PRIVACY & DATA SECURITY
HHS Proposes Major Overhaul to HIPAA Security Rule
On December 30, 2024, the U.S. Department of Health and Human Services (HHS) proposed significant updates to the HIPAA Security Rule, which has remained largely unchanged since its inception in 2003. The proposed rule aims to modernize outdated elements, such as making encryption of electronic personal health information mandatory rather than optional. It also introduces requirements for detailed data security practices, including multifactor authentication, patch management, network segmentation, and other advanced cybersecurity measures
BUSINESSES NEED TO KNOW: The proposal seeks to eliminate the confusion around “addressable” security measures by making them mandatory, providing flexibility in implementation but not allowing entities to skip essential protections. The proposal is open for public comment until early March 2025, although its adoption may face political hurdles with the new administration.
FTC Takes Action Against GM and OnStar for Misuse of Driver Data
The Federal Trade Commission has taken action against General Motors (GM) and OnStar for allegedly collecting, using, and selling drivers’ precise geolocation and driving behavior data without proper consumer consent. The FTC claims GM misled consumers into signing up for OnStar and its Smart Driver feature, failing to disclose that the data—tracked as frequently as every three seconds—was sold to consumer reporting agencies and used to influence insurance rates.
Under a proposed settlement, GM and OnStar will be banned for five years from sharing such data with consumer reporting agencies. They must also obtain explicit consumer consent before collecting vehicle data, allow consumers to access and delete their data, and provide options to limit or disable geolocation tracking.
BUSINESSES NEED TO KNOW: This marks the FTC’s first enforcement action related to connected vehicle data. More importantly, businesses should take note of the settlement’s 5-year ban. Enforcement actions are not simply about imposing a financial penalty for alleged past behavior – more often than not, they will also include restrictions on future practices that can significantly impact a business’s operations or growth strategy. Food for thought when considering the risks of noncompliance!
Allstate Hit with Class Action Suit for Alleged Misuse of Driver Data
A proposed class-action lawsuit in Illinois federal court accuses Allstate of secretly obtaining personal driving data from millions of policyholders through software embedded in third-party mobile apps. The lawsuit claims Allstate used this data—collected via apps including SiriusXM, Life360, and GasBuddy—without notifying consumers, in violation of privacy laws, the Federal Wiretap Act, and the Computer Fraud and Abuse Act.
The lawsuit asserts that Allstate and its subsidiary, mobile data and analytics company Arity, paid app developers millions to integrate tracking software, gathering data such as geolocation and accelerometer readings. This information was allegedly used to adjust premiums, deny claims, or drop policyholders—sometimes based on inaccurate assumptions, such as mistaking passengers for drivers.
BUSINESSES NEED TO KNOW: Allstate is being hit on multiple fronts. The case mirrors a similar lawsuit filed by Texas Attorney General Ken Paxton, accusing Allstate and Arity of violating Texas’ Data Privacy and Security Act by collecting drivers’ location data through tracking software in mobile apps and using that data to set car insurance rates without consumers’ knowledge or consent. Friendly reminder: before integrating 3rd party software into a mobile app, do your due diligence and know exactly what information the software is collecting and how it will be used.
FTC Finalizes Amendments to COPPA Rule
In the final days of Chair Lina Khan’s leadership, the U.S. Federal Trade Commission officially updated the Children’s Online Privacy Protection Rule (COPPA), addressing technological advancements and changing online practices with its first updates since 2013. Key updates include stricter parental notice and consent requirements, expanded security obligations, and clearer guidelines for age verification and data retention. The revised rule also tightens restrictions on third-party data sharing, enhances transparency for safe harbor programs, and expands the definition of personal information to include biometric data. The updated rule will take effect 60 days after publication in the Federal Register (which may be delayed due to the administration’s current regulatory pause).
BUSINESSES NEED TO KNOW: When it comes to privacy, one thing legislators and regulatory agencies are aligned on is prioritizing the protection of children. With enhancement and enforcement of these patchwork laws expected to continue at both the state and federal levels, businesses that fall under their scope should review their existing compliance programs and consider how data collection and retention practices may need to be adjusted for compliance.
TCPA/TELESERVICES
Eleventh Circuit Vacates One-to-One Consent Rule
At the eleventh hour before its January 27th effective date, the Eleventh Circuit vacated the FCC’s “one-to-one consent” and “logically and topically related” requirements for prior express written consent under the TCPA in Insurance Marketing Coalition Ltd v. FCC. These rules would have required consumers to give separate consent for each entity calling them. Additionally, the subject matter of the calls would have been required to be logically and topically related to the interaction that prompted the consent.
