Compendium of Recent FTC Policy Statements, Advisory Opinions, and Final Rules

Page 1

Federal Trade Commission January 17, 2025 Compendium of Recent FTC Policy Statements, Advisory Opinions, and Final Rules

Page 2

Office of Policy Planning

January 17, 2025

In the last four years, the FTC has published policy statements and rulemakings on a wide variety of topics pertaining to competition and consumer protection. The FTC staff has compiled these policy statements and final rules into the attached compendium. They reflect our work on a wide array of important and popular priorities, ranging from restoring robust enforcement of corporate accountability laws to protecting Americans from discrete unlawful practices like junk fees, subscription traps, noncompetes, and much more.

We share these materials in case they are useful to states and advocates as they work in the years ahead to promote fair, honest, and competitive markets. For example, they may be useful as models for policy initiatives like state legislation or rulemakings. Additionally, many states have “mini FTC Act” statutes that provide state attorneys general and private plaintiffs with legal tools similar to the FTC Act’s prohibitions on unfair methods of competition and unfair or deceptive acts or practices. Accordingly, these materials may also be useful for efforts to enforce existing state laws.

We believe these policy statements and the explication of our legal authorities in the statements of basis and purpose accompanying these rulemakings reflect the best interpretation of the FTC Act and other statutes the FTC administers, and they may also be the best interpretation of parallel “mini FTC Acts.” We note that under Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), what matters is the “best reading” of a statute, id. at 373, regardless of whether an agency adopts it. We believe that the interpretations set forth in these documents reflect the best reading of the laws and that the reasoning provided therein will therefore prove to be durable.

We further note that the statements of basis and purpose in the enclosed final rulemakings describe in detail the extensive evidence supporting the FTC’s rules, as well as our fulsome analysis of the significant benefits the rules would provide for consumers, businesses, workers, and the economy. States and advocates may find this evidentiary record and analysis useful as they contemplate future policy initiatives.

Finally, we thank states and advocates for your partnership over the years. States and advocates have always played a vital role in protecting consumers and competition, and they have been an invaluable partner to our work at the FTC. We hope these materials can be helpful as they continue to carry out our shared mission of promoting fair, honest, and competitive markets.

Hannah Garden-Monheit Director, Office of Policy Planning Federal Trade Commission UNITED STATES OF AMERICA FEDERAL TRADE COMMISSION WASHINGTON, D.C. 20580

Page 3

TABLE OF CONTENTS

Policy Statements Statement of the Commission on the Withdrawal of the Statement of Enforcement Principles Regarding “Unfair Methods of Competition” Under Section 5 of the FTC Act (Jul. 9, 2021) ...5 Policy Statement on Repair Restrictions Imposed by Manufacturers and Sellers (Jul. 21, 2021) ......................................................................................................................................................12 Statement of the Commission on Breaches by Health Apps and Other Connected Devices (Sept. 15, 2021) ......................................................................................................................................14 Enforcement Policy Statement Regarding Negative Option Marketing (Oct. 28, 2021) ............16 Policy Statement on Education Technology and the Children’s Online Privacy Protection Act (May 19, 2022).............................................................................................................................31 Policy Statement on Rebates and Fees in Exchange for Excluding Lower Cost Drug Products (Jun. 16, 2022) .............................................................................................................................35 Policy Statement on Enforcement Related to Gig Work (Sept. 15, 2022) ...................................41 Policy Statement Regarding the Scope of Unfair Methods of Competition Under Section 5 of the Federal Trade Commission Act (Nov. 10, 2022) .........................................................................58 Policy Statement on Biometric Information and Section 5 of the Federal Trade Commission Act (May 18, 2023).............................................................................................................................74 Merger Guidelines (Dec. 18, 2023) .............................................................................................86 Statement Concerning Brand Drug Manufacturers’ Improper Listing of Patents in the Orange Book (Sept. 14, 2023) ..................................................................................................................137 Policy Statement on Franchisors’ Use of Contract Provisions, Including Non-Disparagement, Goodwill, and Confidentiality Clauses (Jul. 12, 2024) ................................................................143 Staff Guidance on the Unlawfulness of Undisclosed Fees Imposed on Franchisees (Jul. 12, 2024) ......................................................................................................................................................150 Joint Statement on Competition in Generative AI Foundation Models and AI Products (Jul. 23, 2024) ............................................................................................................................................152 Policy Statement on Exemption of Protected Labor Activity by Workers from Antitrust Liability (Jan. 14, 2025)..............................................................................................................................155 Antitrust Guidelines for Business Activities Affecting Workers (Jan. 16, 2025) ........................167

Page 4

Advisory Opinions Commission Statement on the Holder Rule and Attorneys’ Fees and Costs (Jan. 18, 2022) ......180 Final Rules Made in USA Labeling Rule (Jul. 14, 2021) ...............................................................................184 Standards for Safeguarding Customer Information – 2021 Amendments (Dec. 9, 2021) ...........198 Standards for Safeguarding Customer Information – 2023 Amendments (Nov. 13, 2023) .........241 Combating Auto Retail Scams Trade Regulation Rule (Jan. 4, 2024) .........................................252 Trade Regulation Rule on Impersonation of Government and Businesses (Mar. 1, 2024) .........358 Telemarketing Sales Rule Amendments (Apr. 16, 2024) .............................................................373 Non-Compete Clause Rule (May 7, 2024) ..................................................................................400 Health Breach Notification Rule (May 30, 2024) ........................................................................565 Ophthalmic Practice Rules (Eyeglass Rule) Amendments (Jul. 26, 2024) ..................................602 Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (Aug. 22, 2024) ....650 Negative Option Rule (Nov. 15, 2024) ........................................................................................696 Trade Regulation Rule on Unfair or Deceptive Fees (Dec. 17, 2024) .........................................766

Page 5

UNITED STATES OF AMERICA Federal Trade Commission WASHINGTON, D.C. 20580 STATEMENT OF THE COMMISSION On the Withdrawal of the Statement of Enforcement Principles Regarding “Unfair Methods of Competition” Under Section 5 of the FTC Act July 9, 2021 Section 5 of the Federal Trade Commission Act prohibits “unfair methods of competition in or affecting commerce.”1 In 2015, the Federal Trade Commission under Chairwoman Edith Ramirez published the Statement of Enforcement Principles Regarding “Unfair Methods of Competition” Under Section 5 of the FTC Act (hereinafter “2015 Statement”), which established principles to guide the agency’s exercise of its “standalone” Section 5 authority.2 Although presented as a way to reaffirm the Commission’s preexisting approach to Section 5 and preserve doctrinal flexibility,3 the 2015 Statement contravenes the text, structure, and history of Section 5 and largely writes the FTC’s standalone authority out of existence. In our view, the 2015 Statement abrogates the Commission’s congressionally mandated duty to use its expertise to identify and combat unfair methods of competition even if they do not violate a separate antitrust statute. Accordingly, because the Commission intends to restore the agency to this critical mission, the agency withdraws the 2015 Statement.

I.

Background On August 13, 2015, the Federal Trade Commission issued the 2015 Statement, which announced that the Commission would apply Section 5 using “a framework similar to the rule of reason,” by only challenging actions that “cause, or [are] likely to cause, harm to competition or the competitive process, taking into account any associated cognizable efficiencies and business justifications[.]”4 The 2015 Statement advised that the Commission is “less likely” to raise a 1 15 U.S.C. § 45(a)(1).

2 FTC, Statement of Enforcement Principles Regarding “Unfair Methods of Competition” Under Section 5 of the FTC Act (Aug. 13, 2015) [hereinafter “2015 Statement”], https://www.ftc.gov/system/files/documents/public_statements/735201/150813section5enforcement.pdf. 3 Address by Chairwoman Edith Ramirez, Competition Law Center, George Washington University Law School, 3 (Aug. 13, 2015), https://www.ftc.gov/system/files/documents/public_statements/735411/150813section5speech.pdf (“Our aim in adopting this policy statement is to reaffirm the principles that guide our enforcement decisions, leaving for future generations the flexibility to do the same.”). 4 2015 Statement, supra note 2. Chairwoman Ramirez and Commissioners Julie Brill, Terrell McSweeny, and Joshua Wright voted in favor of the statement. Commissioner Maureen Ohlhausen dissented. FTC Press Release, FTC Issues Statement of Principles Regarding Enforcement of FTC Act as a Competition Statute (Aug. 13, 2015), https://www.ftc.gov/news-events/press-releases/2015/08/ftc-issues-statementprinciples-regarding-enforcement-ftc-act.

Page 6

standalone Section 5 claim “if enforcement of the Sherman or Clayton Act is sufficient to address the competitive harm.”5

In a statement accompanying the issuance of these principles, the Commission explained that its enforcement of Section 5 would be “aligned with” the Sherman and Clayton Acts and thus subject to “the ‘rule of reason’ framework developed under the antitrust laws[.]”6 In a speech announcing the statement, Chairwoman Ramirez noted that she favored a “common-law approach” to Section 5 rather than “a prescriptive codification of precisely what conduct is prohibited.”7 She also acknowledged that the Commission’s policy statement was codifying an interpretation of Section 5 that is more restrictive than the Commission’s historic approach and more constraining than the prevailing case law.8 She added, “[W]e now exercise our standalone Section 5 authority in a far narrower class of cases than we did throughout most of the twentieth century.”9

With the exception of certain administrative complaints involving invitations to collude, the agency has pled a standalone Section 5 violation just once in the more than five years since it published the statement.10

II.

The Text, Structure, and History of Section 5 Reflect a Clear Legislative Mandate Broader than the Sherman and Clayton Acts

By tethering Section 5 to the Sherman and Clayton Acts, the 2015 Statement negates the Commission’s core legislative mandate, as reflected in the statutory text, the structure of the law, and the legislative history, and undermines the Commission’s institutional strengths.

In 1914, Congress enacted the Federal Trade Commission Act to reach beyond the Sherman Act and to provide an alternative institutional framework for enforcing the antitrust

5 2015 Statement, supra note 2.

6 FTC, Statement on the Issuance of Enforcement Principles Regarding “Unfair Methods of Competition” Under Section 5 of the FTC Act, at 2 (Aug. 13, 2015), https://www.ftc.gov/system/files/documents/public_statements/735381/150813commissionstatementsecti on5.pdf; see also Chairwoman Ramirez, supra note 3, at 10 (“Today’s policy statement reaffirms that this same framework governs standalone Section 5 claims no less than claims arising under the Sherman and Clayton Acts.”).

