United StatesFTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)
In force since .
An enforcement supervision rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Disclosure, Security
- Audit expectation
- none
What it requires
- Do not engage in unfair or deceptive practices when collecting, using, or sharing personal data.NIST Privacy FrameworkCT.PO-P1
- Assess foreseeable privacy harms before deploying a system that collects or uses biometric identifiers derived from photographs, videos, or voice recordings, and disclose material facts about that collection.NIST Privacy FrameworkID.RA-P3NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Federal Trade Commission (guidance, recorded ); Federal Trade Commission v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P3Potential problematic data actions and associated problems are identified.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Section 5(a) declares unfair or deceptive practices unlawful but attaches no civil penalty to a bare first violation; a penalty attaches only once the FTC has issued a trade-regulation rule (15 U.S.C. 45(m)(1)(A)) or a final cease-and-desist order (15 U.S.C. 45(l), 45(m)(1)(B)), and the person then violates it with actual knowledge or knowledge fairly implied. Each of those provisions states a nominal $10,000-per-violation ceiling, adjusted for inflation to $53,088 per violation (2025 figure) by 16 CFR 1.98. Each day of a continuing failure to comply with a rule is a separate violation under 45(m)(1)(C).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 53,088
Who enforces it
Enforcement body
Federal Trade Commission
Enforcement record
Counts the case entries listed on the FTC's own Privacy and Security Enforcement page, part of the Protecting Consumer Privacy and Security topic hub, with case dates from through , the latest twelve months the page's own Cases list covers as of the read date: Hims and Hers, CMG Media Corporation, RentGrow, Amazon.com, FTC v. Kochava, Illuminate Education, Twitter, OkCupid and Match, General Motors, NGL, Disney, Illusory Systems and Nomad, Support King (SpyFone.com), Avast, Apitor, and Iconic Hearts Holdings, sixteen matters the page brings under Section 5 as the general federal vehicle for privacy and data-security enforcement. The next-oldest listed case, Pornhub, Mindgeek and Aylo, is dated and falls just outside this window.
- As of
- Source link
- https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-security-enforcement
- Actions per year
- 16
Settledness
- As of
- Case link
- https://www2.ca3.uscourts.gov/opinarch/143514p.pdf
- Guidance link
- https://www.ftc.gov/legal-library/browse/ftc-policy-statement-unfairness
- Case citation
- Federal Trade Commission v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015)
- Guidance body
- Federal Trade Commission
- Open questions
- Does a failure to use reasonable data security cause or likely cause "substantial injury to consumers" under 15 U.S.C. 45(n) when personal information was exposed but no consumer is shown to have been harmed by the exposure?
What it makes you log
Logging duty
Section 5(a) declares unfair or deceptive acts or practices unlawful and directs the Commission to prevent them; the section carries no duty to make, keep or produce a log or record. The second requires line rests on the Commission's biometric policy statement, which lists assessment and monitoring practices the Commission treats as relevant to an unfairness finding but states no record duty. The Commission's power to demand information is in section 46, which this row does not cite. The reach in 45(a)(4)(A) applies only to acts or practices involving foreign commerce: injury within the United States is a place-of-effect test, and the clause's second prong, material conduct occurring within the United States, matches no value in the hook vocabulary and is left out.
- Kind
- None
- As of
What this law does
Prohibits unfair or deceptive acts or practices in or affecting commerce and empowers the FTC, not private plaintiffs, to investigate and enforce against them. This is the primary federal vehicle for privacy and data-security enforcement in the absence of a comprehensive statute, reaching misrepresentations about data collection or protection and unfair data practices that cause substantial, unavoidable consumer injury.
The Commission's 2023 Policy Statement on Biometric Information applies this authority to biometric identifiers, including those derived from photographs, videos, or voice recordings.
How courts have read itPremium data
Our analysis of this law draws on 6 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .