan and Mexico. *See* FTC, “International Consumer Protection and Cooperation” [(Hyperlink)](https://www.ftc.gov/policy/international/international-consumer-protection-cooperation "https://www.ftc.gov/policy/international/international-consumer-protection-cooperation") GPEN: the Global Privacy Enforcement Network is an informal network of privacy enforcement authorities that work together to facilitate sharing of information and cooperate on cross-border enforcement of laws protecting privacy. *See* FTC, “Multilateral Memorandum of Understanding For Participation In the Global Privacy Enforcement Network System” (2015), [(Hyperlink)](https://www.ftc.gov/system/files/documents/cooperation_agreements/151026gpen-alert-mou.pdf "https://www.ftc.gov/system/files/documents/cooperation_agreements/151026gpen-alert-mou.pdf") Bilateral agreements: The FTC has entered into at least 22 bilateral cooperation agreements with foreign consumer protection authorities including Australia, Ireland, Mexico, Spain and several Canadian provinces. *See* FTC, “International Cooperation Agreements” [(Hyperlink)](https://www.ftc.gov/policy/international/international-cooperation-agreements "https://www.ftc.gov/policy/international/international-cooperation-agreements") ### 8\. **Appeals** **8\.1 Describe any appeal processes.** In FTC administrative enforcement actions, appeals from the ALJ’s “initial decision” to the full Commission are available to either FTC’s “complaint counsel” or any respondent. In limited cases, including certain merger cases, an appeal from the ALJ’s initial decision is automatic. *See* 16 CFR § 3.52. Upon appeal, the Commission receives briefs, holds oral argument, and thereafter issues its own final decision and order. The FTC Rules of Practice allow for the filing of amicus briefs in support of either side of the appeal, with leave of the Commission. For automatic appeals, the Commission places the appeal on its docket and defines the issues to be briefed by the parties. *See* 16 CFR § 3.53. Unlike appeals in state or federal courts, the Commission reviews the ALJ’s entire decision anew, without deference, including the findings of fact. *See* 16 CFR § 3.54(b). The Commission’s final decision is then appealable, but only by any respondent against which an order is issued. The respondent may file a petition for review with any U.S. court of appeals within whose jurisdiction the respondent resides or carries on business or where the challenged practice was used. 15 USC § 45(c). The case then proceeds from that point along the same path as cases originally filed in the district courts. Just as a case coming up for appellate review from a federal district court receives some deference from the appellate court, so too does a final Commission decision. Specifically, the appellate court reviews questions of law *de novo* but will not disturb factual determinations of the Commission that are supported by substantial evidence. If the federal Court of Appeals affirms the Commission’s order, the court enters its own order of enforcement. The party losing in the court of appeal may seek review by the United States Supreme Court, upon petition for a writ of certiorari. Otherwise, consumers enforcing state law consumer protection claims may appeal through standard civil processes. **8\.2 Can consumers or retailers/manufacturers appeal decisions made by the consumer authority/authorities or by a court?** Consumers are not parties to enforcement actions and thus do not have appellate rights from enforcement decisions. As described above in section 1, there is no private right of action under the FTC Act, and such actions can only be brought by the agency. The FTC and defendant retailers/manufacturers, however, can appeal administrative enforcement decisions as described in response to question 8.1 above. Consumers (and retailers/manufacturers) have full appellate rights in private civil litigation to which they are parties that are originated in state or federal courts and brought under state law like California’s CLRA or UCL or under federal statutes like ECOA, TCPA, FCRA, etc. Appeals in private litigation follow the normal court appellate rules, whereby only final judgments or orders that dispose of all claims as to all parties are automatically appealable. Certain interlocutory orders are subject to discretionary appeal, such as class certification orders, orders denying motions to compel arbitration, “collateral” orders (orders on issues unrelated to the merits of the suit), certain kinds of sanctions orders, attorney disqualification orders, etc. **8\.3 Does an appeal suspend the effect of any penalty/the requirement to pay any fine (if applicable)?** The effects of an appeal vary based on circumstances. In administrative actions, a party subject to a cease-and-desist order under § 5 of the FTC Act may apply to the Commission for a stay pending judicial review. *See* 16 CFR § 3.56(b). If, within 30 days after the application was received by the Commission, the Commission either has denied or has not acted on the application, a stay may be sought in a court of appeals where a petition for review of the order is pending. *Id*. An application for stay must state the reasons a stay is warranted and the facts relied upon, and must include supporting affidavits or other sworn statements, and a copy of the relevant portions of the record. The application must also address the likelihood of the applicant’s success on appeal, whether the applicant will suffer irreparable harm if a stay is not granted, the degree of injury to other parties if a stay is granted, and why the stay is in the public interest. *See* 16 CFR § 3.56(c). In court actions seeking injunctive relief, monetary damages, and/or penalties, often an appeal will suspend the defendant’s obligation to pay a penalty. The payment of penalties will generally be stayed on appeal automatically. In deciding whether to stay an order awarding injunctive relief pending appeal, federal courts engage in a similar exercise as the Commission in an administrative appeal, balancing four factors: “(1) whether the stay applicant has made a strong showing that he is likely to succeed on the merits; (2) whether the applicant will be irreparably injured absent a stay; (3) whether issuance of the stay will substantially injure the other parties interested in the proceeding; and (4) where the public interest lies.” *LabMD, Inc. v. FTC*, 678 F. App’x 819 (11th Cir. 2016) (citing *Nken v. Holder*, 556 U.S. 418, 425-26 (2009) (quotation omitted)). ### 9\. **Current Trends and Anticipated Reforms** **9\.1 What are the recent enforcement trends in your jurisdiction and what key trends do you expect in the next 12 months?** **Children’s data privacy** In early 2025, the FTC unanimously moved to strengthen online privacy protections for children in updating the COPPA. The Commission established requirements for online providers to obtain legitimate parental consent before disclosing personal information from children under 13 to third parties for targeted advertising. The new protections also advise against the indefinite retention of children’s data. Children’s privacy issues are expected to remain an ongoing priority for the FTC, and many expect that additional federal legislation will soon follow to further increase protections. **AI and tech** Following its promise to safeguard consumers from the prospective harms of AI, the FTC focused many of its recent enforcement actions on AI-driven consumer harms. Specific focuses included substantiation of AI claims, the safeguarding of personal data in AI systems, and implementing rigorous standards to prevent AI bias and discrimination. The FTC emphasised the importance of upholding prior promises to consumers, including those about whether personal data would be used to train AI models. In late 2024, the FTC brought an enforcement sweep termed “Operation AI Comply” that targeted misrepresentations relating to the efficacy of various AI providers’ capabilities. In one example, the FTC halted company DoNotPay’s misleading claims that the AI service could substitute for the expertise of a human lawyer. Each company targeted by the sweep either settled with the FTC or was issued a temporary restraining order. DoNotPay agreed to a proposed Commission order requiring a \$193,000 payment and issuance of warnings about the limitations of law-related features on the service. Federal lawmakers are also increasingly concerned about the use of AI in healthcare – particularly when used to deny insurance claims in one fell swoop. *See* Bicameral, Bipartisan Letter to Centers for Medicare & Medicaid Services (June 25, 2024) (available at [(Hyperlink)](https://nadler.house.gov/news/documentsingle.aspx?DocumentID=396200 "https://nadler.house.gov/news/documentsingle.aspx?DocumentID=396200") ) (led by Representatives Jerrold Nadler, Judy Chu, and Senator Elizabeth Warren). Healthcare companies are utilising AI tools designed to quickly review insurance claims and issue denials at inflated rates. This saves insurers money by allowing them to employ fewer medical professionals to review claims, and by reducing the benefits paid, at the expense of their insureds’ well-being. Insurance denials lead to serious health complications, some of which are fatal. Several private class action lawsuits have been filed on behalf of insured individuals who were denied coverage due to companies’ use of AI, resulting in the delay or loss of necessary medical care. *See, e.g., Kisting Leung v. Cigna*, 2:23-cv-01477-DAD-CSK (E.D. Cal. 2025) (declining to dismiss plaintiffs’ claims under 29 USC § 1132(a)(3) and UCL in a case where consumer plaintiffs challenged Cigna’s use of an algorithm called PXDX to review and deny claims for diagnostic procedures, with claims for violations of ERISA and the UCL); *Lokken v. UnitedHealth Group*, Inc., 23-CV-03514 (JRT/SGE) (D. Minn. 2025) (declining to dismiss plaintiffs’ claims for breach of contract and breach of the implied covenant of good faith and fair dealing in a case challenging UnitedHealthcare’s use of the nH Predict algorithm to review post-acute care claims); *Barrows v. Humana, Inc*., 3:23-cv-00654-RGJ (W.D. Ky. 2025) (declining to dismiss plaintiffs’ claims for breach of contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment, and common law fraud in a case challenging Humana’s use of the same nH Predict algorithm). As discussed in question 6.1, the FTC is increasingly relying on investigational hearings and compulsory process in matters involving AI, and state attorneys general issue their own CIDs, sometimes through multistate coalitions (both in general and in AI-related matters). Litigation is expanding as well. In February 2026, the nation’s first trial seeking to hold social media companies liable for addicting children began in Los Angeles Superior Court, where thousands of cases are consolidated. Key executives, including Meta CEO Mark Zuckerberg, are expected to testify. *See Social Media Cases*, No. JCCP5255 (L.A. Super. Ct. 2026). In another example, parents sued OpenAI in August 2025, alleging that ChatGPT encouraged their child to take his own life after the chatbot engaged with him about anxiety, self-harm, and suicide methods. The case remains in active discovery. *See Raine v. OpenAI, Inc.*, No. CGC25628528 (S.F. Super. Ct. 2026). **AI-washing** The FTC has expressed concern that AI-related marketing claims are often inaccurate, a misleading practice termed “AI-washing”. Since April 2025, the FTC filed multiple cases alleging that defendants engaged in AI-related deceptive marketing claims, and two of the cases have been resolved – against Workado, LLC and Growth Cave. In the Workado matter, the company claimed that its AI Content Detector was developed using a wide range of material to make it more accurate for average users; however, the AI model powering the AI Content Detector was trained or fine-tuned to effectively classify only academic content. As a result of the Growth Cave matter, defendants, including Growth Cave’s co-CEOs, are permanently banned from marketing and selling business opportunities and credit repair programmes as part of the settlement to resolve allegations that their scheme cost consumers nearly \$50 million in damages. Similar actions are also being brought in the private sector. For example, in a consolidated nationwide class action, consumers alleged that Apple falsely represented what the iPhone 16 could do by promoting AI capabilities (“Apple Intelligence”) that did not exist. The docket reflects that, as of December 2025, the parties reached an agreement in principle to resolve the matter on a class wide basis, with a final settlement expected to be presented for court approval in March 2026. *See Landsheft v. Apple Inc.