7 Address by Chairwoman Ramirez, supra note 3, at 2.

8 Id. at 4-5.

9 Id. at 2.

10 See Federal Trade Commission’s Complaint for Equitable Relief, FTC v. Qualcomm Inc., No. 5:17-cv- 00220 (N.D. Cal. Jan. 17, 2017), [hereinafter “Qualcomm Complaint”], https://www.ftc.gov/system/files/documents/cases/170117qualcomm_redacted_complaint.pdf. Even in Qualcomm, the Commission primarily relied on arguments under the Sherman Act; the standalone theory was not a core focus of the litigation.

Page 7

laws.11 After the Supreme Court announced in Standard Oil that it would subject restraints of trade to an open-ended “standard of reason” under the Sherman Act, lawmakers were concerned that this approach to antitrust delayed resolution of cases, delivered inconsistent and unpredictable results, and yielded outsized and unchecked interpretive authority to the courts.12 For instance, Senator Newlands complained that Standard Oil left antitrust regulation “to the varying judgments of different courts upon the facts and the law”; he thus sought to create an “administrative tribunal … with powers of recommendation, with powers of condemnation, [and] with powers of correction.”13 Likewise, a 1913 Senate committee report lamented that the rule of reason had made it “impossible to predict” whether courts would condemn many “practices that seriously interfere with competition, and are plainly opposed to the public welfare,” and thus called for legislation “establishing a commission for the better administration of the law and to aid in its enforcement.”14 These concerns spurred the passage of the FTC Act, which created an administrative body that could police unlawful business practices with greater expertise and democratic accountability than courts provided.15

At the heart of the statute was Section 5, which declares “unfair methods of competition” unlawful.16 By proscribing conduct using this new term, rather than codifying either the text or judicial interpretations of the Sherman Act, the plain language of the statute makes clear that Congress intended for Section 5 to reach beyond existing antitrust law.

The structure of Section 5 also supports a reading that is not limited to an extension of the Sherman Act. Notably, the FTC Act’s remedial scheme differs significantly from the remedial structure of the other antitrust statutes. The Commission cannot pursue criminal penalties for violations of “unfair methods of competition,” and Section 5 provides no private right of action, shielding violators from private lawsuits and treble damages. In this way, the institutional design laid out in the FTC Act reflects a basic tradeoff: Section 5 grants the Commission extensive authority to shape doctrine and reach conduct not otherwise prohibited by the Sherman Act, but provides a more limited set of remedies.17

The legislative debate around the FTC Act makes clear that the text and structure of the statute were intentional. Lawmakers chose to leave it to the Commission to determine which practices fell into the category of “unfair methods of competition” rather than attempt to define through statute the various unlawful practices, given that “there were too many unfair practices

11 See Neil Averitt, The Meaning of ‘Unfair Methods of Competition’ in Section 5 of the FTC Act, 21 B.C. L. REV. 227, 229-240 (1980).

12 Id. at 232-237. See Standard Oil Co. v. United States, 221 U.S. 1, 60 (1911). 13 See 47 CONG. REC. 1225 (1911) (statement of Sen. Newlands). 14 S. REP. NO. 1326, 62d Cong., 3d Sess., at xiv (1913).

15 See Averitt, supra note 11, at 232-37.

16 15 U.S.C. § 45(a).

17 William E. Kovacic & Marc Winerman, Competition Policy and the Application of Section 5 of the Federal Trade Commission Act, 76 ANTITRUST L.J. 929, 932 (2010).

Page 8

to define, and after writing 20 of them into the law it would be quite possible to invent others.”18 Lawmakers were clear that Section 5 was designed to extend beyond the reach of the antitrust laws.19 For example, Senator Cummins, one of the main sponsors of the FTC Act, stated that the purpose of Section 5 was “to make some things punishable, to prevent some things, that cannot be punished or prevented under the antitrust law.”20

The Supreme Court has repeatedly affirmed this view of the agency’s Section 5 authority, holding that the statute, by its plain text, does not limit unfair methods of competition to practices that violate other antitrust laws.21 The Court, recognizing the Commission’s expertise in competition matters, has given “deference”22 and “great weight”23 to the Commission’s determination that a practice is unfair and should be condemned.

Although the Commission suffered a few notable defeats under Section 5 in the early 1980s, those decisions in no way support the 2015 Statement’s decision to tether Section 5 to the Sherman and Clayton Acts. For example, in Boise Cascade, the Ninth Circuit ruled that the evidence did not support the Commission’s factual finding that the defendants’ conduct had an adverse effect on prices.24 In Ethyl, the Second Circuit explicitly held that the FTC’s Section 5 authority is broader than the Sherman or Clayton Acts, but it required the Commission to show that the challenged conduct is “collusive, coercive, predatory, or exclusionary,” or has an “anticompetitive purpose,” or “cannot be supported by an independent legitimate reason.”25 In short, these decisions confirm that Section 5 empowers the Commission to prohibit conduct that does not violate other antitrust laws, so long as it clearly explains why the practice is illegitimate and bases that ruling on substantial evidence.

18 S. REP. NO. 597, 63d Cong., 2d Sess., 13 (1914) (“The committee gave careful consideration to the question as to whether it would attempt to define the many and variable unfair practices which prevail in commerce and to forbid [them] or whether it would, by a general declaration condemning unfair practices, leave it to the commission to determine what practices were unfair. It concluded that the latter course would be the better, for the reason . . . that there were too many unfair practices to define, and after writing 20 of them into the law it would be quite possible to invent others.”). 19 See Averitt, supra note 11, at 251-252.

20 51 CONG. REC. 11, 236 (1914) (statement of Sen. Cummins). 21 See FTC v. Ind. Fed’n of Dentists, 476 U.S. 447, 454 (1986); FTC v. Sperry & Hutchinson Co., 405 U.S. 233, 244 (1972); FTC v. Brown Shoe Co., 384 U.S. 316, 321 (1966); FTC v. Motion Picture Advert. Serv. Co., 344 U.S. 392, 394-95 (1953); FTC v. R.F. Keppel & Bros., Inc., 291 U.S. 304, 309-310 (1934). 22 Ind. Fed’n of Dentists, 476 U.S. at 454.

23 Atl. Ref. Co. v. FTC, 381 U.S. 357, 368 (1965) (quoting FTC v. Cement Inst., 333 U.S. 683, 720 (1948)).

24 Boise Cascade Corp. v. FTC, 637 F.2d 573, 577-82 (9th Cir. 1980). 25 E.I. du Pont de Nemours & Co. v. FTC, 729 F.2d 128, 136-40 (2d Cir. 1984). See also Official Airline Guides, Inc. v. FTC, 630 F.2d 920, 927-28 (2d Cir. 1980) (holding that while courts must give “great weight” to the Commission’s judgment that a practice is unfair, the Commission could not condemn a monopolist’s refusal to deal where it “has no purpose to restrain competition or expand [its] monopoly, and does not act coercively”).

Page 9

III.

The 2015 Statement Overlooks the Unique Features of Section 5, Ratifies an Unadministrable Approach, and Perpetuates Uncertainty in the Law

In addition to flouting a clear congressional mandate, the 2015 Statement fails to consider or even recognize the unique features of or limits on Section 5. By instead confining Section 5 to the framework that presently governs the Sherman and Clayton Acts, the 2015 Statement willfully surrenders the Commission’s key institutional advantages as an administrative agency with the power to adjudicate cases, issue rules and industry guidance, and conduct detailed marketplace studies.26

The Commission’s efforts to constrain Section 5 in this way have only hindered the agency’s enforcement efforts. Coupling Section 5 to the Sherman Act has led courts to bind the FTC to liability standards created by generalist judges in private treble-damages actions under the Sherman Act, despite the striking differences in institutional contexts and the Commission’s unique role as an expert public body.27 Aside from invitations to collude—which the agency has long treated as a violation of Section 528—the Commission has pled a standalone Section 5 claim just once since the issuance of the 2015 Statement.29 In practice, the Statement has doubled down on the Commission’s longstanding failure to investigate and pursue “unfair methods of competition.”

Moreover, by subjecting Section 5 to a framework similar to the rule of reason, the Commission hamstrings its enforcement mission with an approach that poses significant administrability concerns. The current iteration of the rule of reason invites courts to assess whether particular business conduct is “unreasonable,” including through determining whether the “procompetitive” effects of the conduct outweigh any “anticompetitive” effects.30 Famously unwieldy, the standard leads to soaring enforcement costs, risks inconsistent outcomes, and has been decried by judges as unadministrable or exceedingly difficult to meet.31

26 See, e.g., Professor Daniel A. Crane, Comments at FTC Workshop on Section 5 of the FTC Act as a Competition Statute, 73-74 (Oct. 17, 2008), https://www.ftc.gov/sites/default/files/documents/public_events/section-5-ftc-act-competitionstatute/transcript.pdf, (“What I want to suggest is that, in many ways, by marrying the meaning of Section 5 to the Sherman Act, the FTC is losing many, many of its institutional advantages, as both a norm creator and an enforcer of antitrust law.”).

27 See id. at 76 (“[B]y coupling the Sherman Act to the FTC Act, the FTC gets saddled with a rule that was created in a completely different institutional context with different considerations.”); id. at 77 (“I think this is a huge mistake in terms of the institutional context. You’re taking baggage you don’t have to take and you shouldn’t take and it leads to weakened liability norms in the FTC.”). 28 See, e.g., Oregon Lithoprint, Inc.; Analysis to Aid Public Comment, 83 Fed. Reg. 11529, 11531 (Mar. 15, 2018) (“The Commission has long held that an invitation to collude violates Section 5 of the FTC Act even where there is no proof that the competitor accepted the invitation.”). 29 See Qualcomm Complaint, supra note 10.

30 See, e.g., Ohio v. Am. Express Co., 138 S. Ct. 2274, 2283-84 (2018). 31 See, e.g., Leegin Creative Leather Prods., Inc. v. PSKS, Inc., 551 U.S. 877, 916 (2007) (Breyer, J., dissenting) (“How easily can courts identify instances in which the benefits are likely to outweigh potential harms? My own answer is, not very easily.”); Richard A. Posner, The Rule of Reason and the

Page 10

In practice, courts have also used the weaknesses of the rule of reason as a basis for restricting private antitrust plaintiffs.32 As the Supreme Court recently pointed out, scholars have found that the defendant prevailed in “nearly all rule of reason cases in the last 45 years on the ground that the plaintiff failed to show a substantial anticompetitive effect.”33 Indeed, lawmakers’ concerns about the infirmities of the rule of reason standard were partly why Congress enacted Section 5 in the first place.34 Tying Section 5 back to this framework offends the plain text, structure, and legislative history of Section 5 and needlessly constrains the Commission from taking action to safeguard the public from unfair methods of competition.