The court ruled that the FCC exceeded its statutory authority, finding that the TCPA does not define “prior express consent” and that Congress intended to incorporate common law principles of consent, which allow consumers to consent to multiple entities and unrelated topics if the consent is clear. This decision reduces the regulatory burden and potential TCPA liability for businesses, providing more flexibility in consumer communications.
BUSINESSES NEED TO KNOW: In the lead gen world, was there any bigger headline than this in January? While most businesses were not spared the cost of implementing solutions given the timing of the court’s decision, they can still breathe a sigh of relief even as they continue to be mindful of other important – and highly enforced – telemarketing regulations, including Do-Not-Call rules and the E-SIGN Act.
Looking for more info on the implications of the 11th Circuit’s decision and what businesses need to know going forward? Catch up with Michele A. Shuster and Chris Wager on our recorded webinar.
Supreme Court Weighs District Court Review of FCC TCPA Rules
The U.S. Supreme Court heard arguments on whether district courts must defer to the Federal Communications Commission’s interpretations of the TCPA under the Hobbs Act. In McLaughlin Chiropractic Associates v. McKesson Corp., the justices examined whether lower courts can independently assess FCC rulings or if they are bound by agency determinations.
Some justices expressed skepticism about preventing district courts from reviewing potentially flawed FCC interpretations. Others suggested that the appellate review process already provides a sufficient check on agency decisions. A ruling in favor of the chiropractic group could significantly alter how TCPA cases—and broader administrative law—are litigated by allowing more challenges to agency rulings in district courts.
BUSINESSES NEED TO KNOW: The outcome may hinge on the positions of Chief Justice John Roberts and Justice Amy Coney Barrett, both of whom remained silent during the session. If the Supreme Court rules against FCC deference, district courts will be free to interpret the TCPA independently, potentially leading to inconsistent rulings among courts.
ADVERTISING & MARKETING
FTC Fines accessiBe $1 Million for Alleged Misleading Web Accessibility Claims
The Federal Trade Commission has fined software provider accessiBe $1 million, asserting the software provider falsely claimed its AI-powered tool, accessWidget, could make any website compliant with the Web Content Accessibility Guidelines (WCAG) for people with disabilities. The FTC found these claims, made on accessiBe’s website, on social media, and in articles on third-party websites formatted to look like impartial and objective reviews, to be misleading and unsubstantiated.
The complaint also alleged that accessiBe misrepresented third-party reviews as independent and failed to disclose its connections to these reviewers. Under the proposed order, accessiBe must stop making such claims without evidence and clearly disclose any material connections to endorsers, in addition to the $1 million penalty.
BUSINESSES NEED TO KNOW: This appears to be a pretty standard enforcement response by the FTC for alleged violations of the FTC Act. However, we think it serves as an important reminder that deceptive marketing laws like this can apply not just to consumer-facing businesses, but to ones, like accessiBe, that engage in B2B marketing as well.
Fifth Circuit Vacates FTC’s CARS Rule on Auto Retail Scams
A split Fifth Circuit panel vacated the Federal Trade Commission’s (FTC) Combating Auto Retail Scams (CARS) rule, which aimed to prohibit bait-and-switch tactics and hidden charges in car buying and leasing. The court sided with car dealers, finding that the FTC failed to provide an “advance notice of proposed rulemaking,” as required by the Federal Trade Commission Act. The majority opinion held that the FTC’s omission was not a harmless error, and that proper advance notice could have influenced the final rule.
The CARS rule sought to enhance transparency in car purchase and leasing transactions by prohibiting deceptive practices and requiring clear disclosure of prices and add-ons. Specifically, it prohibited misrepresentations about material information, required dealers to clearly disclose the offering price, and barred dealers from charging consumers for add-ons that don’t actually provide a benefit. The rule also required dealers to get consumers’ express, informed consent before charging them.
BUSINESSES NEED TO KNOW: Could the CARS Rule be re-introduced in another form by the FTC? It’s possible. The judges ruled only on the petitioners’ claim that the FTC didn’t issue advance notice of proposed rulemaking, and not on other claims that the Commission didn’t adequately justify the rule and relied on an arbitrary and capricious cost-benefit analysis.
Join M&S Partners Michele Shuster & Josh Stevens for our first Privacy Watch webinar of 2025 coming in February. Stay tuned for registration information coming soon!
Learn how we can help keep you in compliance and ahead of the regulatory curve. Let’s Talk.
Want to receive Regulatory Roundups right to your inbox? Subscribe.