*, No. 25-cv-02668 (N.D. Cal. 2025). **Focus on racial equity** In recent years, the FTC demonstrated a renewed focus on combatting surveillance, algorithmic bias and other emerging issues that may disproportionately affect communities of colour. Through its Every Community Initiative, the FTC sought to support consumers in historically underserved communities, which may be disproportionately affected by fraud and other consumer issues. These efforts included developing specific resources, conducting outreach and events, initiating law enforcement actions, and conducting research to better identify and understand the equity issues. With the advent of AI, and issues regarding racial bias in AI systems that are now making crucial decisions in housing, health care, and more, the FTC’s enforcement may expand and adapt to tackle these new technological threats to equity. One such example was the FTC’s 2023 settlement with Rite Aid for the company’s discriminatory use of facial recognition software powered by AI. The settlement offers companies a framework for assessing their systems for potential AI bias that has a discriminatory impact. Under the current administration, however, it is uncertain whether the FTC will continue to pursue such cases aggressively. Recent actions, including warning letters to law firms alleging their DEI hiring efforts may constitute unlawful anticompetitive conduct, suggest a shift in enforcement priorities. **9\.2 Are there any proposed reforms to consumer law or policy within the next 12 months?** The CFPB is expected to continue its shift toward limited enforcement under the Trump administration, following personnel changes, workforce reductions, and abandonment of many enforcement matters in 2025. For 2026, the bureau has expressed plans to revise many regulations, including: (1) Regulation B, which implements the ECOA; (2) the Section 1071 small business data collection rule; and (3) the final Section 1033 personal financial data rights rule. But given the administration’s overall priorities and the bureau’s constrained budget, less enforcement activity and rulemaking are expected. The FCC has announced that it will continue its “Delete, Delete, Delete” initiative, aimed at rescinding agency rules and regulations in alignment with the Trump Administration’s larger deregulatory efforts. While earlier efforts focused on eliminating regulations that the FCC claims are tied to obsolete technologies, many expect that the FCC will move to more substantive deregulation in 2026. Separately, the “Make America Healthy Again” (“MAHA”) grassroots movement is expected to continue to pressure the FDA and state regulators into action. For example, as of early 2026, at least 18 states have pursued Supplemental Nutrition Assistance Program (“SNAP”) waivers to render certain items, such as soda, candy, and prepared desserts, ineligible for purchase with government SNAP (food assistance) funds. Select states, such as California and Texas, have adopted new legislation regarding ultra processed foods and warning labels, and this MAHA-attributed trend is expected to continue in 2026. It remains to be seen whether Health and Human Services Secretary Robert Kennedy will pursue a national food standard or continue to encourage state-level regulation. *** ### Production Editor's Note This chapter has been written by a member of ICLG's international panel of experts, who has been exclusively appointed for this task as a leading professional in their field by [Global Legal Group](https://www.glgroup.co.uk/), ICLG's publisher. ICLG's in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style, including anti-plagiarism and AI-detection tools. This chapter was copy-edited by [Hollie Parker](https://iclg.com/meet-the-team), our in-house editor. Read this chapter FREE To download this chapter FREE [Register or log in here](https://iclg.com/free-registration) - ![Chapter - PDF Edition](https://iclg.com/skin/images/iman_white.svg) [Buy **Chapter** in PDF format£100](https://iclg.com/basket/add/chapterpdf_1436_56608) - ![Book Single PDF](https://iclg.com/skin/images/ibook_white.svg) [Buy **the Book** in PDF format£295](https://iclg.com/basket/add/singlebookpdf_1436) ## Contributors [![Ryan J. Clarkson](https://iclg.com/uploads/contributors/PED9v9SaYrjQZikAGJ95sXu9PXlO0k97FwgVsVOx.png)](https://iclg.com/firms/clarkson-law-firm-p-c/ryan-j-clarkson) [Ryan J. Clarkson](https://iclg.com/firms/clarkson-law-firm-p-c/ryan-j-clarkson) [Clarkson Law Firm](https://iclg.com/firms/clarkson-law-firm-p-c) [![Tim Giordano](https://iclg.com/uploads/contributors/5Fn5p0sONOGcQeLcQ3NZIS9krFri1Tv2KRGJ3DTV.png)](https://iclg.com/firms/clarkson-law-firm-p-c/tim-giordano) [Tim Giordano](https://iclg.com/firms/clarkson-law-firm-p-c/tim-giordano) [Clarkson Law Firm](https://iclg.com/firms/clarkson-law-firm-p-c) [![Lauren Anderson](https://iclg.com/uploads/contributors/cEwPGNKmf6TidiQ7vi9mlQJJqkH692pWaKVmrXZ9.png)](https://iclg.com/firms/clarkson-law-firm-p-c/lauren-anderson) [Lauren Anderson](https://iclg.com/firms/clarkson-law-firm-p-c/lauren-anderson) [Clarkson Law Firm](https://iclg.com/firms/clarkson-law-firm-p-c) [![Jiaming (Jay) Zheng](https://iclg.com/uploads/contributors/y8SXGgx3dXpRlcHfrgOjxSoAZNRgJ14CYSO3euPp.png)](https://iclg.com/firms/clarkson-law-firm-p-c/jiaming-jay-zheng) [Jiaming (Jay) Zheng](https://iclg.com/firms/clarkson-law-firm-p-c/jiaming-jay-zheng) [Clarkson Law Firm](https://iclg.com/firms/clarkson-law-firm-p-c) [![Clarkson Law Firm](https://iclg.com/uploads/organisations/b0d9uBNCjnO8EUrZ8iesqsrNydtRsViwPITuku1v.png)](https://iclg.com/firms/clarkson-law-firm-p-c) [Clarkson Law Firm](https://iclg.com/firms/clarkson-law-firm-p-c) ## Latest Briefings - [Class Certification in Consumer and Employment Litigation in California: An Overview](https://iclg.com/briefing/21844-class-certification-in-consumer-and-employment-litigation-in-california-an-overview) ![Publish date](https://iclg.com/skin/images/clock.svg) 06 Nov 2024 - [AI in Healthcare](https://iclg.com/briefing/21822-ai-in-healthcare) ![Publish date](https://iclg.com/skin/images/clock.svg) 04 Nov 2024 ### Related Events [View all](https://iclg.com/conferences) - 29th Apr 2026 [The Future of Consumer Protection: Risks, Rights and Responsibilities](https://iclg.com/conferences/consumer-protection-in-financial-services-staying-ahead-of-a-shifting-landscape) [![Follow us on LinkedIn](https://iclg.com/skin/images/linkedin-icon-white.svg)Follow us on LinkedIn](https://www.linkedin.com/showcase/international-comparative-legal-guides-iclg/posts/?feedView=all) [![ICLG Logo](https://iclg.com/skin/images/glg2024/iclg_logo_header.svg)](https://iclg.com/) [Terms & Conditions](https://iclg.com/terms-and-conditions) [Testimonials](https://iclg.com/testimonials) [Contact Us](https://iclg.com/contact-us) [Our Blog](https://iclg.com/blog) [About Us](https://iclg.com/about-us) [Contributor Login](https://iclg.com/briefing/sendcontent) The International Comparative Legal Guides and the International Business Reports are published by: Global Legal Group [![LinkedIn](https://iclg.com/skin/images/linkedin-icon.svg)](https://www.linkedin.com/showcase/international-comparative-legal-guides-iclg/posts/?feedView=all) [![Twitter](https://iclg.com/skin/images/twitter-icon.svg)](https://x.com/ICLG_GLG) [![Facebook](https://iclg.com/skin/images/facebook-icon.svg)](https://www.facebook.com/globallegalgroup) Excellent website. Found it very useful for my LLM thesis Enyinnaya Uwadi - Bixer Partners, Abuja, Nigeria [![Global Legal Group](https://iclg.com/skin/images/glg2024/glg_logo_white.svg)](https://www.glgroup.co.uk/) 59 Tanner Street, London SE1 3PL, UK [customer.service@glgroup.co.uk](mailto:customer.service@glgroup.co.uk) \| +44 207 367 0720 © 2002-2026 Copyright: ICLG.com \| [Privacy policy](https://iclg.com/privacy-policy) \| [Consent Preferences](https://iclg.com/practice-areas/consumer-protection-laws-and-regulations/usa) \| [Cookie policy](https://iclg.com/cookie-policy) \| [Terms of Use](https://www.glgroup.co.uk/terms-of-use) \| [Conditions of Sale](https://www.glgroup.co.uk/conditions-of-sale) ![Zoominfo pixel](https://ws.zoominfo.com/pixel/ykoa47bE6FclZOXeMmWE) ![Linkedin Tracking Pixel](https://px.ads.linkedin.com/collect/?pid=464386&fmt=gif) ![](https://www.astute-7-visionary.com/808470.png)
Readable Markdown
![The ICLG to: Consumer Protection Laws and Regulations](https://iclg.com/uploads/publications/images/small/rWK5PcIuq2Xu383ZEvGizNHpNq4XIfQH2HH661mp.png) ## Consumer Protection Laws and Regulations USA 2026 **ICLG - Consumer Protection Laws and Regulations** - USA Chapter covers common issues in consumer protection laws and regulations, including substantive provisions, enforcement action, current trends and anticipated reforms. Published: 10/04/2026 ## Chapter Content Free Access 1. 1\. **General** 2. 2\. **Protections in Relation to the *Quality*, *Function* and *Safety* of Goods and Services** 3. 3\. **Prohibitions Relating to “Conduct” Against Consumers** 4. 4\. **Specific Applications of the Rules and Protections** 5. 5\. **Other Protections/Prohibitions** 6. 6\. **Investigation of Potential Breaches** 7. 7\. **Enforcement** 8. 8\. **Appeals** 9. 9\. **Current Trends and Anticipated Reforms** ### 1\. **General** **1\.1 What legislation, regulations and guidelines are relevant to consumer protection in your jurisdiction?** United States law protects consumers at the federal and state levels. Select federal consumer protection statutes, which apply nationwide, include the Federal Trade Commission Act (“FTC Act”), the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”), the Gramm-Leach-Bliley Act (“GLB Act”), the Truth in Lending Act, the Fair Credit Reporting Act (“FCRA”), the Fair Debt Collection Practices Act, the Equal Credit Opportunity Act (“ECOA”), the Identity Theft and Assumption Deterrence Act, the Children’s Online Privacy Protection Act (“COPPA”), the Telephone Consumer Protection Act (“TCPA”), the Video Privacy Protection Act, the Federal Tort Claims Act, the Consumer Product Safety Act (“CPSA”), the Federal Food, Drug and Cosmetic Act (“FDCA”), the Magnuson Moss Warranty Act, the Lanham Act, and the Securities Exchange Act of 1934. Previously, under the Biden administration, the Federal Trade Commission (“FTC”) and the Consumer Financial Protection Bureau (“CFPB”) pursued an expansive consumer protection agenda, with a focus on rulemaking to complement enforcement actions. Newer rule initiatives focused on addressing unfair and deceptive business practices related to multi-level marketing schemes, for-profit colleges, “gig” employment opportunities, telemarketing, automotive “junk fees”, government impersonation, and commercial surveillance. The Trump administration has since significantly reduced consumer protection enforcement. For example, the CFPB withdrew nearly 70 guidance documents in 2025, citing the administration’s mandate to eliminate regulations and reduce costs for businesses. The One Big Beautiful Bill Act, signed by Trump on July 4, 2025, nearly halved the CFPB’s budget, cutting its cap of Federal Reserve operating expenses from 12 per cent to 6.5 per cent. Federal regulations also continue to evolve alongside the increasingly online consumer marketplace. For example, the FTC instituted a regulation that prohibits selling or purchasing fake consumer reviews or testimonials without clearly disclosing the relationship to consumers. 