The 2015 Statement is also rife with internal contradictions that may effectively read the Commission’s standalone Section 5 authority out of the statute altogether. First, although the Statement recognizes that Section 5 prohibits conduct that would violate the Sherman or Clayton Acts “if allowed to mature or complete,” it then requires the Commission to prove “likely” anticompetitive effects under the rule of reason.35 Importing the rule of reason’s likelihood requirement would abrogate the Commission’s statutory mandate to combat incipient wrongdoing before it becomes likely to harm consumers or competition. As the Supreme Court has held, Section 5 “was designed to supplement and bolster the Sherman Act and Clayton Act— to stop in their incipiency acts and practices which, when full blown, would violate those Acts.”36

Second, although the 2015 Statement declares that the Commission will apply a “framework similar to the rule of reason,” it then suggests that the Commission will typically refrain from bringing a standalone Section 5 case where the Sherman or Clayton Acts already apply. But it is hard to imagine what, if any, cases could ever meet both of these criteria: With the exception of invitations to collude, almost every practice that is unlawful under the rule of reason will already be subject to the Sherman or Clayton Acts and thus (according to the 2015 Statement) be improper targets for standalone Section 5 enforcement. The 2015 Statement may have hinted at a broader reading of Section 5 by embracing an undefined “framework similar to” the rule of reason, but if that was the Commission’s intent, the reference was far too vague to provide any meaningful guidance. By both wedding Section 5 to the Sherman Act’s legal

Economic Approach: Reflections on the Sylvania Decision, 45 U. CHI. L. REV. 1, 14 (1977) (“The content of the Rule of Reason is largely unknown; in practice, it is little more than a euphemism for nonliability.”).

32 Maurice E. Stucke, Does the Rule of Reason Violate the Rule of Law?, 42 U.C. DAVIS L. REV. 1375, 1383, 1423, 1471 (2009).

33 NCAA v. Alston, No. 20-512, slip op. at 25 (June 21, 2021) (citing Brief for 65 Professors of Law, Business, Economics, and Sports Management as Amici Curiae 21, n. 9); see also Michael A. Carrier, The Rule of Reason: An Empirical Update for the 21st Century, 16 GEO. MASON L. REV. 827 (2009). 34 See supra pp. 2-3.

35 2015 Statement, supra note 2.

36 FTC v. Motion Picture Advert. Serv. Co., 344 U.S. 392, 394-95 (1953) (citing FTC v. Beech-Nut Packing Co., 257 U.S. 441, 453 (1922); Fashion Originators' Guild of Am. v. FTC, 312 U.S. 457, 463, 466 (1941)); see also FTC v. Brown Shoe Co., 384 U.S. 316, 321-22 (1966).

Page 11

standard and signaling that Section 5 won’t be pursued if the Sherman Act already applies, the 2015 Statement effectively turns standalone Section 5 into a dead letter.

More generally, the 2015 Statement assumes a case-by-case approach to “unfair methods of competition,” despite widespread recognition that this adjudication-only approach often fails to deliver clear guidance.37 Without explanation, the Statement fails to address the possibility of the Commission adopting rules to clarify the legal limits that apply to market participants.

The Commission’s inability, after a century of commanding this statutory authority, to deliver clear Section 5 principles suggests that the time is right for the Commission to rethink its approach and to recommit to its mandate to police unfair methods of competition even if they are outside the ambit of the Sherman or Clayton Acts. The task will require careful and serious work, but it is one that our enabling statute expected and required.

IV.

Looking Ahead

Withdrawing the 2015 Statement is only the start of our efforts to clarify the meaning of Section 5 and apply it to today’s markets. Section 5 is one of the Commission’s core statutory authorities in competition cases; it is a critical tool that the agency can and must utilize in fulfilling its congressional mandate to condemn unfair methods of competition. In the coming months, the Commission will consider whether to issue new guidance or to propose rules that will further clarify the types of practices that warrant scrutiny under this provision. In the meantime, the Commission will exercise responsibly its prosecutorial discretion in determining which cases are appropriate under Section 5, consistent with legal precedent.

37 See Rohit Chopra & Lina M. Khan, The Case for “Unfair Methods of Competition” Rulemaking, 87 U. CHI. L. REV. 357, 359-63 (2020); Sandeep Vaheesan, Resurrecting “A Comprehensive Charter of Economic Liberty”: The Latent Power of the Federal Trade Commission, 19 U. PA. J. BUS. L. 645, 668- 70 (2017); Jan M. Rybnicek & Joshua D. Wright, Defining Section 5 of the FTC Act: The Failure of the Common Law Method and the Case for Formal Agency Guidelines, 21 GEO. MASON L. REV. 1287, 1288, 1304-05 (2014); Kovacic & Winerman, supra note 17, at 933-34; C. Scott Hemphill, An Aggregate Approach to Antitrust: Using New Data and Rulemaking to Preserve Drug Competition, 109 COLUM. L. REV. 629, 674-80 (2009); Crane, supra note 26, at 78-79.

Page 12

UNITED STATES OF AMERICA

Federal Trade Commission WASHINGTON, D.C. 20580

Policy Statement of the Federal Trade Commission on Repair Restrictions Imposed by Manufacturers and Sellers

In 2019, the Federal Trade Commission (“Commission”) called for public comment and empirical research on repair restrictions, which culminated in the Commission’s “Nixing the Fix” report to Congress.1 The Commission is now issuing this policy statement regarding its enforcement policy with respect to repair restrictions.

Restricting consumers and businesses from choosing how they repair products can substantially increase the total cost of repairs, generate harmful electronic waste, and unnecessarily increase wait times for repairs. In contrast, providing more choice in repairs can lead to lower costs, reduce e-waste by extending the useful lifespan of products, enable more timely repairs, and provide economic opportunities for entrepreneurs and local businesses.

In 2019, the Commission convened a workshop on “Nixing the Fix” and sought input from consumers, independent businesses, manufacturers, and others. Through this work, the Commission uncovered evidence that manufacturers and sellers may, without reasonable justification, be restricting competition for repair services in numerous ways, including: imposing physical restrictions (e.g., the use of adhesives); limiting the availability of parts, manuals, diagnostic software, and tools to manufacturers’ authorized repair networks; using designs that make independent repairs less safe; limiting the availability of telematics information (i.e., information on the operation and status of a vehicle that is collected by a system contained in the vehicle and wirelessly relayed to a central location, often the manufacturer or dealer of the vehicle); asserting patent rights and enforcement of trademarks in an unlawful, overbroad manner; disparaging non-OEM parts and independent repair; using unjustified software locks, digital rights management, and technical protection measures; and imposing restrictive end user license agreements.

The Commission’s report on repair restrictions explores and discusses a number of these issues and describes the hardships repair restrictions create for families and businesses. The Commission is concerned that this burden is borne more heavily by underserved communities, including communities of color and lower-income Americans.2 The pandemic exacerbated these effects as consumers relied more heavily on technology than ever before.3

1 Federal Trade Commission. Nixing the Fix: An FTC Report to Congress on Repair Restrictions. (May 2021) https://www.ftc.gov/system/files/documents/reports/nixing-fix-ftc-report-congress-repairrestrictions/nixing_the_fix_report_final_5521_630pm-508_002.pdf. 2 See id. at 3-4.

3 Id. at 4-5.

Page 13

While unlawful repair restrictions have generally not been an enforcement priority for the Commission for a number of years,4 the Commission has determined that it will devote more enforcement resources to combat these practices.5 Accordingly, the Commission will now prioritize investigations into unlawful repair restrictions under relevant statutes such as the Magnuson-Moss Warranty Act6 and Section 5 of the Federal Trade Commission Act.7

First, the Commission urges the public to submit complaints and provide other information to aid in greater enforcement of the Magnuson-Moss Warranty Act and its implementing regulations. While current law does not provide for civil penalties or redress, the Commission will consider filing suit against violators of the Magnuson-Moss Warranty Act to seek appropriate injunctive relief. The Commission will also closely monitor private litigation to determine whether the Commission may wish to investigate a pattern of unfair or deceptive acts or practices or file an amicus brief. Further, the Commission will explore rulemaking, as appropriate.

Second, the Commission will scrutinize repair restrictions for violations of the antitrust laws. For example, certain repair restrictions may constitute tying arrangements or monopolistic practices—such as refusals to deal, exclusive dealing, or exclusionary design—that violate the Sherman Act.8 Violations of the Sherman Act also violate the prohibition on unfair methods of competition codified in Section 5 of the Federal Trade Commission Act.

Third, the Commission will assess whether repair restrictions constitute unfair acts or practices, which are also prohibited by Section 5 of the Federal Trade Commission Act. In addition, the Commission will analyze any material claims made to purchasers and users to ascertain whether there are any prohibited deceptive acts or practices, in violation of Section 5 of the Federal Trade Commission Act.

Finally, the Commission will bring an interdisciplinary approach to this issue, using resources and expertise from throughout the agency to combat unlawful repair restrictions. The FTC will also closely coordinate with state law enforcement and policymakers to ensure compliance and to update existing law and regulation to advance the goal of open repair markets.

4 The Commission has brought only one case alleging a violation of the Magnuson-Moss Warranty Act in the past decade. In the Matter of BMW of North America, LLC, No. 132-3150 (October 2015). During this period, the Commission’s efforts have included issuing several warning letters to companies that appeared to be engaged in warranty tying in violation of the Magnuson-Moss Warranty Act. See FTC Staff Warns Companies that It Is Illegal to Condition Warranty Coverage on the Use of Specified Parts or Services, https://www.ftc.gov/news-events/pressreleases/2018/04/ftc-staff-warns-companies-it-illegal-condition-warranty-coverage. 5 In conjunction with the Nixing the Fix Workshop, the Commission sought public comments and submissions of empirical research concerning repair restrictions. The full docket of public comments and empirical research submissions is available at https://www.regulations.gov/docket/FTC-2019-0013/document and https://www.regulations.gov/document/FTC-2019-0013-0001/comment. 6 15 U.S.C. § 2301 et. seq. The Magnuson-Moss Warranty Act prohibits, among other things, tying arrangements that condition a consumer product’s warranty on the use of a third-party service provider or on the use of a particular product, unless the warrantor provides the services or products for free or obtains a waiver from the FTC. 15 U.S.C. § 2302(c).

