The U.S. Supreme Court's April 2021 decision in the AMG matter significantly limited the Federal Trade Commission's (FTC's) ability to seek monetary redress for consumers under the FTC Act, relief the FTC had successfully obtained for over four decades. Since the Supreme Court announced its decision, the FTC has been deploying new strategies to return money to consumers harmed by unfair or deceptive practices and to otherwise deter such conduct through civil penalties. Companies should pay close attention to these strategies, as they provide a roadmap for future investigations and enforcement. These strategies include the following:

• Aggressive use of statutes that authorize civil penalties: The AMG case does not affect the FTC's ability to get civil penalties for violation of 1) an existing order or 2) statutes it enforces other than the FTC Act. (The FTC Act does not authorize the FTC to get civil penalties for first-time violations). So, for example, both before and after the AMG decision was announced, the FTC sought and obtained civil penalties for violations of laws like the Children's Online Privacy Protection Act, the Fair Credit Reporting Act, and the Telemarketing Sales Act, among others. Last year, the FTC also invoked, for the first time, three additional authorities to obtain civil penalties:
  • The COVID-19 Consumer Protection Act of 2020, which makes it illegal "to engage in deceptive marketing related to the treatment, cure, prevention, mitigation or diagnosis of COVID-19, or any other government benefit related to COVID-19."
  • The BOTS Act, which authorizes the FTC to seek civil penalties against individuals and companies that use bots or other means to circumvent limits on online ticket purchases.
  • The Red Flags Rule under the Fair Credit Reporting Act, which requires creditors and financial institutions to implement a written identity theft prevention program.
  The FTC also expanded its interpretation of the Restore Online Shoppers Confidence Act (ROSCA), which allows the FTC to seek civil penalties for unfair and deceptive practices related to negative option features. In the Moviepass case announced post-AMG, the FTC alleged a ROSCA violation, even though the deception related to the underlying product characteristic, and not the negative option feature. This decision sets the stage for seeking civil penalties expansively under ROSCA. Finally, earlier this month, the FTC announced a settlement requiring defendants to pay monetary redress based on an alleged violation of a rarely used, anti-pretexting provision of the Gramm-Leach-Bliley Act. We can expect to see an aggressive application of all statutes enforced by the FTC to seek monetary remedies after the AMG decision.
• Enforcement of existing Rules: Section 19 of the FTC Act allows the FTC to seek not only civil penalties, but also restitution and damages for violations of Commission Rules. For example, last year, the FTC ordered the payment of refunds to subscribers of a mobile coloring book app for violations of the Children's Online Privacy Protection Act (COPPA), marking the first time the FTC has sought restitution for a COPPA violation. We expect the FTC to allege Rule violations where possible to trigger its authority to obtain restitution for harmed consumers. Indeed, the FTC's recently issued policy statement on the Health Breach Notification Rule signals its intent to step up enforcement efforts under the Rule, which would allow the FTC to seek penalties, damages, and restitution for violations.
• New Magnuson-Moss rulemaking: Section 18 of the FTC Act authorizes the agency to promulgate rules defining particular acts or practices as unfair or deceptive. The FTC has used this tool sparingly, given that it adds many steps to the more streamlined rulemaking process under the Administrative Procedures Act. But the FTC has signaled its intent to use the tool more widely. Any Rule developed under Section 18 would give the FTC the ability to seek redress, damages, and penalties. The FTC has already begun a Magnuson-Moss rulemaking proceeding on impersonation fraud. It also announced its intent to launch a rulemaking proceeding on privacy, security, and algorithmic decision making.
• Notice of penalty offenses: Under Section 5(m) of the FTC Act, the FTC can notify companies of administratively litigated decisions in which a practice has been found to be unfair or deceptive. The FTC intends to assert that companies that receive these "Notices of Penalty Offenses" have actual knowledge that the practice is unfair or deceptive, and if they engage in the practice, the FTC can seek civil penalties against them. In order to trigger this authority, the Commission sent Notices of Penalty Offenses to businesses in three areas: 1) false money-making claims (over 1,000 notices); 2) fake reviews or other misleading endorsements (hundreds of notices); and 3) misleading claims about job and earnings profits applicable to for-profit colleges (70 notices).
• Partnerships with states: Another strategy to obtain consumer redress involves partnering more frequently with State Attorneys General and leveraging their authority to seek monetary remedies. In the Equifax case, for example, the FTC partnered with the CFPB and states to develop a $575 million redress program.
• Seeking redress as part of administrative actions: Section 19 also allows the FTC to obtain a final cease and desist order administratively, and then commence a civil action for damages and restitution if the Commission satisfies the court that the unfair or deceptive practice at issue is "dishonest or fraudulent." Some businesses have paid redress as part of FTC administrative settlements, presumably to avoid a follow-on civil action.
• Advocacy for Section 13(b) reform: Finally, despite all of these strategies, there will be cases in which it will be difficult for the FTC to obtain monetary relief. Accordingly, the FTC will likely continue to press for legislative reform that will reinstate its authority to seek consumer redress under Section 13(b).

For more information on FTC consumer protection, privacy, and security investigations and enforcement actions, please contact Wilson Sonsini attorneys Maneesha Mithal, Chris Olsen, Lydia Parnes, or Tracy Shapiro.