16 CFR 465. This aims to prevent companies from deceiving consumers through the use of fake reviews, suppression of negative reviews, and paying for positive reviews. The FTC is also evaluating how best to combat and prevent the harmful effects of Artificial Intelligence (“AI”). For example, the FTC ran an exploratory challenge named “Voice Cloning Challenge” to encourage the development of multidisciplinary approaches – from products to polices to procedures – aimed at protecting consumers from AI-enabled voice cloning harms. Top submissions include proposals from organisations and professors at universities, which will split \$35,000 in prize money. In another example, the FTC sued to stop Air AI from using deceptive claims about business growth, earnings potential, and refund guarantees to bilk millions from small businesses. In 2025, the FTC shifted from the Biden-era emphasis on broad rulemaking toward more targeted and case-by-case investigations, focusing on anticompetitive and sector-specific enforcement in areas such as healthcare and tech. For example, the FTC secured a historic \$2.5 billion settlement with Amazon over allegations that the company used deceptive sophisticated subscription traps designed to manipulate consumers into enrolling in Prime memberships without their knowledge and made it unduly hard to cancel those subscriptions. The FTC also ordered the nation’s largest pet cremation business, Gateway Services, Inc., to stop enforcing restrictive noncompete agreements that bind nearly 1,800 workers. FTC Chairman Andrew N. Ferguson sent letters to several large healthcare employers and staffing firms urging them to conduct a comprehensive review of their employment agreements – including any noncompete or other restrictive agreements – to ensure they are appropriately tailored and comply with the law. At the federal legislative level, Section 230 of the Communications Decency Act, which generally protects online platforms from liability for user-generated content, remains the subject of great debate. Its original justification – to encourage the growth and development of the internet in its early years – is no longer valid. With more and more dangerous platforms proliferating online, in the AI space and otherwise, many now believe platforms should be held accountable for the consumer and other harms they enable. Despite this growing view, it remains to be seen whether any legislative change will follow. A narrower interpretation of immunity might also be successfully advanced in courts, given that the increasingly digital world in which we now live and work could not have been anticipated when Section 230 was passed. In addition to federal law, most states have one or more consumer protection statutes that prohibit unfair and deceptive business practices within their borders. States with the broadest, most flexible prohibitions thus affording the greatest consumer protections include California, Connecticut, Hawaii, Illinois, Massachusetts, New York and Vermont. Perhaps the best-known examples of state consumer protection statutes are California’s Consumers Legal Remedies Act (“CLRA”) and New York’s General Business Law. Powerful examples of state privacy legislation are the Illinois Biometric Information Privacy Act (“BIPA”), and the California Consumer Privacy Act (“CCPA”). **1\.2 What is the definition of “consumer” (i.e., who does consumer protection law protect)?** Consumer protection laws safeguard purchasers of goods and services against defective products and deceptive, fraudulent business practices. The definition of “consumer” is statute-specific and varies depending on the nature of the goods or services being regulated. For example, under the Uniform Commercial Code (“UCC”), a collection of laws adopted by most states to regulate interstate commercial transactions, “‘consumer’ means an individual who enters into a transaction primarily for personal, family, or household purposes”. UCC § 1-201. Under the Dodd-Frank Act, which overhauled financial regulation after the Great Recession of 2007–09, “‘consumer’ means an individual or an agent, trustee, or representative acting on behalf of an individual”. 12 USC § 5481(4). Under the FCRA, which restricts the use of information held by consumer reporting agencies, the term simply “means an individual”. 15 USC § 1681(a)–(c). The TCPA protects businesses as well as natural persons against telephone solicitation. 47 USC § 227. Under state law, the definition of “consumer” may be limited to an “individual who seeks or acquires, by purchase or lease, any goods or services for personal, family, or household purposes” – *see*, *e.g.*, Cal. Civ. Code § 1761(d) – but some statutes sweep more broadly. For example, under the Texas Deceptive Trade Practices and Consumer Protection Act, the definition of consumer includes “an individual, partnership, corporation, this state, or a subdivision or agency of this state who seeks or acquires by purchase or lease, any goods or services”. Tex. Bus. & Com. Code § 17.45(4). **1\.3 Who is/which entities are required to comply with consumer protection law?** The entities governed vary by statute. For example, the FTC Act applies to “persons, partnerships, or corporations, except banks, savings and loan institutions \[…\], Federal credit unions \[…\], common carriers \[…\], and persons, partnerships, or corporations insofar as they are subject to the Packers and Stockyards Act”. 15 USC § 45(a)(2). The Dodd-Frank Act applies to “any person that engages in offering or providing a consumer financial product or service”, as well as affiliates of such persons. 12 USC § 5481(6). State consumer protection laws typically provide broad prohibitions that apply to anyone engaged in commercial conduct. For example, the Connecticut Unfair Trade Practices Act provides that “\[n\]o person shall engage in unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce”. Conn. Gen. Stat. § 42-110b(a). Many statutes, however, carve out specific exceptions. For example, the Pennsylvania Unfair Trade Practices and Consumer Protection Law imposes a standard of strict liability on businesses but contains an exemption for media entities that publish deceptive advertisements in good faith and without knowledge of the deception. 73 Pa. State. § 201-3. **1\.4 Which agency/agencies is/are responsible for enforcing consumer protection law (i.e., who is the investigator and who is the adjudicator)?** Various federal agencies enforce consumer protection laws, including the FTC, the CFPB, the Federal Communications Commission (“FCC”), the Consumer Product Safety Commission (“CPSC”), the Food and Drug Administration (“FDA”), and the United States Department of Agriculture (“USDA”). Some federal enforcement may begin to see new limits in the coming years. For example, the One Big Beautiful Bill Act, signed on July 4, 2025, reduced the CFPB’s operating budget by nearly half. At the state level, each Attorney General (“AG”) investigates and enforces consumer protection laws; in some states, District Attorneys also have the authority to prosecute consumer protection claims. In California, the Department of Consumer Affairs has an internal division that is authorised to investigate consumer complaints and enforce state consumer protection laws. Many state consumer protection laws also include a private right of action, empowering consumers to vindicate rights in court parallel to, or independent of, government action. These private actions serve as a critical “gap” filling measure to ensure greater legal compliance and accountability than regulatory action alone could achieve. In some states, individuals are required to give advance notice of the alleged deceptive practices to the business, prior to filing in court. This creates a safe harbour period during which the business may address the individual’s claims and avoid legal liability or other penalties. ### 2\. **Protections in Relation to the *Quality*, *Function* and *Safety* of Goods and Services** **2\.1 Please describe any protections regarding the quality and function of goods and services acquired by consumers.** At the federal level, agencies such as the FDA and USDA promulgate regulations regarding the quality and function of goods and services such as foods, drugs, and agriculture. At the state level, the UCC, which has been almost universally adopted, contains provisions relating to express and implied warranties. *See* UCC §§ 2-313–2-315. Some state statutes have requirements pertaining to the quality of goods. For example, California’s CLRA prohibits “\[r\]epresenting that goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that they do not have or that a person has a sponsorship, approval, status, affiliation, or connection that the person does not have”. Cal. Civ. Code § 1770(a)(5). Many states also recognise common law claims for fraud or breach of express and implied warranties. Turning to the safety of goods and services, at the federal level, the CPSA exists: “(1) to protect the public against unreasonable risks of injury associated with consumer products; (2) to assist consumers in evaluating the comparative safety of consumer products; (3) to develop uniform safety standards for consumer products and to \[minimise\] conflicting State and local regulations; and (4) to promote research and investigation into the causes and prevention of product-related deaths, illnesses, and injuries.” 15 USC § 2051(b). The Motor Vehicle Safety Act “prescribe\[s\] motor vehicle safety standards”. 49 USC § 30101(1). The FDCA seeks to ensure the safety of food, drugs, medical devices and cosmetics. *See* 21 USC §§ 301 *et seq*. There are also numerous federal laws dealing with the safety of various agricultural products. *See*, *e.g*., 21 USC §§ 451 *et seq*. (relating to poultry inspection and safety); and 21 USC §§ 601 *et seq*. (relating to meat inspection and safety). In addition, there are various state laws to ensure the safety of consumer goods and services. *See*, *e*.*g*., California Sherman Act, Cal. Health & Safety Code § 109875 *et seq*. (California’s version of the FDCA, establishing parallel state regulation of the safety of food, drugs, medical devices and cosmetics); 16 Tex. Admin. Code §§ 82.1 *et seq*. (relating to barber shop regulations); and *id*. §§ 83.1 *et seq*. (relating to cosmetology regulations). State and federal laws also affect safety through labelling and disclosure requirements. For example, California Proposition 65 provides that “\[n\]o person in the course of doing business shall knowingly and intentionally expose any individual to a chemical known to the state to cause cancer or reproductive toxicity without first giving clear and reasonable warning to such individual”. Cal. Health & Safety Code § 25249.6. Many states also recognise relevant common law claims, including, for example, product liability and negligence. **2\.2 Please outline the substantive tests for these protections.** The substantive tests vary depending on the goods or services, as well as the regulations or guidelines at issue. Under the UCC, if the seller makes any promise or provides a description or model relating to the goods, the goods must conform. *See* UCC § 2-313. The goods must also: “pass without objection in the trade”; “in the case of fungible goods, \[be\] of fair average quality”; be “fit for the ordinary purposes”; “run, within the variations permitted by the agreement”; be “adequately contained, packaged, and labelled”; and “conform to the promise or affirmations of fact made on the container or label if any”. *Id*. § 2-314(2). Furthermore, if the seller had reason to know the buyer was acquiring the goods for a particular purpose, the goods must be fit for that purpose. *See id*. § 2-315. Other state law substantive tests vary by jurisdiction. For safety, the substantive tests vary depending on the governing law or regulation and range from specific to broad. For example, the CPSC broadly prohibits the sale of consumer products that contain a defect which could create a substantial product hazard and products that create an unreasonable risk of serious injury or death. However, there are also very specific requirements for some products. For example, it is deemed a substantial hazard for “\[c\]hildren’s upper outerwear in sizes 2T to 16” to “hav\[e\] one or more drawstrings”. 16 CFR § 1120.3(b)(1). The related “standard prohibits drawstrings at the hood and neck area of children’s upper outerwear” and imposes specific limitations on the use of drawstrings in the waist or bottom of children’s upper outerwear. *See* [(Hyperlink)](https://www.cpsc.gov/FAQ/Drawstrings-in-Children%E2%80%99s-Upper-Outerwear "https://www.cpsc.gov/FAQ/Drawstrings-in-Children%E2%80%99s-Upper-Outerwear") **2\.3 What types of goods and services are covered by the protections?** All goods and services sold to the American public for individual use are subject to state and federal laws which regulate their transparency, fitness for sale, and potential for fraud. The types of legal protections afforded depend on the good or service and the source of protection. For example, the UCC applies to commercial goods. *See* UCC § 2-102. The FDA promulgates Current Good Manufacturing Practice regulations for the quality of drug products. *See* 21 CFR Part 210; 21 CFR Part 211. The USDA sets quality standards for various agricultural products including meat, eggs, fruits, and vegetables. *See*, *e.g.*, 21 USC § 606 (relating to the inspection of meat products). Regarding consumer safety, the blend of federal, state, and local laws, regulations, guidelines, and ordinances covers a wide range of consumer products and services. Together with the availability of common law claims, few if any consumer products or services escape safety protections. **2\.4 Are there any exceptions to these protections?** Exceptions are sometimes available and vary by law or regulation. For example, the UCC generally applies to all commercial sales of goods, but parties may contractually modify the protections available to businesses. *See*, *e.g.*, UCC § 2-316 (relating to the exclusion or modification of warranties). As set forth in question 2.3, few if any consumer products or services are excluded altogether from safety protections. **2\.5 What remedies are available for a breach of the protections in relation to the quality, function and safety of goods and services?** If a breach of these protections involves a product defect or risk of a safety hazard to consumers, the remedies can involve enforcement by a federal or state regulatory agency. For example, when a defective product regulated by the FDA has entered the marketplace, the agency can issue a recall. *See*, *e.g.