7 15 U.S.C. § 45. Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive actors or practices, as well as unfair methods of competition, in or affecting commerce. Section 5 also encompasses violations of the Sherman Act, which prohibits certain exclusionary and other anticompetitive conduct. 8 See, e.g., Eastman Kodak Co. v. Image Technical Servs., Inc., 504 U.S. 451 (1992); United States v. Microsoft, 253 F.3d 34 (D.C. Cir. 2001).

Page 14

UNITED STATES OF AMERICA Federal Trade Commission WASHINGTON, D.C. 20580

Office of the Chair

STATEMENT OF THE COMMISSION On Breaches by Health Apps and Other Connected Devices

September 15, 2021

In recognition of the proliferation of apps and connected devices that capture sensitive health data, the Federal Trade Commission is providing this Policy Statement to offer guidance on the scope of the FTC’s Health Breach Notification Rule, 16 C.F.R. Part 318 (“the Rule”).1

The FTC’s Health Breach Notification Rule helps to ensure that entities who are not covered by the Health Insurance Portability and Accountability Act (“HIPAA”) nevertheless face accountability when consumers’ sensitive health information is compromised. Under the Rule’s requirements, vendors of personal health records (“PHR”) and PHR-related entities must notify U.S. consumers and the FTC, and, in some cases, the media, if there has been a breach of unsecured identifiable health information, or face civil penalties for violations. The Rule also covers service providers to these entities. In practical terms, this means that entities covered by the Rule who have experienced breaches cannot conceal this fact from those who have entrusted them with sensitive health information.

The Rule was issued more than a decade ago, but the explosion in health apps and connected devices makes its requirements with respect to them more important than ever. The FTC has advised mobile health apps to examine their obligations under the Rule,2 including through the use of an interactive tool.3 Yet the FTC has never enforced the Rule, and many appear to misunderstand its requirements. This Policy Statement serves to clarify the scope of the Rule, and place entities on notice of their ongoing obligation to come clean about breaches.

The Rule covers vendors of personal health records that contain individually identifiable health information created or received by health care providers. The Rule is triggered when such entities experience a “breach of security.”4 Under the definitions cross-referenced by the Rule, the developer of a health app or connected device is a “health care provider” because it “furnish[es] health care services or supplies.”5 When a health app, for example, discloses

1 The Rule implements the requirements of the American Recovery & Reinvestment Act of 2009, Pub. L. No. 111-5, 123 Stat. 115, codified at 42 U.S.C. § 17937.

2 Mobile Health App Developers: FTC Best Practices, FED. TRADE COMM’N, https://www.ftc.gov/tipsadvice/business-center/guidance/mobile-health-app-developers-ftc-best-practices (last visited on Sept. 15, 2021). 3 Mobile Health Apps Interactive Tool, FED. TRADE COMM’N, https://www.ftc.gov/tips-advice/businesscenter/guidance/mobile-health-apps-interactive-tool (last visited on Sept. 15, 2021). 4 See 16 C.F.R. § 318.2(a) 5 See id. § 318.2; 42 U.S.C. § 1320d(6), d(3).

Page 15

sensitive health information without users’ authorization, this is a “breach of security” under the Rule.6 The statute directing the FTC to promulgate the Rule requires that a “personal health record” be an electronic record that can be drawn from multiple sources. The Commission considers apps covered by the Rule if they are capable of drawing information from multiple sources, such as through a combination of consumer inputs and application programming interfaces (“APIs”). For example, an app is covered if it collects information directly from consumers and has the technical capacity to draw information through an API that enables syncing with a consumer’s fitness tracker. Similarly, an app that draws information from multiple sources is covered, even if the health information comes from only one source. For example, if a blood sugar monitoring app draws health information only from one source (e.g., a consumer’s inputted blood sugar levels), but also takes non-health information from another source (e.g., dates from your phone’s calendar), it is covered under the Rule.

In addition, the Commission reminds entities offering services covered by the Rule that a “breach” is not limited to cybersecurity intrusions or nefarious behavior. Incidents of unauthorized access, including sharing of covered information without an individual’s authorization, triggers notification obligations under the Rule.

As many Americans turn to apps and other technologies to track diseases, diagnoses, treatment, medications, fitness, fertility, sleep, mental health, diet, and other vital areas, this Rule is more important than ever. Firms offering these services should take appropriate care to secure and protect consumer data. The Commission intends to bring actions to enforce the Rule consistent with this Policy Statement. Violations of the Rule face civil penalties of $43,792 per violation per day.

6 Id. § 318.2(a) (defining “breach of security” as “acquisition of [PHR identifiable health information] without the authorization of the individual.”).

Page 16

Enforcement Policy Statement Regarding Negative Option Marketing

I.

Introduction and Background The Federal Trade Commission (“FTC” or “Commission”) issues this Policy Statement to provide guidance regarding its enforcement of various statutes and FTC regulations addressing negative option marketing and operating.1 This Statement is intended to assist the business community and practitioners by providing specific guidance on the Commission’s interpretation of existing law as it applies to negative option practices. This Statement may also assist the courts in developing an appropriate framework for interpreting and applying the various statutes and regulations addressing negative option marketing discussed herein. Negative option offers come in a variety of forms, but all share a central feature: each contains a term or condition under which the seller may interpret a consumer’s silence or failure to take affirmative action to reject a good or service or to cancel the agreement as acceptance or continuing acceptance of the offer.2 Typically, negative option arrangements include, but are not limited to, automatic renewals, continuity plans, free-to-pay or fee-to-pay conversions, and prenotification plans. Automatic renewals allow sellers (e.g., a magazine publisher) to

1 This Policy Statement elaborates on principles annunciated by the Commission in individual cases and rules issued over the course of many years. This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates one or more existing statutory or regulatory requirements. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action under the FTC Act or other statutes. Pursuant to the Congressional Review Act (5 U.S.C. § 801 et seq.), the Office of Information and Regulatory Affairs designated this Policy Statement as not a “major rule,” as defined by 5 U.S.C. § 804(2). 2 The Commission’s Telemarking Sales Rule (16 C.F.R. Part 310) defines a negative option feature as a provision in an offer or agreement to sell or provide any goods or services “under which the customer’s silence or failure to take an affirmative action to reject goods or services or to cancel the agreement is interpreted by the seller as acceptance of the offer.” 16 C.F.R. § 310.2(w).

Page 17

unilaterally renew consumers’ subscriptions when they expire, unless consumers affirmatively cancel their subscriptions by a certain date. Continuity plans allow consumers to agree in advance to receive periodic shipments of goods or provision of services (e.g., bottled water delivery), which they continue to receive until they cancel the agreement. Free trial marketing (e.g., free-to-pay conversions) provides consumers the opportunity to receive goods or services for free (or at a nominal fee) for a trial period. After the trial period, sellers can automatically begin charging a fee (or higher fee) unless consumers affirmatively cancel or return the goods or services. Finally, under prenotification plans3 (e.g., book-of-the-month clubs), sellers provide periodic notices offering goods to participating consumers and then send—and charge for—those goods only if the consumers take no action to decline the offer. The periodic announcements and shipments can continue indefinitely.4 Negative option programs are widespread in the marketplace and can provide substantial benefits for sellers and consumers. At the same time, consumers suffer costs when marketers fail to make adequate disclosures, bill consumers without their consent, or make cancellation difficult or impossible. Over the years, unfair or deceptive negative option practices have remained a persistent source of consumer harm, often saddling shoppers with recurring payments for products and services they did not intend to purchase or did not want to continue to purchase.5 To address this problem, the Commission and states regularly bring cases

3 The Commission’s Rule on the “Use of Prenotification Negative Option Plans” (16 C.F.R. Part 425) only covers this type of negative option marketing.

4 In addition, some negative option offers include upsell or bundled offers, where sellers use consumers’ billing data to sell additional products from the same seller or pass consumers’ billing data to a third party for their sales. An upsell occurs when a consumer completes a first transaction and then receives a second solicitation for an additional product or service. A bundled offer occurs when a seller packages two or more products or services together so that they cannot be purchased separately.

5 See, e.g., n. 6 infra.

Page 18

challenging a variety of harmful negative option practices. These matters involve a range of deceptive or unfair practices, including inadequate disclosures of hidden charges in ostensibly “free” offers and other products or services, enrollment without consumer consent, and inadequate or overly burdensome cancellation and refund procedures.6 In addition, the Commission receives thousands of complaints each year related to negative option marketing. The number of ongoing cases and high volume of complaints demonstrate there is prevalent, unabated consumer harm in the marketplace.

The FTC’s enforcement actions primarily rely on Section 5 of the FTC Act (15 U.S.C. § 45(a)), the Restore Online Shoppers’ Confidence Act (“ROSCA”) (15 U.S.C. §§ 8401-8405), and the Telemarketing Sales Rule (16 C.F.R. Part 310). However, the Rule on the Use of Prenotification Negative Option Plans (16 C.F.R. Part 425), the Electronic Fund Transfer Act (“EFTA”) (15 U.S.C. §§ 1693-1693r), and the Postal Reorganization Act (i.e., the Unordered Merchandise Statute) (39 U.S.C. § 3009) also address various aspects of negative option marketing.

6 Recent examples of these matters include: FTC v. JDI Dating, Ltd., No. 1:14-cv-08400 (N.D. Ill. 2014); FTC, State of Illinois, and State of Ohio v. One Technologies, LP, No. 3:14-cv-05066 (N.D. Cal. 2014); FTC v. Health Formulas, LLC, No. 2:14-cv-01649-RFB-GWF (D. Nev. 2016); FTC v. BunZai Media Group, Inc., No. 2:15-cv- 04527-GW-PLA (C.D. Cal. 2015); FTC v. NutraClick LLC, No. 2:16-cv-06819-DMG-JPR (C.D. Cal. 2016) (NutraClick I); FTC v. DOTAuthority.com, Inc., No. 0:16-cv-62186-WJZ (S.D. Fla. 2016); FTC v. XXL Impressions, No. 1:17-cv-00067-NT (D. Me. 2017); FTC v. AAFE Products Corp., No. 3:17-cv-00575 (S.D. Cal. 2017); FTC v. RevMountain, LLC, No. 2:17-cv-02000-APG-GWF (D. Nev. 2017); FTC v. Pact, Inc., No. 2:17-cv-01429 (W.D. Wash. 2017); FTC v. Tarr, No. 3:17-cv-02024-LAB-KSC (S.D. Cal. 2017); FTC v. Credit Bureau Center, LLC, No. 17-cv-00194 (N.D. Ill. 2017); FTC v. AdoreMe, Inc., No. 1:17-cv-09083 (S.D.N.Y. 2017); FTC v. Triangle Media Corp., No. 3:18-cv- 01388-LAB-LL (S.D. Cal. 2018); In re: UrthBox, Inc., No. C-4676 (FTC 2019); FTC v. Elite IT Partners, Inc., No. 2:19-cv-00125-RJS (D. Utah 2019); FTC v. Apex Capital Group, LLC, No. 2:18-cv-09573-JFW-JPR (C.D. Cal. 2018); FTC v. AH Media, No. 3:19-cv-04022-JD (N.D. Cal. 2019); FTC v. Age of Learning, Inc., No. 2:20-cv-07996 (C.D. Cal. 2020); FTC v. NutraClick, LLC, No. 2:20-cv-08612 (C.D. Cal. 2020) (NutraClick II).

