PRIVACY & DATA SECURITY
Texas AG Investigates Tech Companies Over Minors’ Data Privacy
Texas Attorney General Ken Paxton announced investigations into the privacy and safety policies of more than a dozen tech companies, including Reddit, Instagram, Discord, and Character.AI. The investigations fall under the Securing Children Online through Parental Empowerment (SCOPE) Act and the Texas Data Privacy and Security Act (TDPSA). Part of the state’s growing privacy arsenal, these laws are aimed at stopping digital service providers from disseminating or selling personal identifying information of children without consent from their parent and impose rigid notice and consent requirements on businesses that gather and use personal data of minors.
BUSINESSES NEED TO KNOW: We’ll keep saying it: Don’t mess with Texas. This investigation follows major privacy enforcement actions against big and small players alike, including a $1.4 billion settlement with Meta for unlawful data collection. With a goal to be #1 in privacy enforcement, expect to see a lot of activity – and headlines – from this state in 2025.
CFPB Proposes New Rule to Regulate Data Brokers Under FCRA
The Consumer Financial Protection Bureau proposed a new rule to regulate data brokers under the Fair Credit Reporting Act (FCRA), aiming to address privacy concerns and national security risks associated with the sale of sensitive consumer data. The rule would classify data brokers as “consumer reporting agencies,” similar to credit bureaus, and require those selling credit histories, income data, or debt payment information to comply with FCRA standards. Key provisions include:
- Restricting the sale of personally identifiable information, such as Social Security numbers and addresses, to prevent misuse by scammers, domestic abusers, and foreign adversaries.
- Applying “permissible purpose” restrictions to ensure sensitive data is only used for legitimate reasons, like mortgage applications or fraud prevention.
- Enhancing consumer protections by mandating accuracy and transparency in data handling.
BUSINESSES NEED TO KNOW: Will this rule actually reach implementation? Anticipate challenges from both an alarmed banking industry, as well as the incoming Trump administration. Indeed, under the latter, much of the CFPB’s current agenda under Director Chopra will likely be scrapped as the Bureau’s future falls into greater uncertainty.
FTC Settles with Data Brokers Over Unlawful Sensitive Location Data Practices
The Federal Trade Commission announced settlements with data broker Mobilewalla Inc. and location intelligence company Gravy Analytics Inc. for unlawfully collecting and selling precise location data. The data revealed sensitive details, including visits to healthcare facilities, places of worship, military sites, and other private locations. These actions illustrate a growing focus of the Commission in targeting data aggregators for handling sensitive data in violation of Section 5 of the FTC Act. The proposed settlements ban both companies from selling sensitive location data and impose strict data collection and retention limits.
BUSINESSES NEED TO KNOW: When evaluating your data collection program, it is always important to consider the potential harms to consumers and weigh your need for the information against these risks. Just because you can collect data, doesn’t always mean you should.
TCPA/TELESERVICES
Eleventh Circuit Questions FCC’s One-to-One Consent Rule for Marketing Calls
Eleventh Circuit judges expressed skepticism about the FCC’s legal justification for its new One-to-One Consent rule. The Insurance Marketing Coalition Ltd. is seeking to vacate this provision, arguing it exceeds the FCC’s statutory authority under the TCPA. The judges also questioned the FCC’s interpretation of “prior express consent” and its impact on a consumer’s right to receive marketing calls. Set to take effect on January 27th, the rule aims to close the “lead generator loophole” where consumers using comparison shopping sites and other lead generation mechanisms could provide consent to be contacted with offers from multiple companies at once.
BUSINESSES NEED TO KNOW: All eyes are on this one. In what may be the most effective challenge to One-to-One Consent, the case highlights the tension between regulatory efforts to curb unwanted communications and statutory limits on agency authority. With an implementation date just weeks away, a decision may be coming quickly.
Learn More! Join our upcoming webinar to understand the current debate and timeline surrounding this case and learn practical ways to prepare for potential shifts in FCC deference and TCPA expansion and enforcement.
FCC Proposes Stricter Rules to Combat Robocalls and Enforce Compliance
The Federal Communications Commission has proposed stricter enforcement and compliance measures to ensure telecom providers actively participate in efforts to combat robocalls. The proposed rules would impose tougher enforcement, higher penalties, and stricter requirements for voice service providers participating in the Robocall Mitigation Database (RMD), a system designed to track efforts to block illegal robocalls. Key provisions of the proposal include annual recertification and accuracy updates, mandatory filing fees, and enhanced security measures including two-factor authorization.