*, 21 USC § 3501. Similarly, the USDA has authority to detain and seize defective products for which it has regulatory authority. *See id*. §§ 672–73. Violations of FDA or USDA regulations may also result in criminal or civil penalties. *See*, *e.g.*, *id*. §§ 333 & 335b. Under the UCC, “\[t\]he measure of damages for breach of warranty is the difference at the time and place of acceptance between the value of the goods accepted and the value they would have had if they had been as warranted”. UCC § 2-714(2). At common law, remedies may include replacement of the defective product, damages, or contractually agreed-to liquidated damages, in circumstances where damages are difficult to calculate. Individuals may also pursue monetary and injunctive relief in states that provide a private right of action. For example, California’s CLRA authorises private civil actions against companies that use “unfair methods of competition and unfair or deceptive acts or practices”, including “\[r\]epresenting that goods or services are of a particular standard, quality, or grade \[…\] if they are of another”. Cal. Civil Code. § 1770(a)(7). Remedies available under the CLRA are wide-ranging, and include monetary damages, punitive damages, restitution, and injunction, as well as attorneys’ fees. *Id*. at § 1780(a). Consumer-plaintiffs often bring parallel claims under California’s Unfair Competition Law (“UCL”), which offers similar protections against deceptive business practices. Under the UCL “the primary form of relief available \[…\] to protect consumers from unfair business practices is an injunction”. *In re: Tobacco II Cases*, 46 Cal. 4th 298, 319, 93 Cal. Rptr. 3d 559, 575 (2009). Under the UCL and CLRA, as well as California’s False Advertising Law (“FAL”), consumers may also pursue public injunctive relief, which has the primary purpose and effect of stopping unlawful acts that threaten the general public. *McGill v. Citibank, N.A*., 2 Cal. 5th 945, 955, 216 Cal. Rptr. 3d 627, 633 (2017). For safety violations, remedies include product recalls or seizures and civil or criminal penalties. Individuals may also seek injunctive relief and/or compensatory and punitive damages through a private civil action (individual or class action). **2\.6 Who has or which agencies have standing to initiate proceedings for a breach?** If a breach of the protections in relation to the quality or function of goods involves a product defect or risk of a safety hazard to consumers, then various federal and state agencies may have the authority to initiate proceedings for the breach. For example, under certain circumstances, the CPSC, FDA and USDA have authority to request (and in some cases, mandate) the removal of defective products from the marketplace. In addition, these agencies may coordinate with the Department of Justice (“DOJ”) to bring enforcement actions which may result in civil or criminal penalties. The USDA’s Food Safety Inspection Service may also bring an enforcement action that results in a food establishment’s loss of ability to produce, sell, or distribute its products in commerce. *See* 9 CFR § 500.6. For breaches of warranty under the UCC or common law, the injured party may bring a civil action to seek damages or injunctive relief. Individual consumers may also initiate individual or class action proceedings for a breach of state statutory or common law duties. **2\.7 Describe at least two examples of public or private enforcement of these protections in the last five years, including the conduct/alleged conduct, result and penalties imposed.** Public and private enforcement relating to product quality and function has been active over the past five years. On the federal level, the FTC has targeted deceptive user interface designs and hidden fees. These practices are known as “dark patterns” and “junk fees”, respectively. In September 2025, the FTC secured a landmark \$2.5 billion settlement with Amazon.com, Inc. after alleging that Amazon used sophisticated dark patterns to trick consumers into enrolling in automatically renewing Prime subscriptions without informed consent and made cancellation unduly difficult. The settlement enjoins Amazon from employing these practices, including the use of misleading prompts such as “No, I don’t want Free Shipping”. *See* [(Hyperlink)](https://www.ftc.gov/legal-library/browse/cases-proceedings/2123050-amazoncom-inc-rosca-ftc-v "https://www.ftc.gov/legal-library/browse/cases-proceedings/2123050-amazoncom-inc-rosca-ftc-v") At the state level, in early 2025, the Connecticut AG obtained a \$1.5 million judgment against Carvana LLC, an online car dealer, resolving claims that Carvana delayed sending title documents to buyers, failed to advance timely payments to sellers, and provided poor customer service. The complaint alleged deceptive and wilful unfairness under the Connecticut Unfair Trade Practices Act. The judgment requires Carvana to comply with state title and registration requirements, strengthen customer service systems, and use “best efforts” to accurately describe specific features of the automobiles it sells. *See State of Conn. v. Carvana LLC* (No. HHD-CV25-6196604-S) (Conn. Superior Court, Hartford Judicial District). In an example of successful private enforcement, in late 2024, consumers achieved a \$9.2 million class action settlement to resolve claims involving Dr. Dennis Gross brand skin care products advertised as containing collagen when they did not contain collagen. This is one of the largest false advertising settlements ever in the skincare industry, providing consumers with nearly full restitution, up to \$380 per consumer. The company also agreed to no longer sell products labelled as “+ collagen” unless they in fact contained collagen, relief that will benefit consumers worldwide. *See Kandel, et al., v. Dr. Dennis Gross Skincare, LLC* (No. 1:23-cv-01967-ER) (S.D.N.Y.). Product-safety enforcement has been similarly robust. For example, in early 2025, Fitbit agreed to pay \$12.25 million to resolve CPSC’s allegations that it failed to promptly report that its popular smartwatch products frequently overheated and severely burned some consumers. In a statement following resolution of these claims, the CPSC emphasised its commitment to holding companies responsible for continuing to sell dangerous products despite knowing these products can cause serious injury or death. In addition to the financial penalty, Fitbit must maintain internal controls and procedures to ensure the company complies with the CPSA. Private litigation has also targeted safety issues. In *In re: Procter & Gamble Aerosol Products Marketing & Sales Practices Litigation*, consumers alleged that various aerosol personal care products were contaminated with benzene, a known carcinogen, and that P\&G failed to properly disclose the risk to consumers. The parties reached an \$8 million settlement to resolve the allegations, providing monetary payment to consumers based on the number of products they purchased. P\&G also agreed to buttress its health and safety practices by implementing material testing, “finished product” testing, and other measures to monitor for benzene contamination in the future. *See In re: Procter & Gamble Aerosol Products Marketing & Sales Practices Litigation*, No. 2:22-MD-03025 (S.D. Ohio). Another high-profile example of private enforcement is a consumer class action recently filed against Apple, alleging that the Apple Watch Sport Band products contain perfluorohexanoic acid, a toxic perfluoroalkyl and polyfluoroalkyl substance (“PFAS”), in hazardous amounts that substantially exceed Apple’s own internal standards and other thresholds for safety by 40.8 times. *See Cavalier et al. v. Apple Inc.*, No. 5:2025-cv-00713 (N.D. Cal.). Apple has moved to dismiss the action, and the court has not yet ruled. Finally, in January 2026, a federal court certified a Rule 23(b)(3) class in mass litigation alleging that 9Lives, Kibbles ‘n Bits, and Meow Mix misled consumers by marketing their products as healthful despite containing titanium dioxide and packaging that contained, or risked containing, PFAS. *See Jeruchim v. J.M. Smucker Co.*, No. 22-cv-06913-WHO, 2026 U.S. Dist. LEXIS 12228 (N.D. Cal. Jan. 22, 2026). The court’s strong certification order may help pave the way for class certification in the Apple PFAS matter and other PFAS-related cases still in earlier stages. ### 3\. **Prohibitions Relating to “Conduct” Against Consumers** **3\.1 Please describe any protections/prohibitions relating to the conduct of persons or businesses (e.g., manufacturers/retailers) which sell or supply goods and services to consumers (“Conduct”). For example, misleading and deceptive Conduct, unconscionable Conduct, etc.** The most generally applicable federal consumer protection statute regulating conduct in the United States is the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce”. 15 USC § 45(a)(1). The federal Lanham Act also contemplates civil lawsuits for false advertising that “misrepresents the nature, characteristics, qualities, or geographic origin” of goods or services. 15 USC § 1125(a)(1)(B). Most states have adopted statutes that prohibit unfair or deceptive business and debt-collection practices. For example, California has three statutes prohibiting unfair or deceptive business practices: the CLRA, which streamlines class certification and provides for both legal and equitable relief; as well as the UCL and FAL, which limit available remedies to injunctive relief and restitution. **3\.2 Please outline the substantive tests for the above-mentioned protections/prohibitions.** Under federal law, a deceptive practice is one that “misleads the consumer acting reasonably in the circumstances, to the consumer’s detriment”. *See* FTC’s Policy Statement on Deception (1983), [(Hyperlink)](https://www.ftc.gov/legal-library/browse/ftc-policy-statement-deception "https://www.ftc.gov/legal-library/browse/ftc-policy-statement-deception") . A practice is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition”. 15 USC § 45(n). The FTC also has the authority to promulgate Rules under the FTC Act that specify particular acts or practices that are unfair or deceptive. In some cases, Congress directs the FTC to promulgate a specific Rule. Selected Rules enforced by the FTC include the following: the Business Opportunity Rule imposes disclosure requirements for business opportunity sellers to prospective buyers, in order to provide buyers with sufficient information to assess the risks of a business opportunity; the CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing Act) Rule defines the criteria for ascertaining the “primary purpose” of a commercial e-mail, requiring warning labels on commercial e-mails that have sexually explicit material and prohibiting charging a fee and other opt-out barriers; the COPPA Rule implements COPPA by imposing rules on operators of websites and online services that either have actual knowledge that they collect information on children under 13 on their services or are directed to children under 13; the Franchise Rule requires franchisors to provide specific disclosures to franchisees, so they have sufficient information to properly make an investment in a franchise; the Health Breach Notification Rule requires vendors of personal health records and related entities to notify consumers after a breach involving unsecured information, with specific requirements for timing, method and the content of the notification; and the Made in USA Rule states that marketers making unqualified claims that their products are made in the United States should be able to prove those claims. Analogous state law claims such as the California statutes described in question 3.1 employ a “reasonable consumer” test that evaluates false and misleading business practices from the vantage of an ordinary consumer. *See*, *e.g.*, *Williams v. Gerber Prods. Co.*, 523 F.3d 934, 938 (9th Cir. 2008). **3\.3 What types of goods and services are covered by these protections/prohibitions? Is the payment of a price for these goods/services always required for their enforceability?** The FTC Act covers all goods and services “in or affecting commerce”, 15 USC § 45(a)(2); most state protections against unfair or deceptive practices also apply broadly across the spectrum of commercial goods and services. Payment of a price for goods or services is not always required for enforceability under state law. California’s UCL, for example, provides a private right of action for corporate entities to sue their business competitors for unfair or deceptive practices. While the plaintiff corporation must demonstrate economic loss to its business caused by the defendant company’s unfair or deceptive practices, it need not have tendered money directly for goods or services offered by the defendant. **3\.4 Are there any exceptions/exemptions to the protections/prohibitions relating to Conduct?