Page 19

Section 5 of the FTC Act: Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices, is the core consumer protection statute enforced by the Commission, and therefore, has traditionally served as the primary mechanism for addressing deceptive negative option claims.7 In its guidance and cases, the FTC has highlighted four basic Section 5 requirements that negative option marketing must follow to comply with Section 5.8 First, marketers must clearly and conspicuously disclose the material terms of a negative option offer including, at a minimum, key terms such as the existence of the negative option offer, the offer’s total cost, and how to cancel the offer.9 Second, sellers must disclose these material terms before consumers agree to the purchase.10 Third, marketers must obtain consumers’ express informed

7 Section 5 specifically states that “unfair or deceptive acts or practices in or affecting commerce . . . are . . . declared unlawful.” The FTC Act defines “unfair or deceptive acts or practices” to include such acts or practices involving foreign commerce that cause or are likely to cause reasonably foreseeable injury within the United States or involve material conduct occurring within the United States (15 U.S.C. § 45(a)(4)(A)). It also defines “unfair” practices as those that cause or are likely “to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition” (15 U.S.C. § 45(n)).

8 See Negative Options: A Report By the Staff of the FTC’s Division of Enforcement, 26-29 (Jan. 2009), https://www.ftc.gov/sites/default/files/documents/reports/negative-options-federal-tradecommission-workshop-analyzing-negative-option-marketing-reportstaff/p064202negativeoptionreport.pdf. In discussing the principal Section 5 requirements related to negative options, the report cites to the following pre-ROSCA cases, FTC v. JAB Ventures, No. CV08-04648 (C.D. Cal. 2008); FTC v. Complete Weightloss Center, No. 1:08cv00053 (D.N.D. 2008); FTC v. Berkeley Premium Nutraceuticals, No. 1:06cv00051 (S.D. Ohio 2006); FTC v. Think All Publ’g, No. 4:07cv11 (E.D. Tex. 2006); FTC v. Hispanexo, No. 1:06cv424 (E.D. Va. 2006); FTC v. Consumerinfo.com, No. SACV05-801 (C.D. Cal. 2005); FTC v. Conversion Mktg., No. SACV04-1264 (C.D. Cal. 2004); FTC v. Mantra Films, No. CV03-9184 (C.D. Cal. 2003); FTC v. Preferred Alliance, No. 103-CV0405 (N.D. Ga. 2003); United States v. Prochnow, No. 1:02-CV-0917 (N.D. Ga. 2002); FTC v. Ultralife Fitness, Inc., No. 2:08-cv-07655-DSF-PJW (C.D. Cal. 2008); In the Matter of American Isuzu Motors, No. C- 3712 (FTC 1997); FTC v. Universal Premium Services, No. CV06-0849 (C.D. Cal. 2006); FTC v. Remote Response, No. 06-20168 (S.D. Fla. 2006); and FTC’s Dot Com Disclosures guidance. 9 See, e.g., FTC v. JAB Ventures; FTC v. Complete Weightloss Center; FTC v. NutraClick, LLC I. 10 See, e.g., FTC v. JAB Ventures; Complete Weightloss Center; FTC v. Berkeley Premium Nutraceutical; FTC v. Think All Publ’g. Disclosures earlier in the transaction may be necessary to avoid deception. See e.g., FTC’s Dot Com Disclosures guidance.

Page 20

consent to such offers.11 Finally, marketers must not erect unreasonable barriers to cancellation or impede the effective operation of promised cancellation procedures, and must honor cancellation requests that comply with such procedures.12 Although these basic guidelines are useful, the legality of a particular negative option depends on an individualized assessment of the advertisement’s net impression and the marketer’s business practices.13 ROSCA: Enacted by Congress in 2010 to address ongoing problems with online negative option marketing, ROSCA prohibits charging or attempting to charge consumers for goods or services sold on the Internet through any negative option feature14 unless the marketer: (1) clearly and conspicuously discloses all material terms of the transaction15 before obtaining the consumer’s billing information; (2) obtains a consumer’s express informed consent before

11 E.g., FTC. v. Neovi, Inc., 604 F.3d 1150, 1157-59 (9th Cir. 2010), amended by 2010 WL 2365956 (9th Cir. June 15, 2010); FTC v. Amazon.com, Inc., No. C14-1038-JCC, 2016 WL 10654030, at *8 (W.D. Wash. Apr. 26, 2016); FTC v. Ideal Fin. Sols., Inc., No. 2:13-CV-00143- JAD, 2015 WL 4032103, at *8 (D. Nev. June 29, 2015); FTC v. BunZai Media Group, Inc. 12 See, e.g., FTC v. Universal Premium Services; FTC v. Remote Response; FTC v. Berkeley Premium Nutraceuticals; FTC v. Hispanexo; FTC v. Age of Learning, Inc. 13 See, e.g., Negative Options: A Report By the Staff of the FTC’s Division of Enforcement, 28. 14 15 U.S.C. § 8403. ROSCA incorporates the definition of “negative option feature” from the Commission’s Telemarketing Sales Rule, 16 C.F.R. § 310.2(w). ROSCA also contains a finding that “Third party sellers used a free trial period to enroll members, after which they periodically charged consumers until consumers affirmatively canceled the memberships. This use of “freeto-pay conversion” and “negative option” sales took advantage of consumers’ expectations that they would have an opportunity to accept or reject the membership club offer at the end of the trial period.” 15 U.S.C. § 8401(8). Finally, in addition to addressing negative option marketing, ROSCA contains provisions related to third party “post transaction” offers. See, e.g., 15 U.S.C. § 8402.

15 The Commission has brought several cases alleging a failure to disclose adequately the terms of the negative option feature. See, e.g., FTC v. NutraClick II; FTC v. Triangle Media Corporation; FTC v. AAFE Products Corp. The Commission recently alleged that failure to disclose a material term of the underlying service that was necessary to prevent deception violated this provision of ROSCA. In re: MoviePass, Inc., No. C-4751 (October 5, 2021).

Page 21

charging the consumer’s account; 16 and (3) provides simple mechanisms for the consumer to stop recurring charges.17 ROSCA also addresses offers made by, or on behalf of, third-party sellers during, or immediately following, a transaction with an initial merchant. Specifically, ROSCA prohibits post-transaction, third-party sellers18 from charging or attempting to charge consumers unless the seller: (1) before obtaining billing information, clearly and conspicuously discloses the offer’s material terms; and (2) receives the consumer’s express informed consent by obtaining the consumer’s name, address, contact information, as well as the full account number to be charged, and requiring the consumer to perform an additional affirmative action indicating consent.19 ROSCA also prohibits initial merchants from disclosing billing information to any posttransaction third-party seller for use in any Internet-based sale of goods or services.20 Furthermore, ROSCA provides that a violation of that Act is a violation of a Commission trade regulation rule under Section 18 of the FTC Act.21 Thus, the Commission may seek a variety of remedies for violations of ROSCA, including civil penalties under Section 5(m)(1)(A) of the FTC Act;22 injunctive relief under Section 13(b) of the FTC Act;23 and consumer redress,

16 See, e.g., FTC v. BunZai Media Group, Inc.; FTC v. Health Formulas, LLC; and FTC v. JDI Dating, Ltd.

17 See, e.g., FTC v. Age of Learning, Inc.; FTC v. AdoreMe, Inc.; and FTC, State of Illinois, and State of Ohio v. One Technologies.

18 ROSCA defines “post-transaction third-party seller” as a person other than the initial merchant who sells any good or service on the Internet and solicits the purchase on the Internet through an initial merchant after the consumer has initiated a transaction with the initial merchant. 15 U.S.C. § 8402(d)(2).

19 15 U.S.C. § 8402(a).

20 15 U.S.C. § 8402(b).

21 15 U.S.C. § 8404. Section 18 of the FTC Act is 15 U.S.C. § 57a. 22 15 U.S.C. § 45(m)(1)(A).

23 15 U.S.C. § 53(b).

Page 22

such as damages, and other relief under Section 19 of the FTC Act.24 Although Congress charged the Commission with enforcing ROSCA, it did not direct the FTC to promulgate implementing regulations.25

Telemarketing Sales Rule: The TSR prohibits deceptive telemarketing acts or practices, including those involving negative option offers, and certain types of payment methods common in deceptive negative option marketing. Specifically, the TSR requires telemarketers to disclose all material terms and conditions of the negative option feature, including the need for affirmative consumer action to avoid the charges, the date (or dates) the charges will be submitted for payment, and the specific steps the customer must take to avoid the charges. It also prohibits telemarketers from misrepresenting such information and contains specific requirements related to payment authorization.26 Finally, the TSR prohibits the use of payment methods often used in deceptive marketing, including negative options, such as remotely created checks.27 The Rule, however, only applies to negative option offers made over the telephone. Prenotification Plan Rule: The Commission promulgated the “Use of Prenotification Negative Option Plans” Rule (“Prenotification Plan Rule”) (16 C.F.R. Part 425).28 The Prenotification Plan Rule requires sellers of such plans to clearly and conspicuously disclose

24 15 U.S.C. § 57b(a)(1) and (b).

25 ROSCA states that a violation “of this chapter or any regulation prescribed under this chapter shall be treated as a violation of a rule under section 18 of the Federal Trade Commission Act (15 U.S.C. 57a) regarding unfair or deceptive acts or practices.” 15 U.S.C. § 8404(a). 26 16 C.F.R. Part 310.3(a).