The RMD requires providers to certify their adoption of STIR/SHAKEN protocols and detail robocall mitigation efforts. Providers not listed in the RMD cannot send call traffic through other networks. The FCC’s Enforcement Bureau identified more than 2,400 voice service providers that failed to properly file in the RMD and who must now show cause as to why they should not be removed.
BUSINESSES NEED TO KNOW: The FCCs recent action against over 2,400 voice service providers offers insight into its compliance priorities. Telecom providers should review their current policies and procedures and determine what changes may be required to comply with the proposed rules to avoid a similar fate. Some enhanced security measures, such as two-factor authorization, may require more resources to design and implement.
ADVERTISING & MARKETING
Audible Faces Class Action Over Expiring Credits
Audible Inc. is facing a proposed class action lawsuit for allegedly violating Washington consumer law by selling audiobook credits that expire after one year. The lawsuit claims that Audible’s credits function as gift certificates, which are generally not allowed to expire under Washington’s Gift Certificate Law. As such, the complaint argues that these credits, used to purchase audiobooks that Audible claims users can “keep forever,” are unlawfully time-limited. The lawsuit also accuses Audible of violating the state’s Consumer Protection Act and unjustly benefiting from the expiring credits. The plaintiff is seeking to stop the expiration of credits, along with restitution and damages.
BUSINESSES NEED TO KNOW: State laws vary! Businesses, particularly those that operate nationwide, need to be aware of state laws that apply to gift cards and other prepaid products. Make sure to clearly disclose any terms or restrictions for your credit, point, and reward programs, and ensure they are in compliance with all applicable state and federal consumer protection laws.
FTC Settles with Rytr Over False Review Generation Service
The Federal Trade Commission approved a final consent order against Rytr, addressing allegations that the company sold an AI service used for generating false and deceptive online reviews. The FTC’s complaint claimed that Rytr’s service created detailed, misleading reviews unrelated to user input, violating the FTC Act. The final order prohibits Rytr from engaging in similar conduct and bars the company from promoting or selling any service dedicated to generating consumer reviews or testimonials.
Notably, Commissioners Melissa Holyoak and Andrew N. Ferguson dissented with the Order, expressing concern with its overreach and arguing that Rytr should not be held liable for users’ actions as the company did not directly make or endorse any misrepresentations, nor does the complaint even allege that users actually posted any of the drafted reviews that would substantiate claims of consumer harm.
BUSINESSES NEED TO KNOW: This case takes on the question of a business’s liability for how a customer utilizes its products. For example, while the final order found Rytr liable for creating the means and instrumentalities to deceive consumers, Commissioners Holyoak and Ferguson cautioned against imposing primary liability where Rytr never personally engaged in misrepresentations. In the nascent stages of AI regulation and enforcement, even regulators disagree on the responsibility held by facilitating potential deceptive behavior.
FTC Finalizes Rule to Ban Hidden Fees in Ticketing and Lodging Industries
The Federal Trade Commission has finalized a bipartisan Junk Fees Rule to prohibit businesses in the event ticketing and lodging industries from using deceptive pricing tactics, such as bait-and-switch strategies or hidden fees. Effective immediately, consumers booking hotels, concert tickets, or sporting event seats must see, upfront, the total price to be charged, including all fees such as “resort,” “convenience,” or “service” fees. The rule does not restrict the type or amount of fees themselves, nor does it preclude any specific pricing strategy. However, it does require these businesses to clearly and conspicuously disclose the full price inclusive of all mandatory fees whenever they offer, display, or advertise any price of live-event tickets or short-term lodging.
BUSINESSES NEED TO KNOW: Every business should be paying attention here. The Junk Fees Rule received bipartisan support and sets a precedent that could extend to other industries. Proactively adopting transparent pricing practices can not only prepare you for future regulatory changes, but can also reduce consumer confusion, boost conversion rates, and improve your customers’ purchase experience – a win for any business in any industry.
Join M&S Attorneys Michele A. Shuster and Aaron Parry, along with Spencer Elg from What If Media Group for our Reshaping Telemarketing Compliance webinar, where they will discuss the three questions that every business should be considering as they move forward with their 2025 compliance strategy. Register Now.
Learn how we can help keep you in compliance and ahead of the regulatory curve. Let’s Talk.
Want to receive Regulatory Roundups right to your inbox? Subscribe.