** The FTC Act does not apply to banks, savings and loan institutions, federal credit unions, common carriers, or non-profit entities, among others. *See* 15 USC § 45(a)(2). **3\.5 What remedies are available for a breach of the protections/prohibitions relating to Conduct?** At the federal level, unfair or deceptive acts or practices proscribed under § 18(a)(1)(B) of the FTC Act are subject to a statutory civil penalty of \$50,120 per violation if the FTC can demonstrate (1) the perpetrator of the unfair or deceptive practices had actual knowledge that their conduct was in violation of the FTC Act, and (2) the FTC had already issued a written decision that such conduct was unfair or deceptive. Additionally, many state consumer protection laws provide remedies for victims of false and deceptive conduct, including statutory damages, restitution, and injunction relief. Typically, these lawsuits proceed as class actions. **3\.6 List at least two examples of public or private enforcement of the protections relating to Conduct in the last five years, including the breach/alleged breach, result and penalties imposed.** Public and private enforcement over the past five years reflects the breadth of conduct targeted, as well as significant penalties imposed. In September 2025, Amazon reached a \$2.5 billion settlement with the FTC to resolve claims that it violated the Restore Online Shoppers’ Confidence Act by failing to (i) clearly disclose Prime subscription terms, (ii) obtain informed consent from customers before charging them, and (iii) offer a simple mechanism for cancellation. Under the settlement, Amazon will pay a \$1 billion civil penalty and issue \$1.5 billion in refunds to approximately 35 million affected consumers. The civil penalty is the highest ever assessed in a case involving an FTC rule violation, and the refund amount is the second-highest restitution award for a commission action. Another major example of public enforcement occurred in December 2025, when Maplebear Inc. (Instacart) agreed to a \$60 million settlement with the FTC related to allegations that it deceptively advertised “free delivery” on first orders while charging a service fee and failed to clearly disclose subscription terms. The settlement requires Instacart to stop misrepresenting delivery costs and to clearly disclose any restrictions on its money-back guarantees, along with other forward-looking measures to increase transparency for consumers. State regulators have also been active. In January 2026, the California Department of Financial Protection and Innovation imposed a \$500,000 penalty on crypto-backed loan company Nexo Capital Inc. to resolve claims it failed to obtain a valid licence while making high-risk loans to California consumers, and for overcollateralising loans to California borrowers. The settlement also requires Nexo to transfer all funds belonging to California residents to a properly licensed entity. Private enforcement has produced substantial results as well. In April 2023, a federal court in New York granted final approval of a \$7.8 million settlement, the highest ever settlement for a false advertising claim concerning preservatives. The settlement resolved claims that Celsius falsely advertised its popular drink products as having “no preservatives” despite the presence of citric acid. Class members received reimbursements of up to \$250, and the Company agreed to remove the challenged label claim. *Hezi, et al. v. Celsius Holdings Inc*., No. 1:21-CV-9892-VM (S.D.N.Y.). In October 2024, consumers secured a \$9.2 million settlement, resolving claims that Dr. Dennis Gross brand skincare products were falsely advertised as containing collagen when they did not. One of the largest ever false advertising settlements in the skincare industry, it provided consumers with nearly full restitution, up to \$380 per person. The company also agreed to no longer use the “+Collagen” labelling unless the products actually contain collagen. *Kandel, et al., v. Dr. Dennis Gross Skincare LLC*, No. 1:23-cv-01967-ER (S.D.N.Y.). ### 4\. **Specific Applications of the Rules and Protections** **4\.1 How do the rules and protections apply in relation to online marketplaces?** Consumer protection regulation is increasingly focused on online marketplaces as consumers spend more time and money online. As discussed in question 2.7, “junk fees” in online marketplaces are increasingly subject to public and private enforcement actions. Similarly, undisclosed auto-renewal provisions and predatory “dark patterns” (digital design tricks designed to encourage consumer purchases or data sharing without consumer awareness) are targets of enforcement actions and new legislation. **4\.2 How do the rules and protections apply in relation to social media?** Consumer protection law plays a central role in combatting the harms perpetuated by social media. Regulators and private plaintiffs increasingly pursue claims involving predatory and illegal data tracking and sharing, undisclosed paid advertising content, and design choices that drive consumer addiction. As of early 2026, multiple state and federal actions allege that major platforms intentionally engineered addictive features, such as infinite scroll, autoplay and reward systems, to keep children habitually engaged in ways that harm their mental health, in violation of consumer protection laws. *See, e.g*., *Social Media Cases*, No. JCCP5255 (L.A.S.C.). The intersection of AI and social media is another emerging focus. For example, in early 2026, the California AG announced an investigation into widespread reports of non-consensual, sexually explicit “deepfakes” images used to harass women online. The reports involve Grok, the chatbot developed by Elon Musk’s company xAI, Inc. and widely used on X (formerly Twitter). **4\.3 How do the rules and protections apply to pricing practices?** State and federal regulators are adapting to companies’ predatory pricing schemes with the initiation of new laws targeting deceptive practices. In 2024, California’s “Honest Pricing Law” went into effect, a price transparency law that makes it illegal for businesses to advertise a price for a good or service that does not include all associated fees or charges (with the exception of certain taxes and shipping costs). Additionally, in 2025, the FTC engaged the Rule on Unfair or Deceptive Fees, which prohibits bait-and-switch pricing and other tactics used to hide total prides and mislead people about fees, particularly in the live-event ticketing and short-term lodging industries. The FTC has also been increasingly focused on policing the predatory tactic of “strikethrough pricing”, which creates a false sense of urgency for consumers who are baited by a supposedly limited-time discount. **4\.4 How do the rules and protections apply to dark patterns or online choice?** As noted in question 4.1, the counteraction of “dark patterns” is a critical goal of enforcement agencies and private litigants in combatting fraud in the online marketplace. The FTC recently issued guidance titled “Bringing Dark Patters to Light”, which explains the deceptive nature of these predatory psychological tricks and provides recommendations for businesses to avoid deceptive tactics. State regulators, including California and Connecticut, have likewise focused on the abatement of dark patterns as critical to enforcement of their respective state privacy regimes. **4\.5 How do the rules and protections apply in relation to green claims?** A growing number of consumers are looking to buy environmentally friendly, “green” products, whether designated as “natural”, “non-toxic”, “sustainable”, “compostable”, or otherwise. Many companies have responded to the demand not by improving their products, but by “greenwashing” – using labels or advertising that overstate or misrepresent environmental benefits. To guide marketers and prevent deception, the FTC developed the Green Guides, which detail general principles for environmental claims, how consumers interpret “green” claims, and what substantiation or qualification is required. Some states, like California, have specifically incorporated the Green Guides into their consumer protection laws. In an example of successful private enforcement, in 2024, consumers settled class action claims against the manufacturers of ChapStick products that were labelled as “100% Natural” or made with “100% Naturally Sourced Ingredients”, despite containing various synthetic ingredients. The settlement requires GlaxoSmithKline and Pfizer to cease using these claims unless accurate, providing forward-looking relief that benefits consumers nationwide. *See Moore v. GlaxoSmithKline Consumer Healthcare Holdings (US) LLC et al.* (No. 4:20-cv09077) (N.D. Cal.). **4\.6 How do the rules and protection apply in relation to consumer representations?** The consumer protection rules and regulations are squarely aimed at false and deceptive representations. These protections apply across marketplaces, including in-store and online purchases. These laws generally apply to representations that are false or misleading, rendering many statements actionable even if a company can make an argument of literal truth – so long as a statement has the tendency or likelihood to mislead the general public, the statement may be in violation of consumer protection laws. **4\.7 How do the rules and protection apply in relation to scams?** Scams are another primary focus of the consumer protection regulatory scheme. As a result of increasing cryptocurrency scams, the Federal Bureau of Investigation, the DOJ, and D.C. federal prosecutors launched a joint task force in late 2025, the Scam Center Strike Force. The task force’s “Crypto Seizure Team” has already seized more than \$400 million in cryptocurrency. State regulators are likewise focused on cryptocurrency scams. For example, the Massachusetts AG filed suit against Bitcoin Depot in early 2026 alleging that the company, which operates ATMs where consumers can exchange cash for cryptocurrency, is aware that scammers use its kiosks to move money and defraud victims, but chooses to ignore the activity in furtherance of profits. *See Commonwealth v. Bitcoin Depot Inc.*(No. 2684CV00328) (Suffolk County Superior Court). ### 5\. **Other Protections/Prohibitions** **5\.1 Does consumer law in your jurisdiction have any other prohibitions/protections not covered by the questions above? If so, please describe these prohibitions/protections.** In addition to the federal consumer protection laws discussed above, state and local governments regulate consumer protection in a variety of ways, ranging from false advertising law, to unfair business practice regulation, to food safety requirements for local restaurants, to product labelling, privacy, biometrics and AI. For example, many local health departments conduct restaurant inspections to ensure compliance with food safety requirements. Another prominent example is California Proposition 65, which requires warnings for products with certain chemicals known to cause cancer or reproductive harm. Due to the growing concern over corporate abuse of consumer data, states are increasingly enacting data privacy regulations. Illinois enacted the BIPA, which institutes collection, use and sharing limits for companies that handle the biometric information of Illinois residents. The CCPA and the California Privacy Rights Act (“CPRA”) impose a range of protective measures for consumers. Other important state privacy laws include: the Virginia Consumer Data Protection Act (“VCDPA”); the Colorado Privacy Act (“CPA”), which was recently amended to safeguard geolocation data and require consent for resale of sensitive consumer information; the Utah Consumer Privacy Act (“UCPA”); the New Jersey Data Protection Act (“NJDPA”); and the Oregon Consumer Privacy Act (“OCPA”), which was recently updated to further safeguard the sale and processing of personal data if such data belongs to a consumer under the age of 16. Given their importance to companies carrying out business in the United States, the remainder of this section will focus on these requirements. California also recently enacted the Genetic Information Privacy Act, following in the footsteps of Illinois’ BIPA, which protects consumers’ genetic information from misuse and unauthorised disclosure. Additionally, states are increasingly focused on regulating AI. Colorado became the first state to enact comprehensive AI regulation with the passing of the Colorado Artificial Intelligence Act in May 2024, which focused on preventative protections for consumers from algorithmic discrimination. Other states are beginning follow suit. For example, the Texas Responsible Artificial Intelligence Governance Act (“TRAIGA”) went into effect on January 1, 2026, affording similar AI-focused protections. **5\.2 Please outline the substantive tests for the above-mentioned protections/prohibitions.