27 80 Fed. Reg. 77520 (Dec. 14, 2015). The TSR Notice of Proposed Rulemaking (78 Fed. Reg. 41200 (July 9, 2013)) noted negative option cases where the defendants used unauthorized remotely created checks. E.g., FTC v. FTN Promotions, Inc., Civ. No. 8:07-1279 (M.D. Fla. Dec. 30, 2008) (Stip. Perm. Inj.) (defendants allegedly caused more than $171 million in unauthorized charges to consumers’ accounts for bogus travel and buyers’ clubs in part by using unauthorized remotely created checks).

28 The Commission issued the Rule after finding some negative option marketers committed unfair and deceptive practices that violated Section 5 of the Act, 15 U.S.C. § 45.

Page 23

their plan’s material terms before consumers subscribe. It enumerates seven material terms sellers must disclose: (1) how subscribers must notify the seller if they do not wish to purchase the selection; (2) any minimum purchase obligations; (3) the subscribers’ right to cancel; (4) whether billing charges include postage and handling; (5) that subscribers have at least ten days to reject a selection; (6) that, if any subscriber is not given ten days to reject a selection, the seller will credit the return of the selection and postage to return the selection, along with shipping and handling; and (7) the frequency with which announcements and forms will be sent.29 In addition, sellers must provide particular periods during which they will send introductory merchandise, give consumers a specified period to respond to announcements, provide instructions for rejecting merchandise in announcements, and promptly honor written cancellation requests.30 The Prenotification Plan Rule applies only to plans like book-of-the-month clubs in which sellers provide periodic notices offering goods to participating consumers and then send— and charge for—those goods only if the consumers take no action to decline the offer. These types of plans, however, account for only a small fraction of current negative option marketing. Therefore, the Rule does not reach most modern negative option marketing.31

29 16 C.F.R. § 425.1(a)(1)(i)-(vii).

30 16 C.F.R. §§ 425.1(a)(2) and (3); § 425.1(b).

31 The Prenotification Plan Rule defines “negative option plan” narrowly to apply only to prenotification plans. 16 C.F.R. § 425.1(c)(1). In 1998, the Commission clarified the Rule’s application to such plans in all media, stating that it “covers all promotional materials that contain a means for consumers to subscribe to prenotification negative option plans, including those that are disseminated through newer technologies . . . .” 63 Fed. Reg. 44555, 44561 (Aug. 20, 1998). In 2017, the Commission estimated that fewer than 100 sellers (“clubs”) were subject to the current Rule’s requirements. 82 Fed. Reg. 38907, 38908 (Aug. 16, 2017).

Page 24

Other Relevant Requirements: EFTA32 and the Unordered Merchandise Statute33 also contain provisions relevant to negative option marketing. EFTA prohibits sellers from imposing recurring charges on a consumer’s debit cards or bank accounts without written authorization. The Unordered Merchandise Statute provides that mailing unordered merchandise, or a bill for such merchandise, constitutes an unfair method of competition and an unfair trade practice in violation of Section 5 of the FTC Act.

II.

Principles For Negative Option Marketing

Given the number of applicable statutory and regulatory requirements and the ongoing problems in the marketplace, the Commission now issues the following enforcement guidance based on its enforcement history.34 This guidance covers three areas commonly addressed by the Commission in its negative option cases: disclosures, consent, and cancellation. These principles convey the Commission’s current views on the application of relevant statutes and regulations to negative option marketing and, as such, should help marketers in their compliance efforts and better understand how the Commission enforces the law. Disclosures: ROSCA35 requires marketers to clearly and conspicuously disclose the material terms of the transaction.36 Pursuant to longstanding precedent, any express claim or

32 15 U.S.C. §§ 1693-1693r.

33 39 U.S.C. § 3009.

34 In an October 2, 2019 Notice (84 Fed. Reg. 52393), the Commission sought comment on the need for amendments to the “Rule Concerning the Use of Prenotification Negative Option Plans” (i.e., “Negative Option Rule” (16 CFR Part 425)) to help consumers avoid recurring payments for products and services they did not intend to order and to allow them to cancel such payments without unwarranted obstacles. The Commission will continue to closely monitor compliance with the rules and laws applicable to negative option marketing, and is still considering various options in the rule review proceeding for the Negative Option Rule. 35 Any reference to ROSCA in these principles applies only to Internet transactions, consistent with that statute’s coverage.

36 Of course, sellers fail to disclose adequately material terms if the disclosed terms are not truthful and substantiated.

Page 25

deliberately implied claim is presumed to be material.37 Moreover, the FTC’s cases for failure to disclose under Section 5 of the FTC Act are generally consistent with ROSCA.38 Those terms at minimum should include:

• Any material terms related to the underlying product or service that are necessary to prevent deception, regardless of whether that term directly relates to the terms of the negative option offer;39 • That consumers will be charged40 for the good or service, or that those charges will increase after any applicable trial period ends, and, if applicable, that the charges will be on a recurring basis, unless the consumer timely takes steps to prevent or stop such charges;

• Each deadline (by date or frequency) by which the consumer must act in order to stop the charges;

• The amount (or range of costs) the consumer will be charged or billed and, if applicable, the frequency of such charges a consumer will incur unless the consumer takes timely steps to prevent or stop those charges;

37 See, e.g., FTC Statement on Deception, 103 F.T.C. 174, 182 (1984) (appended to Cliffdale Assocs., Inc., 103 F.T.C. 110 (1984)); Thompson Medical Co., 104 F.T.C. 648, 816 (1984). 38 The Commission has consistently brought cases for deceptive and pure omissions of material fact. See, e.g., FTC v. Roca Labs, Inc., 345 F. Supp. 3d 1375, 1390 (M.D. Fla. 2018); FTC v. NPB Advert., Inc., 218 F. Supp. 3d 1352, 1361 (M.D. Fla. 2016); FTC v. Am. Standard Credit Sys., Inc., 874 F. Supp. 1080, 1088 (C.D. Cal. 1994); FTC v. BlueHippo Funding, LLC, 762 F.3d 238, 241 (2d Cir. 2014). But see, In re International Harvester, 104 F.T.C. 949, 1059 (1984) (Not all omissions are deceptive or unfair. “The number of facts that may be material to consumers-and on which they may have prior misconceptions-is literally infinite.”) 39 The Commission recently alleged that a negative option seller’s failure to disclose that it was impeding access to its movie subscription service violates ROSCA. MoviePass, Inc. 40 “Charge,” “Charged,” or “Charging,” for the purposes of this Policy Statement, means any attempt to collect money or other consideration from a consumer, including but not limited to causing Billing Information to be submitted for payment, including against the consumer’s credit card, debit card, bank account, telephone bill, or other account.

Page 26

• The date (or dates) each charge will be submitted for payment; and • All information necessary to cancel the contract. These disclosures must be clear and conspicuous.41 To meet this standard, offers should be difficult to miss (i.e., easily noticeable) or unavoidable and easily understandable by ordinary consumers, including:

• In any communication that is solely visual or solely audible, the disclosure should be made through the same means through which the communication is presented. In any communication made through both visual and audible means, such as a television advertisement, the disclosure should be presented simultaneously in both the visual and audible portions of the communication even if the representation requiring the disclosure is made in only one means. • A visual disclosure, by its size, contrast, location, the length of time it appears, and other characteristics, should stand out from any accompanying text or other visual elements so that it is easily noticed, read, and understood. • An audible disclosure, including by telephone or streaming video, should be delivered in a volume, speed, and cadence sufficient for ordinary consumers to easily hear and understand it.

• In any communication using an interactive electronic medium, such as the Internet or software, the disclosure should be unavoidable. A disclosure is not clear and conspicuous if a consumer needs to take any action, such as clicking on a hyperlink or hovering over an icon, to see it.

41 Supra at nn. 9 and 15.

Page 27

• The disclosure should use diction and syntax understandable to ordinary consumers and should appear in each language in which the representation that requires the disclosure appears.

• The disclosure should comply with these requirements in each medium through which it is received, including all electronic devices and face-to face communications.

• The disclosure should not be contradicted or mitigated by, or inconsistent with, anything else in the communication.42 • When the representation or sales practice targets a specific audience, such as children, the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of that group.

Additionally, if the disclosures are in writing (including on the Internet), they should: • if related to the negative option feature, appear immediately adjacent to the means of recording the consumer’s consent for the negative option feature; • if not related to the negative option feature, appear before consumers make a decision to buy (e.g., before they “add to shopping cart”); and • not contain any other information that interferes with, detracts from, contradicts, or otherwise undermines the ability of consumers to read and understand the

42 An example of an inadequate disclosure is one where the consumer sees an offer upfront, in an electronic or written advertisement or on the landing page of a website, which is materially different from the terms of the offer presented in later stages, such as later web pages, of the ordering process. See, e.g., FTC v. E.M.A. Nationwide, Inc., 767 F.3d 611, 633 (6th Cir. 2014); FTC v. Fed. Loan Modification Law Ctr., LLP, No. SA-CV-09-401-CJC (MLGx) (C.D. Cal. 2010); FTC v. Grant Connect, LLC, 827 F. Supp. 2d 1199, 1214 (D. Nev. 2011).

Page 28

disclosures, including any information not directly related to the material terms and conditions of any negative option feature.

For all telephone and other oral offers, the disclosures should not contain any other information that interferes with, detracts from, contradicts, or otherwise undermines the ability of consumers to understand the disclosures, including any information not directly related to the material terms and conditions of any negative option feature. Consent:43 ROSCA, judicial decisions applying Section 5, and cases brought by the Commission under those laws make clear marketers should obtain the consumer’s express informed consent before charging the consumer.44 To attain express informed consent, the negative option seller should:

• obtain the consumer’s acceptance of the negative option feature offer separately from any other portion of the entire transaction;

• not include any information that interferes with, detracts from, contradicts, or otherwise undermines the ability of consumers to provide their express informed consent to the negative option feature;45 • obtain the consumer’s unambiguously affirmative consent to the negative option feature;46

43 Negative option sellers covered by the Telemarketing Sales Rule should also ensure that they are complying with the consent requirements in 16 C.F.R. § 310.4 specifically applicable to transactions involving a free-to-pay conversion and preacquired account information. 44 Supra at nn. 11 and 16.

45 Such information could appear on the product page itself (e.g., extraneous language that interferes with the consumer’s ability to provide consent) or in another location (e.g., a separate webpage containing information materially contradicting the information on the consent page). 46 A “pre-checked box” does not constitute affirmative consent. In addition, the seller should clearly disclose the name of the billing entity authorized by the consumer’s consent.

Page 29

• obtain the consumer’s unambiguously affirmative consent to the entire transaction; and • be able to verify the consumer’s consent.