** Several examples follow. In California, the CCPA (as amended by the CPRA) applies to for-profit businesses that collect personal information from or about Californians and either: (1) have a gross annual revenue over \$25 million; (2) buy, sell, or share personal information of 100,000 or more consumers or households; or (3) derive 50% or more of their annual revenue from selling California residents’ personal information. Under the updated law, consumers have new rights, including the right to correct personal information that a business has shared about them and the right to limit the disclosure of sensitive personal information collected about them. California’s data privacy laws contain a limited private right of action for certain data breaches and are otherwise enforced by the state AG and California Privacy Protection Agency. In contrast, the below states’ statutory protections do not afford individuals a private right of action, though many states’ attorneys general welcome consumer reports regarding potential violations. In Virginia, the VCDPA applies to persons that conduct business in Virginia or offer products or services targeted to residents in Virginia and: (1) control or process the data of at least 100,000 consumers; or (2) control or process the personal data of at least 25,000 consumers and derive more than 50% of their revenue from the sale of personal data. The scope of Colorado’s law is very similar to Virginia’s, however, it only applies to data controllers, not data processors (although it defines data controllers more broadly). In Utah, the UCPA applies to controllers and processors that: (1) conduct business in Utah or produce a product or service targeted to consumers who are Utah residents; (2) have an annual revenue of \$25 million or more; and (3) meet at least one of the following thresholds: (i) during a calendar year, control or process the personal data of 100,000 or more consumers; or (ii) derive over 50% of the entity’s gross revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. This renders the UCPA narrower than other state privacy laws. In New Jersey, the NJDPA requires companies to provide clear privacy notices and implement adequate mechanisms for consumers to exercise their rights. To evaluate high-risk data activities, like targeted advertising or profiling, organisations must also conduct data protection assessments to evaluate potential harm to consumers. The NJPDA applies to any business or organisation processing personal data of 100,000+ residents, or anytime revenue is derived from selling the data of 25,000+ residents. **5\.3 Are there any exceptions/exemptions?** Certain states’ data privacy laws apply only to for-profit businesses (e.g., California, Virginia), while others apply more generally, including to entities such as nonprofits (e.g., New Jersey, Oregon). The laws also typically exempt entities that are subject to certain federal laws described above, such as the Health Insurance Portability and Accountability Act (“HIPAA”), the GLB Act and the FCRA. Notably, non-HIPAA health apps (e.g., fitness, fertility apps) are not exempt and are increasingly targets of enforcement activity. California offered an initial exemption for employee and business-to-business commercial information, though it expired in December 2022. **5\.4 What remedies are available for a breach of these protections?** In many states, only the AG can issue penalties. However, some states, like California, provide for a private right of action. Across states, civil penalties can range from \$2,663 for a one-time unintentional violation of the CCPA to up to \$20,000 for a single violation of Colorado’s privacy law. **5\.5 List at least two examples of public or private enforcement of these protections in the last five years, including the breach/alleged breach, result and penalties imposed.** In early 2026, a federal judge in California granted final approval of a \$30 million settlement resolving consumer claims that Google and YouTube illegally collected children’s data for targeted resale. Of note, the settlement followed an important appellate decision holding that the plaintiffs’ state privacy claims were not preempted by the federal COPPA. *See* *Hubbard v. Google LLC* (No. 5:19-cv-07016) (N.D. Cal.). In another example of successful private enforcement, in late 2025, an Illinois federal judge granted final approval of a \$12.1 million settlement in a BIPA class action against gas station chain Speedway LLC. More than 7,000 current and former employees alleged that the company collected and shared their fingerprint data through a time-clock system without proper consent. *See Howe v. Speedway LLC* (No. 1:19-cv-01374) (N.D. Il.). In late 2024, the California Privacy Protection Agency announced an investigative sweep focused on data brokers’ compliance with the registry requirements of the state’s Delete Act, which imposes registry requirements and data deletion and disclosure obligations on data brokers. Since then, the Agency has brought at least nine enforcement actions. Most recently, in early 2026, it announced a \$45,000 fine levied against Datamasters, a marketing firm that compiles and redistributes lists of people with serious health conditions (Alzheimer’s disease, drug addiction, bladder incontinence, etc.). In addition to the financial penalty, Datamasters must also stop selling the personal information of California residents, effectively removing the company from the state marketplace. In an example of non-monetary, pre-litigation enforcement, in January 2026, General Motors and OnStar entered into a consent agreement with the FTC to resolve allegations that the companies failed to obtain drivers’ consent before sharing geolocation and driver behaviour data with consumer reporting agencies. The final order imposes a five-year ban on General Motors and OnStar’s ability to disclose sensitive consumer data to consumer reporting agencies. It also imposes a 20-year requirement to obtain express consent before collection, using, or sharing connected vehicle data (with exceptions for emergency responders). ### 6\. **Investigation of Potential Breaches** **6\.1 What powers does/do the consumer authority/authorities in your jurisdiction have to investigate potential breaches of consumer law? Describe the key steps in a typical investigation.** The FTC has the power “\[t\]o gather and compile information concerning, and to investigate from time to time the organization, business, conduct, practices, and management of any person, partnership, or corporation engaged in or whose business affects commerce”. 15 USC § 46(a). The FTC is increasingly using investigational hearings and compulsory investigations against AI related issues, such as algorithmic discrimination, AI-generated deception, and impersonation fraud. For example, in 2025, the FTC launched an inquiry into AI chatbots acting as companions, including: Alphabet, Inc.; Character Technologies, Inc.; Instagram, LLC; Meta Platforms, Inc.; OpenAI OpCo, LLC; Snap, Inc.; and X.AI Corp. The FTC is interested in particular on the impact of these chatbots on children and what actions companies are taking to mitigate potential negative impacts, limit or restrict children’s or teens’ use of these platforms, and comply with the COPPA Rule. As part of its inquiry, the FTC sought information about how the companies: monetise user engagement; process user inputs and generate outputs in response to user inquiries; develop and approve characters; measure, test, and monitor for negative impacts before and after deployment; mitigate negative impacts, particularly to children; employ disclosures, advertising, and other representations to inform users and parents about features, capabilities, the intended audience, potential negative impacts, and data collection and handling practices; monitor and enforce compliance with company rules and terms of services (e.g., community guidelines and age restrictions); and use or share personal information obtained through users’ conversations with the chatbots. In 2025, the FTC also signalled that it would use existing federal law to address algorithmic discrimination in automated decision-making services regarding hiring, lending, and tenant screening. The FTC also has the “power to require by subpoena the attendance and testimony of witnesses and the production of all such documentary evidence relating to any matter under investigation”, also known as a Civil Investigative Demand (“CID”). *Id*. § 49. An FTC investigation typically begins when the FTC sends a CID to an investigative target. The CID does not require approval by the Commission as a whole; rather, at least one Commissioner signs off on the issuance of the CID. The target may have a meet-and-confer with the staff designated on the CID to attempt to negotiate the scope of the CID. The target may file a motion to quash within 20 days, which is initially ruled on by a single Commissioner and may be appealed to the FTC. 16 CFR § 2.10. The CID usually requests documents, testimony, and in many cases, particularly more recently, investigational hearings, which are similar to depositions. *See* 16 CFR § 2.7. At the conclusion of the investigation, staff will either recommend closing the investigation or the filing of a complaint. If staff recommend a complaint, the FTC can grant a period of time for the staff to negotiate a settlement. If a matter is still not resolved, the FTC has the option of filing a complaint in an administrative forum before an administrative law judge (“ALJ”) or directly in federal court. State attorneys general also use investigative tools and multistate coalitions, including CIDs and formal inquiries, to mitigate AI-related harms, such as algorithmic bias, deception, and fraud. For example, Texas AG Ken Paxton opened an investigation into AI chatbot platforms, including Meta AI Studio and Character.AI, for potentially engaging in deceptive trade practices and misleadingly marketing themselves as mental health tools. Similarly, New York AG Letitia James and a bipartisan coalition of 41 attorneys general from other states sent a letter to 13 Big Tech companies, including Meta, Microsoft, and OpenAI, urging them to implement safeguards on AI chatbots to protect children and vulnerable people. **6\.2 How is an investigation triggered (e.g., *ex officio*, whistleblower or complaint)?** Investigations may be triggered in various ways – through consumer complaints, information provided by an internal whistleblower, press articles, Congressional referrals, social media posts, or the initiative of a Commission employee. Sometimes, the FTC “sweeps” an entire industry to ensure compliance with the law. **6\.3 Describe any complaints procedure for (i) consumers, and (ii) businesses.** The FTC encourages consumers to file a complaint whenever they have been the victim of fraud, identity theft, or other unfair or deceptive business practices. Consumers can file complaints online at [(Hyperlink)](https://reportfraud.ftc.gov/#/assistant "https://reportfraud.ftc.gov/#/assistant") or by calling 1-877-FTC-HELP. The FTC is actively encouraging consumers to report AI-powered scams. In addition to the FTC’s standard reporting mechanism, the FTC maintains a separate reporting mechanism for “misconduct by technology platforms”. Consumer organisations or other advocacy groups often also file complaints or petitions with the FTC. Consumer groups have filed complaints with the FTC alleging unfair or deceptive practices with respect to, for example, Facebook’s facial recognition practices, Instagram influencers’ failure to disclose that they were being paid for endorsements, and companies’ allegedly unfair practices with respect to scoring individuals for employment and other purposes. These complaints are often sent to the FTC’s Office of Secretary and Commissioners’ offices. Businesses can also file complaints with the FTC through these same channels. Another path for business complaints is through a self-regulatory organisation such as the Better Business Bureau National Programs (“BBBNP”). When a business files a complaint about a competitor’s advertisement with the Better Business Bureau (“BBB”), it has specialised procedures to resolve these issues. If it finds that an advertisement violates its guidelines, and the Company declines to remedy the violation, the BBB can refer the matter to the FTC for enforcement. As one example, the Children’s Advertising Review Unit, a subdivision of the BBBNP, referred the company Musical.ly (predecessor to TikTok) to the FTC for allegedly violating COPPA, and the FTC subsequently brought an enforcement action. **6\.4 What is the timeline for a typical investigation?** A typical FTC investigation will take at least one year, and often longer. **6\.5 Are there criminal penalties for non-compliance with a consumer law investigation? If so, provide examples where such penalties have been imposed.** Usually, the FTC does not have the authority to seek criminal penalties. However, the FTC’s Criminal Liaison Unit assists prosecutors with criminal consumer fraud cases, often by sharing evidence of knowledge of fraud that is developed through the FTC’s civil investigations. In 2021, prosecutors who partnered with the FTC obtained 30 convictions or guilty pleas in new or pending cases. *See* [(Hyperlink)](https://www.ftc.gov/enforcement/criminal-liaison-unit/results "https://www.ftc.gov/enforcement/criminal-liaison-unit/results") . As one example of civil and criminal cooperation, in 2017 the FTC and DOJ jointly brought civil and criminal charges, respectively, against Western Union alleging consumer fraud, aiding and abetting wire fraud, and failing to have an effective anti-money laundering programme. Western Union entered a global settlement that included a \$586 million judgment, a permanent injunction and a deferred prosecution agreement. More recently, in 2025, the FTC and DOJ weighed in on the applicability of antitrust laws to environmental, social, and governance initiatives by filing a Statement of Interest in a multistate antitrust case against asset managers BlackRock, State Street, and Vanguard, a case led by Texas AG Ken Paxton. The FTC has also recently included in their 2025 antitrust guidelines, jointly released with the DOJ, that no-poach agreements and wage fixing could lead to criminal charges against both individuals and companies. **6\.6 Can investigations be resolved by way of commitments or undertakings?** Yes, and this is typical. FTC investigations are usually resolved by a consent order. Violations of administrative consent orders subject defendants to civil penalties. 15 USC § 45(l). Violation of federal orders can lead to remedies within a judge’s discretion, including contempt of court. ### 7\. **Enforcement** **7\.1 How does/do the consumer authority/authorities seek to enforce consumer law (e.g., by administrative decision or by commencing proceedings in court)?** Enforcement by the FTC may be achieved through administrative action, judicial action, or both. **7\.2 Is/are the consumer protection authority/authorities bound by a time limit to commence proceedings on breaches?** There is no statute of limitations when the FTC seeks an injunction in connection with ongoing conduct. There is a five-year statute of limitations for seeking civil penalties, 28 USC § 2462, and a three-year statute of limitations for redress that the Commission would seek in connection with a rule violation. 15 USC § 57b(d). **7\.3 Where regulators/enforcement bodies have a choice of enforcement tools/powers, what considerations do they take into account in determining which tools/powers to use?** The FTC’s choice of administrative or federal court largely depends on the types of remedies it is seeking. If the FTC is seeking civil penalties, it must work with the DOJ or another federal agency with direct authority to litigate civil penalties in federal court, such as the CFPB. Civil penalties are not available in an administrative proceeding. If the FTC is seeking disgorgement or restitution and the case involves the violation of an FTC Rule, the FTC is entitled to this relief in federal district court directly. If the FTC is seeking disgorgement or restitution in other matters, it would have to allege that the law violation was “dishonest or fraudulent”, and would first have to file an administrative action before being able to seek disgorgement or restitution. For purely injunctive relief, the FTC often files actions administratively because any violation of the administrative action would subject defendants to civil penalties. **7\.4 Describe the relevant rules and procedures that must be followed by such bodies (e.g., administrative, judicial).** In the administrative forum, the ALJ presides over adjudications with broad power to compel testimony from parties and non-parties alike. These powers include issuing subpoenas, taking depositions or causing them to be taken, compelling admissions, holding settlement conferences, making initial decisions, and holding parties in contempt if they fail to comply with the ALJ’s orders. 16 CFR § 3.42. In a federal district court, proceedings are governed by the Federal Rules of Civil Procedure, which allow parties to conduct discovery and gather evidence, from both parties and non-parties. For example, Rule 45 allows for subpoenas that can compel testimony, the production of documents, electronically stored information or other tangible items. Fed. R. Civ. P. 45(a). **7\.5 Is there a right to a stand-alone action and follow-on right of action within consumer law? Who has standing to bring these actions?** While there is no private right of action under the FTC Act, some federal consumer laws provide a private right of action. Many state laws also provide for private rights of action. For example, California’s FAL empower aggrieved consumers to vindicate their rights in court, and the CCPA provides that “\[a\]ny consumer whose nonencrypted and nonredacted personal information \[…\] is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action”. Cal. Civil Code § 1798.150(a)(1). Plaintiffs can pursue damages and injunctive or declaratory relief. *Id*. Illinois’ BIPA also provides a private right of action. Individual consumers may also bring state common law claims, such as for negligence, fraud, or product liability. Individual consumers must have standing to enforce violations of these laws. There are three elements generally required to establish standing: “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” *Spokeo, Inc. v. Robins*, 578 U.S. 330, 338 (2016). Any injury in fact must also be “concrete and particularized”. *Id*. at 339. **7\.6 Is there a statute of limitations for bringing stand-alone or follow-on actions?** Private actions have statutes of limitations, which vary depending on the specific claim. Three or four years is typical under state consumer laws. **7\.7 Describe how interactions with other regulations and/or regulators are dealt with by the consumer protection authority.** In balancing federal and state authority, the historic police powers of the states are not to be superseded by federal law unless that was the clear and manifest purpose of Congress. *See Rice v. Santa Fe Elevator Corp.*, 331 U.S. 218, 230 (1947). Federal law may preempt state law by express provision or by implication through field or conflict preemption. Several federal consumer statutes prohibit states from imposing new or additional labelling “requirements”. *See, e.g.*, 21 USC § 360k(a); 7 USC § 136v(b). But the statutory language is silent regarding states’ ability to provide remedies for violations of federal law. Courts have held that this statutory construction does not prevent consumers from claiming relief under state laws for violations of federal standards and their state parallels. *See Astiana v. Hain Celestial Grp., Inc.*, 783 F.3d 753, 757 (9th Cir. 2015). This framework facilitates collective enforcement of state and federal violations by state attorneys general, federal regulatory authorities, as well as aggrieved consumers. In public actions, state and federal regulators are increasingly partnering to prosecute high-stakes consumer fraud. In mid-2024, the FTC issued a report detailing the FTC’s law enforcement cooperation with state attorneys general nationwide and presenting best practices to ensure continued effective collaboration regarding consumer fraud. *See* [(Hyperlink)](https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-issues-report-congress-collaboration-state-attorneys-general "https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-issues-report-congress-collaboration-state-attorneys-general") . In one example in furtherance of those efforts, in late 2025, 21 states joined the FTC in a California federal lawsuit accusing Uber of enrolling users into its paid Uber One subscription service without consent and imposing obstacles that deter and prevent consumers cancelling the service. Allegations include violations of both the FTC Act and several state consumer protection laws, reflecting the joint FTC and state attorneys general prosecution efforts. *See Federal Trade Commission v. Uber Technologies Inc*. (No. 3:25-cv-03477) (N.D. Cal.). **7\.8 Describe any international or regional cooperative mechanisms (e.g., MOUs) in which your jurisdiction is involved in the enforcement of consumer protection.** The FTC joins with more than 100 foreign competition and consumer protection authorities around the world and regularly cooperates with foreign authorities on enforcement and policy matters. Some examples follow. ICPEN: the International Consumer Protection and Enforcement Network is a coalition of mostly government organisations that enforce fair consumer practices and share information and best practices with each other. These organisations include the FTC and government offices from other countries, such as Germany, Ireland, Italy, Japan and Mexico. *See* FTC, “International Consumer Protection and Cooperation” [(Hyperlink)](https://www.ftc.gov/policy/international/international-consumer-protection-cooperation "https://www.ftc.gov/policy/international/international-consumer-protection-cooperation") GPEN: the Global Privacy Enforcement Network is an informal network of privacy enforcement authorities that work together to facilitate sharing of information and cooperate on cross-border enforcement of laws protecting privacy. *See* FTC, “Multilateral Memorandum of Understanding For Participation In the Global Privacy Enforcement Network System” (2015), [(Hyperlink)](https://www.ftc.gov/system/files/documents/cooperation_agreements/151026gpen-alert-mou.pdf "https://www.ftc.gov/system/files/documents/cooperation_agreements/151026gpen-alert-mou.pdf") Bilateral agreements: The FTC has entered into at least 22 bilateral cooperation agreements with foreign consumer protection authorities including Australia, Ireland, Mexico, Spain and several Canadian provinces. *See* FTC, “International Cooperation Agreements” [(Hyperlink)](https://www.ftc.gov/policy/international/international-cooperation-agreements "https://www.ftc.gov/policy/international/international-cooperation-agreements") ### 8\. **Appeals** **8\.1 Describe any appeal processes.** In FTC administrative enforcement actions, appeals from the ALJ’s “initial decision” to the full Commission are available to either FTC’s “complaint counsel” or any respondent. In limited cases, including certain merger cases, an appeal from the ALJ’s initial decision is automatic. *See* 16 CFR § 3.52. Upon appeal, the Commission receives briefs, holds oral argument, and thereafter issues its own final decision and order. The FTC Rules of Practice allow for the filing of amicus briefs in support of either side of the appeal, with leave of the Commission. For automatic appeals, the Commission places the appeal on its docket and defines the issues to be briefed by the parties. *See* 16 CFR § 3.53. Unlike appeals in state or federal courts, the Commission reviews the ALJ’s entire decision anew, without deference, including the findings of fact. *See* 16 CFR § 3.54(b). The Commission’s final decision is then appealable, but only by any respondent against which an order is issued. The respondent may file a petition for review with any U.S. court of appeals within whose jurisdiction the respondent resides or carries on business or where the challenged practice was used. 15 USC § 45(c). The case then proceeds from that point along the same path as cases originally filed in the district courts. Just as a case coming up for appellate review from a federal district court receives some deference from the appellate court, so too does a final Commission decision. Specifically, the appellate court reviews questions of law *de novo* but will not disturb factual determinations of the Commission that are supported by substantial evidence. If the federal Court of Appeals affirms the Commission’s order, the court enters its own order of enforcement. The party losing in the court of appeal may seek review by the United States Supreme Court, upon petition for a writ of certiorari. Otherwise, consumers enforcing state law consumer protection claims may appeal through standard civil processes. **8\.2 Can consumers or retailers/manufacturers appeal decisions made by the consumer authority/authorities or by a court?