Cancellation: ROSCA requires negative option sellers to provide a simple, reasonable means for consumers to cancel their contracts.47 To meet this standard, negative option sellers should provide cancellation mechanisms that are at least as easy to use as the method the consumer used to initiate the negative option feature. For example, to ensure compliance with this simple cancellation mechanism requirement, negative option sellers should not subject consumers to new offers or similar attempts to save the negative option arrangement that impose unreasonable delays on consumers’ cancellation efforts.48 In addition, negative option sellers should provide their cancellation mechanisms at least through the same medium (such as website or mobile application) the consumer used to consent to the negative option feature. The negative option seller should provide, at a minimum, the simple mechanism over the same website or web-based application the consumer used to purchase the negative option feature. If the seller also provides for telephone cancellation, it should provide, at a minimum, a telephone number, and answer all calls to this number during normal business hours, within a short time frame, and ensure the calls are not lengthier or otherwise more burdensome than the telephone call the consumer used to consent to the negative option feature.

Finally, to comply with Section 5, a seller’s cancellation procedures for negative option features should be effective. Sellers should not impede the effective operation of promised

47 Supra at 17.

48 While a request to consider an offer or discount would not amount to an unreasonable delay, multiple requests for a consumer to listen to additional offers, lengthy pitches, or ignoring a consumer’s request to decline further offers could amount to an unreasonable delay.

Page 30

cancellation procedures, and should honor cancellation requests that comply with such procedures. In implementing effective cancellation procedures, marketers should not, among other things: hang up on consumers who call to cancel; place them on hold for an unreasonably long time; provide false information about how to cancel; or misrepresent the reasons for delays in processing consumers’ cancellation requests.49 If ROSCA applies, sellers must comply with both that statute and Section 5 of the FTC Act.

49 See, e.g., FTC v. Universal Premium Services; FTC v. Remote Response; FTC v. Hispanexo; FTC v. Berkeley Premium Nutraceuticals.

Page 31

Policy Statement of the Federal Trade Commission on Education Technology and the Children’s Online Privacy Protection Act The Federal Trade Commission (“Commission”) is committed to ensuring that education technology (“ed tech”) tools and their attendant benefits do not become an excuse to ignore critical privacy protections for children. When Congress enacted the Children’s Online Privacy Protection Act1 (“COPPA”), it empowered the Commission with tools beyond administering compliance with notice and consent regimes. The Commission’s COPPA authority demands enforcement of meaningful substantive limitations on operators’ ability to collect, use, and retain children’s data, and requirements to keep that data secure. The Commission intends to fully enforce these requirements—including in school and learning settings where parents may feel they lack alternatives.

Protecting children’s privacy online has been a priority for the Commission since 1998, when the Commission recommended “that Congress develop legislation placing parents in control of the online collection and use of personal information from their children.”2 Thereafter, Congress enacted COPPA and charged the Commission with enforcing the law, entrusting the FTC to take the lead in protecting children’s privacy just as the country was entering the Internet age. To implement COPPA, the Commission issued the COPPA Rule, which became effective in 2000.3 In the decades since COPPA’s enactment, there has been a steady proliferation of technologies that allow, and business models that depend on, the online collection and monetization of consumers’ personal information. The development of ever more sophisticated targeting practices, in some cases based on comprehensive collection of users’ activities across the Internet, has raised concerns that businesses might engage in harmful conduct and led to calls for strengthening children’s privacy protections. Partly in response to these concerns, the Commission revised the COPPA Rule4 in 2013, including to hold third parties such as advertising networks liable for collection of children’s personal information from child-directed sites in violation of the Rule5 and to expand the definition of personal information to include 1 15 U.S.C. §§ 6501–6505.

2 FED. TRADE COMM’N, PRIVACY ONLINE: A REPORT TO CONGRESS, at 42 (June 1998). See also Complaint, In re Liberty Fin. Cos., Inc., FTC File No. 982-3522 (Aug. 12, 1999)(alleging that website operator falsely represented that personal information collected from children in a survey would be maintained anonymously and that participants would be sent an e-mail newsletter and prizes); Complaint, In re GeoCities, FTC File No. 982-3015 (Feb. 5, 1999) (alleging that website operator misrepresented which entity collected and maintained personal identifying information collected from children).

3 16 C.F.R. Part 312. As discussed below, the Commission strengthened the COPPA Rule through amendments that became effective in 2013. See Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3,972 (Jan. 17, 2013) (Final Rule amendments codified at 16 C.F.R. Part 312).

4 See id.

5 See id. at 4,010. See also Complaint, United States v. OpenX Techs., Inc., Case No. 2:21-cv-09693 (C.D. Cal. Dec. 15, 2021) (alleging that online advertising platform collected and transmitted location information and persistent identifiers from users of child-directed apps without complying with COPPA); Complaint, FTC and the State of New York v. Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019) (alleging that YouTube

Page 32

persistent identifiers used to target advertising to children.6 Since that time, companies’ information collection practices have continued to become more extensive, and concerns remain that children’s information may be used to target them.

Concerns about data collection are particularly acute in the school context, where children and parents often have to engage with ed tech tools in order to participate in a variety of school-related activities. School-issued personal computing devices and online learning services have provided substantial benefits to students, particularly as the COVID-19 pandemic closed schools and forced families to switch from in-person to remote learning for their children. At the same time, parents may have reasonable questions and concerns about the personal information that ed tech providers collect and how they use and potentially share that information with third parties, including for marketing purposes. And parent groups, among others, have expressed concern that children are a captive audience in the school setting and should not be targeted with advertising as they pursue their educations.7 School-issued devices and applications also enter families’ homes, potentially allowing for even more private information to be collected and shared. Commission staff has provided extensive guidance8 on COPPA’s application to ed tech providers to address these concerns.

In investigating potential violations of COPPA by providers of ed tech and other covered online services, the Commission intends to scrutinize compliance with the full breadth of the substantive prohibitions and requirements of the COPPA Rule and statutory language. In particular, the Commission will focus on:

• Prohibition Against Mandatory Collection: COPPA-covered companies, including ed tech providers, must not condition participation in any activity on a child disclosing more information than is reasonably necessary for the child to participate in that activity.9 These businesses cannot stop students from engaging in an ed tech activity if they do not provide information beyond what is reasonably needed to administer the students’ collected persistent identifiers used for targeted advertising from users of child-directed channels without complying with COPPA); Complaint, United States v. InMobi Pte Ltd., Case No. 3:16-cv-3474 (N.D. Cal. June 22, 2016) (alleging that mobile advertising network collected geolocation information from users of apps directed to children under the age of 13 without complying with COPPA).

6 78 Fed. Reg. 3,972, 4,009. See also Complaint, United States v. HyperBeard, Inc., Case No. 3:20-cv-3683 (N.D. Cal. June 3, 2020) (alleging that app developer allowed third-party ad networks to use persistent identifiers to track users of its child-directed apps without complying with COPPA); Complaint, FTC and the State of New York v. Google LLC and YouTube, LLC, Case No. 1:19-cv-2642 (D.D.C. Sept. 4, 2019); Complaint, United States v. Retro Dreamer, Case No. 5:15-cv-2569 (C.D. Cal. Dec. 17, 2015) (alleging that app developer allowed third-party advertisers to collect persistent identifiers through its child-directed apps without complying with COPPA); Complaint, United States v. LAI Sys., LLC, Case No. 2:15-cv-9691 (C.D. Cal. Dec. 17, 2015). 7 See, e.g., COPPA Rule Review, FTC-2019-0054 (Project No. P195404), Comments of Campaign for a Commercial-Free Childhood, et al., Comment No. 117343, at 8 (Dec. 11, 2019) (“In many cases, parents and students are not even aware of what data is being collected, why it is being collected, who is collecting it, or where it is being stored. This data is often used to build behavioral profiles that allow third parties to create more effective marketing campaigns, targeted advertisements, and, ultimately, psychological manipulation of other children.”). 8 See Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N (July 2020) § N, https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked­ questions#N.%20COPPA%20AND%20SCHOOLS.

9 16 C.F.R. § 312.7. See also Complaint, United States v. Looksmart Ltd., Civ. Action No. 01-606-A (E.D. Va. Apr. 19, 2001); Complaint, United States v. BigMailbox.com, Inc., Civ. Action No. 01-605-A (E.D. Va. Apr. 19, 2001).

Page 33

participation in the activity.10 For example, if an ed tech provider does not reasonably need to be able to email students, it cannot condition the student’s access to schoolwork on students providing their email addresses.11 Students must not be required to submit to unnecessary data collection in order to do their schoolwork. • Use Prohibitions: COPPA-covered companies, including ed tech providers, are strictly limited in how they can use the personal information they collect from children. For example, operators of ed tech that collect personal information pursuant to school authorization12 may use such information only to provide the requested online education service. In this context, ed tech companies are prohibited from using such information for any commercial purpose, including marketing, advertising, or other commercial purposes unrelated to the provision of the school-requested online service.13 • Retention Prohibitions: COPPA-covered companies, including ed tech providers, must not retain personal information collected from a child longer than reasonably necessary to fulfill the purpose for which it was collected.14 It is unreasonable, for example, for an ed tech provider to retain children’s data for speculative future potential uses. • Security Requirements: COPPA-covered companies, including ed tech providers, must have procedures to maintain the confidentiality, security, and integrity of children’s personal information.15 For example, even absent a breach, COPPA-covered ed tech providers violate COPPA if they lack reasonable security.16 Such limitations on collection, use, and retention, along with security requirements, place significant responsibility on COPPA-covered businesses to implement strong privacy protections, in addition to the notice and consent requirements of the COPPA Rule. The responsibility for COPPA compliance is on businesses, not schools or parents—and agreements must reflect that.

10 The text of the COPPA Rule addressing prohibitions against conditioning access (16 C.F.R. § 312.7), which is described here, restates nearly verbatim the text of the statutory language (15 U.S.C. § 6502(b)(1)(C)). As part of its ongoing rule review, the Commission is carefully analyzing this provision to ensure that operators are aware of their obligations. See Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s Online Privacy Protection Rule, 64 Fed. Reg. 35,842, 35,846 (July 25, 2019). 11 See Children’s Online Privacy Protection Rule, 64 Fed. Reg. 22,750, 22,758 (proposed Apr. 27, 1999) (codified at 16 C.F.R. § 312) (discussing email address example).

12 Children’s Online Privacy Protection Rule, 64 Fed. Reg. 59,888, 59,903 (Final Rule released Nov. 3, 1999) (codified at 16 C.F.R. § 312).