** Consumers are not parties to enforcement actions and thus do not have appellate rights from enforcement decisions. As described above in section 1, there is no private right of action under the FTC Act, and such actions can only be brought by the agency. The FTC and defendant retailers/manufacturers, however, can appeal administrative enforcement decisions as described in response to question 8.1 above. Consumers (and retailers/manufacturers) have full appellate rights in private civil litigation to which they are parties that are originated in state or federal courts and brought under state law like California’s CLRA or UCL or under federal statutes like ECOA, TCPA, FCRA, etc. Appeals in private litigation follow the normal court appellate rules, whereby only final judgments or orders that dispose of all claims as to all parties are automatically appealable. Certain interlocutory orders are subject to discretionary appeal, such as class certification orders, orders denying motions to compel arbitration, “collateral” orders (orders on issues unrelated to the merits of the suit), certain kinds of sanctions orders, attorney disqualification orders, etc. **8\.3 Does an appeal suspend the effect of any penalty/the requirement to pay any fine (if applicable)?** The effects of an appeal vary based on circumstances. In administrative actions, a party subject to a cease-and-desist order under § 5 of the FTC Act may apply to the Commission for a stay pending judicial review. *See* 16 CFR § 3.56(b). If, within 30 days after the application was received by the Commission, the Commission either has denied or has not acted on the application, a stay may be sought in a court of appeals where a petition for review of the order is pending. *Id*. An application for stay must state the reasons a stay is warranted and the facts relied upon, and must include supporting affidavits or other sworn statements, and a copy of the relevant portions of the record. The application must also address the likelihood of the applicant’s success on appeal, whether the applicant will suffer irreparable harm if a stay is not granted, the degree of injury to other parties if a stay is granted, and why the stay is in the public interest. *See* 16 CFR § 3.56(c). In court actions seeking injunctive relief, monetary damages, and/or penalties, often an appeal will suspend the defendant’s obligation to pay a penalty. The payment of penalties will generally be stayed on appeal automatically. In deciding whether to stay an order awarding injunctive relief pending appeal, federal courts engage in a similar exercise as the Commission in an administrative appeal, balancing four factors: “(1) whether the stay applicant has made a strong showing that he is likely to succeed on the merits; (2) whether the applicant will be irreparably injured absent a stay; (3) whether issuance of the stay will substantially injure the other parties interested in the proceeding; and (4) where the public interest lies.” *LabMD, Inc. v. FTC*, 678 F. App’x 819 (11th Cir. 2016) (citing *Nken v. Holder*, 556 U.S. 418, 425-26 (2009) (quotation omitted)). ### 9\. **Current Trends and Anticipated Reforms** **9\.1 What are the recent enforcement trends in your jurisdiction and what key trends do you expect in the next 12 months?** **Children’s data privacy** In early 2025, the FTC unanimously moved to strengthen online privacy protections for children in updating the COPPA. The Commission established requirements for online providers to obtain legitimate parental consent before disclosing personal information from children under 13 to third parties for targeted advertising. The new protections also advise against the indefinite retention of children’s data. Children’s privacy issues are expected to remain an ongoing priority for the FTC, and many expect that additional federal legislation will soon follow to further increase protections. **AI and tech** Following its promise to safeguard consumers from the prospective harms of AI, the FTC focused many of its recent enforcement actions on AI-driven consumer harms. Specific focuses included substantiation of AI claims, the safeguarding of personal data in AI systems, and implementing rigorous standards to prevent AI bias and discrimination. The FTC emphasised the importance of upholding prior promises to consumers, including those about whether personal data would be used to train AI models. In late 2024, the FTC brought an enforcement sweep termed “Operation AI Comply” that targeted misrepresentations relating to the efficacy of various AI providers’ capabilities. In one example, the FTC halted company DoNotPay’s misleading claims that the AI service could substitute for the expertise of a human lawyer. Each company targeted by the sweep either settled with the FTC or was issued a temporary restraining order. DoNotPay agreed to a proposed Commission order requiring a \$193,000 payment and issuance of warnings about the limitations of law-related features on the service. Federal lawmakers are also increasingly concerned about the use of AI in healthcare – particularly when used to deny insurance claims in one fell swoop. *See* Bicameral, Bipartisan Letter to Centers for Medicare & Medicaid Services (June 25, 2024) (available at [(Hyperlink)](https://nadler.house.gov/news/documentsingle.aspx?DocumentID=396200 "https://nadler.house.gov/news/documentsingle.aspx?DocumentID=396200") ) (led by Representatives Jerrold Nadler, Judy Chu, and Senator Elizabeth Warren). Healthcare companies are utilising AI tools designed to quickly review insurance claims and issue denials at inflated rates. This saves insurers money by allowing them to employ fewer medical professionals to review claims, and by reducing the benefits paid, at the expense of their insureds’ well-being. Insurance denials lead to serious health complications, some of which are fatal. Several private class action lawsuits have been filed on behalf of insured individuals who were denied coverage due to companies’ use of AI, resulting in the delay or loss of necessary medical care. *See, e.g., Kisting Leung v. Cigna*, 2:23-cv-01477-DAD-CSK (E.D. Cal. 2025) (declining to dismiss plaintiffs’ claims under 29 USC § 1132(a)(3) and UCL in a case where consumer plaintiffs challenged Cigna’s use of an algorithm called PXDX to review and deny claims for diagnostic procedures, with claims for violations of ERISA and the UCL); *Lokken v. UnitedHealth Group*, Inc., 23-CV-03514 (JRT/SGE) (D. Minn. 2025) (declining to dismiss plaintiffs’ claims for breach of contract and breach of the implied covenant of good faith and fair dealing in a case challenging UnitedHealthcare’s use of the nH Predict algorithm to review post-acute care claims); *Barrows v. Humana, Inc*., 3:23-cv-00654-RGJ (W.D. Ky. 2025) (declining to dismiss plaintiffs’ claims for breach of contract, breach of the implied covenant of good faith and fair dealing, unjust enrichment, and common law fraud in a case challenging Humana’s use of the same nH Predict algorithm). As discussed in question 6.1, the FTC is increasingly relying on investigational hearings and compulsory process in matters involving AI, and state attorneys general issue their own CIDs, sometimes through multistate coalitions (both in general and in AI-related matters). Litigation is expanding as well. In February 2026, the nation’s first trial seeking to hold social media companies liable for addicting children began in Los Angeles Superior Court, where thousands of cases are consolidated. Key executives, including Meta CEO Mark Zuckerberg, are expected to testify. *See Social Media Cases*, No. JCCP5255 (L.A. Super. Ct. 2026). In another example, parents sued OpenAI in August 2025, alleging that ChatGPT encouraged their child to take his own life after the chatbot engaged with him about anxiety, self-harm, and suicide methods. The case remains in active discovery. *See Raine v. OpenAI, Inc.*, No. CGC25628528 (S.F. Super. Ct. 2026). **AI-washing** The FTC has expressed concern that AI-related marketing claims are often inaccurate, a misleading practice termed “AI-washing”. Since April 2025, the FTC filed multiple cases alleging that defendants engaged in AI-related deceptive marketing claims, and two of the cases have been resolved – against Workado, LLC and Growth Cave. In the Workado matter, the company claimed that its AI Content Detector was developed using a wide range of material to make it more accurate for average users; however, the AI model powering the AI Content Detector was trained or fine-tuned to effectively classify only academic content. As a result of the Growth Cave matter, defendants, including Growth Cave’s co-CEOs, are permanently banned from marketing and selling business opportunities and credit repair programmes as part of the settlement to resolve allegations that their scheme cost consumers nearly \$50 million in damages. Similar actions are also being brought in the private sector. For example, in a consolidated nationwide class action, consumers alleged that Apple falsely represented what the iPhone 16 could do by promoting AI capabilities (“Apple Intelligence”) that did not exist. The docket reflects that, as of December 2025, the parties reached an agreement in principle to resolve the matter on a class wide basis, with a final settlement expected to be presented for court approval in March 2026. *See Landsheft v. Apple Inc.*, No. 25-cv-02668 (N.D. Cal. 2025). **Focus on racial equity** In recent years, the FTC demonstrated a renewed focus on combatting surveillance, algorithmic bias and other emerging issues that may disproportionately affect communities of colour. Through its Every Community Initiative, the FTC sought to support consumers in historically underserved communities, which may be disproportionately affected by fraud and other consumer issues. These efforts included developing specific resources, conducting outreach and events, initiating law enforcement actions, and conducting research to better identify and understand the equity issues. With the advent of AI, and issues regarding racial bias in AI systems that are now making crucial decisions in housing, health care, and more, the FTC’s enforcement may expand and adapt to tackle these new technological threats to equity. One such example was the FTC’s 2023 settlement with Rite Aid for the company’s discriminatory use of facial recognition software powered by AI. The settlement offers companies a framework for assessing their systems for potential AI bias that has a discriminatory impact. Under the current administration, however, it is uncertain whether the FTC will continue to pursue such cases aggressively. Recent actions, including warning letters to law firms alleging their DEI hiring efforts may constitute unlawful anticompetitive conduct, suggest a shift in enforcement priorities. **9\.2 Are there any proposed reforms to consumer law or policy within the next 12 months?** The CFPB is expected to continue its shift toward limited enforcement under the Trump administration, following personnel changes, workforce reductions, and abandonment of many enforcement matters in 2025. For 2026, the bureau has expressed plans to revise many regulations, including: (1) Regulation B, which implements the ECOA; (2) the Section 1071 small business data collection rule; and (3) the final Section 1033 personal financial data rights rule. But given the administration’s overall priorities and the bureau’s constrained budget, less enforcement activity and rulemaking are expected. The FCC has announced that it will continue its “Delete, Delete, Delete” initiative, aimed at rescinding agency rules and regulations in alignment with the Trump Administration’s larger deregulatory efforts. While earlier efforts focused on eliminating regulations that the FCC claims are tied to obsolete technologies, many expect that the FCC will move to more substantive deregulation in 2026. Separately, the “Make America Healthy Again” (“MAHA”) grassroots movement is expected to continue to pressure the FDA and state regulators into action. For example, as of early 2026, at least 18 states have pursued Supplemental Nutrition Assistance Program (“SNAP”) waivers to render certain items, such as soda, candy, and prepared desserts, ineligible for purchase with government SNAP (food assistance) funds. Select states, such as California and Texas, have adopted new legislation regarding ultra processed foods and warning labels, and this MAHA-attributed trend is expected to continue in 2026. It remains to be seen whether Health and Human Services Secretary Robert Kennedy will pursue a national food standard or continue to encourage state-level regulation. *** ### Production Editor's Note This chapter has been written by a member of ICLG's international panel of experts, who has been exclusively appointed for this task as a leading professional in their field by [Global Legal Group](https://www.glgroup.co.uk/), ICLG's publisher. ICLG's in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style, including anti-plagiarism and AI-detection tools. This chapter was copy-edited by [Hollie Parker](https://iclg.com/meet-the-team), our in-house editor.
Shard109 (laksa)
Root Hash1949017854985493909
Unparsed URLcom,iclg!/practice-areas/consumer-protection-laws-and-regulations/usa s443