13 Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N § N, https://www.ftc.gov/business­ guidance/resources/complying-coppa-frequently-asked-questions#N.%20COPPA%20AND%20SCHOOLS (last visited May 18, 2022).

14 16 C.F.R. § 312.10. See also Complaint, United States v. Kurbo, Inc. and WW Int’l, Inc., No. 3:22-cv-00946 (N.D. Cal. Feb. 16, 2022). Complaint, United States v. Musical.ly, Case No. 2:19-cv-1439 (C.D. Cal. Feb. 27, 2019). 15 15 U.S.C. § 6502(b)(1)(D); 16 C.F.R. § 312.8. See also Complaint, In re Retina-X Studios, LLC, FTC File No. 1723118 (Mar. 26, 2020). Complaint, United States v. Unixiz, Inc. d/b/a/ iDressup.com, No. 5:19-cv-02222-NC (N.D. Cal. April 24, 2019); Complaint, United States v. VTech Elecs. Ltd., Case No. 1:18-cv-114 (N.D. Ill. Jan. 8, 2018); Complaint, United States v. RockYou, Inc., No 3:12-cv-01487-SI (N.D. Cal. Mar. 26, 2012). 16 16 C.F.R. § 312.10.

Page 34

Children should not have to needlessly hand over their data and forfeit their privacy in order to do their schoolwork or participate in remote learning, especially given the wide and increasing adoption of ed tech tools. Going forward, the Commission will closely scrutinize the providers of these services and will not hesitate to act where providers fail to meet their legal obligations with respect to children’s privacy.

Page 35

Policy Statement of the Federal Trade Commission on Rebates and Fees in Exchange for Excluding Lower-Cost Drug Products American families and businesses should never pay higher prices for medicine due to unlawful business practices. For this reason, challenging healthcare industry conduct that may raise prices and stifle innovation is a top priority for the Federal Trade Commission (“FTC” or “Commission”), and the Commission will use its full authority under the FTC Act to do so. The FTC has long pursued a comprehensive agenda to address unlawful conduct in the healthcare and pharmaceutical industries.1 For many years, the Commission has received complaints about rebates and fees paid by drug manufacturers to pharmacy benefit managers (PBMs) and other intermediaries to favor high-cost drugs that generate large rebates and fees that are not always shared with patients.2 These rebates and fees may shift costs and misalign incentives in a way that ultimately increases patients’ costs and stifles competition from lower-cost drugs, especially when generics and biosimilars are excluded or disfavored on formularies.

1 For an overview of FTC healthcare actions generally, see MARKUS H. MEIER ET AL., OVERVIEW OF FTC ACTIONS, FED. TRADE COMM’N (Apr. 2022).

2 See H. Rep. 16-456, 116th Cong., (2021), www.congress.gov/116/crpt, (that accompanied H.R. 7668, Fin. Serv’s and General Gov’t Appropriations Bill, (2021)). The Report states: “The Committee urges the FTC to prioritize investigations into manufacturers that erect rebate walls to block competition from new branded therapies, biosimilars, generics, and other innovative products.” Id at 67; see also FED. TRADE COMM’N, REP. ON REBATE WALLS, at 1 n. 3. Previous discussions of the potential for pharmaceutical rebate agreements to foreclose competition were discussed at an FDA/FTC Workshop on a Competitive Marketplace for Biosimilars and an FTC workshop on prescription drug markets. See Public Workshop: FDA/FTC Workshop on a Competitive Marketplace for Biosimilars, U.S. FOOD AND DRUG ADMIN. (Mar. 9, 2020), https://www.fda.gov/drugs/news-events-human­ drugs/public-workshop-fdaftc-workshop-competitive-marketplace-biosimilars-03092020-03092020#event­ materials; Understanding Competition in Prescription Drug Markets: Entry and Supply Chain Dynamics, FED. TRADE COMM’N (Nov. 8, 2017), https://www.ftc.gov/news-events/events/2017/11/understanding-competition­ prescription-drug-markets-entry-supply-chain-dynamics. The FTC has been aware of the issues surrounding drug rebate practices since at least 1999. See ROY LEVY, THE PHARMACEUTICAL INDUSTRY: A DISCUSSION OF COMPETITIVE AND ANTITRUST ISSUES IN AN ENVIRONMENT OF CHANGE, BUREAU OF ECON. STAFF REP., FED. TRADE COMM’N (Mar. 1999).

Page 36

The Commission is issuing this Policy Statement to explain its enforcement policy with respect to these practices.3 We do so by highlighting insulin, which many have cited as one prominent example of a prescription drug impacted by high rebates and fees to PBMs and other intermediaries.4 Insulin is a life-sustaining treatment for roughly 8 million Americans who rely on it to control diabetes.5 Research indicates that the wholesale price of insulin nearly tripled between 2009 and 2017,6 increasing out-of-pocket costs for both insured7 and uninsured patients.8 The list price for a year’s supply of insulin has risen to nearly $6,000, with out-of­ pocket costs for insulin alone averaging $1,288 for uninsured patients and $613 for insured patients as of 2017.9 3 This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates one or more existing statutory or regulatory requirements. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action under the FTC Act or other statutes. Pursuant to the Congressional Review Act (5 U.S.C. § 801 et seq.), the Office of Information and Regulatory Affairs designated this Policy Statement as not a “major rule,” as defined by 5 U.S.C. § 804(2).

4 U.S. SEN. FINANCE COMM., STAFF REP., INSULIN: EXAMINING THE FACTORS DRIVING THE RISING COST OF A CENTURY OLD DRUG, at 71 (Jan. 2021) (“certain contracting and business practices may create incentives for PBMs to favor drugs with high rebates and, in turn, discourage manufacturers from competing to lower WAC prices.”). See also Karen Von Nuys et al., Estimation of the Share of Net Expenditures on Insulin Captured by US Manufacturers, Wholesalers, PBMs, Pharmacies, and Health Plans from 2014 to 2018, 2 J. AM. MED. ASSOC. H. FORUM 1, 3 (2021) (suggesting business practices of intermediaries may influence rising list prices for insulin). 5 See CARDINAL H., 2022 BIOSIMILARS REPORT: THE U.S. JOURNEY AND PATH AHEAD, at 18 (“over eight million people use insulin daily to effectively manage their diabetes”); William T. Cefalu et al., Insulin Access and Affordability Working Group: Conclusions and Recommendations, 41 DIABETES CARE 1299 (2018). 6 See Brian Sable-Smith, How Much Difference Will Eli Lilly’s Half Price Insulin Make, KAISER FAMILY FOUNDATION (Mar. 12, 2019), https://khn.org/news/how-much-difference-will-eli-lillys-half-price-insulin-make/ (“Between 2009 and 2017 the wholesale price of a single vial of Humalog . . . nearly tripled — rising from $92.70 to $274.70.”).

7 Cefalu et al., supra note 5, at 1302; Samantha Willner et al., "Life or death": Experiences of insulin insecurity among adults with type 1 diabetes in the United States, 11 SSM POPULATION H. 1, 3 (2020). 8 See Cefalu et al., supra note 5, at 1308 (explaining uninsured patients pay the full list price without financial assistance).

9 See Sherry Glied & Benjamin Zhu, Not so sweet: Insulin Affordability over Time, THE COMMONWEALTH FUND (Sept. 25, 2020), https://www.commonwealthfund.org/publications/issue-briefs/2020/sep/not-so-sweet-insulin­ affordability-over-time; Chien-Wen Tseng et al, Impact of Higher Insulin Prices on Out-of-Pocket Costs in Medicare Part D, 43 J. DIABETES CARE 50 (2020) (“From 2014 to 2019, the average annual insulin price rose 55% from $3,819 to $5,917… the projected yearly out-of-pocket cost for insulin increased 11% from $1,199 to $1,329.”). These studies note significant heterogeneity in patient out-of-pocket costs depending on several factors including which insulin product(s) is used, the amount of insulin needed, and whether the patient has commercial insurance, Medicare, Medicaid or is uninsured.

Page 37

Patients with diabetes have described how rising insulin costs have rendered this essential product unaffordable and harmed them in different ways.10 The increased cost of insulin has caused many patients to ration it,11 causing suffering, severe illness, and death.12 During the Commission’s Open Meeting in October 2021, one commenter discussed the death of her son who was forced to ration insulin due to high costs.13 Others have described how insulin costs and the fear of losing health insurance have dissuaded them from leaving their current jobs and limited their ability to pursue other opportunities14 For example, one small business owner expressed the fear of expanding his business because of insulin costs.15 High insulin costs also have an outsized impact on those least able to absorb or avoid these additional costs, including patients from historically underserved communities.16 In addition to other factors, some have suggested that high rebates and fees to PBMs and other intermediaries may incentivize higher list prices for insulin and discourage coverage of the 10 Willner et al., supra, note 7; Fed. Trade Comm’n, Tr. of Open Comm’n Meeting, at 14-15, 19-20 (Oct. 21, 2021), www.ftc.gov/openmeetingtranscript.pdf.

11 See Darby Herkert et al., Cost-Related lnsulin Underuse Among Patients With Diabetes, 179 J. AM. MED. ASSOC. INTERN MED. 112-114 (2019) (finding one of every four patients rations insulin due to cost within one sample); INSULIN SENATE REP., supra note 4, at 14.

12 See FTC Open Meeting Tr., supra note 10, at 14 -15, 18-19 (public commenters Matthew Dinger, Anna Squires, and Nicole Smith Holt); see also S. Vincent Rajkumar, The High Cost of Insulin in the U.S.: An Urgent Call to Action, 95 MAYO CLINIC PROC. 22 (Jan. 2020) (“Alec Smith was 23 when he was diagnosed with type 1 diabetes.… At age 26, he could no longer stay on his mother’s health care insurance plan and needed to find his own coverage. …The insurance available to him came with a $7600 deductible and a monthly premium of approximately $440. Because he could not afford this, Alec decided to temporarily forego insurance coverage and purchase insulin with cash. Unfortunately for him, the cash price of insulin was far beyond his means. He decided to try and ration the amount of insulin he took till he had enough savings to purchase insurance. Sadly, on June 27, 2017, he was found dead in his apartment of diabetic ketoacidosis.”).

13 FTC Open Meeting Tr., supra note 10, at 18-19 (public commenter Nicole Smith Holt describes the death of her son, Alec Smith, and others from rationing insulin).

14 See Willner et al., supra note 7, at 6 (“the only reason that I'm working my job currently … is because I'm afraid to get off of it because there goes my insurance, there goes my method to get any kind of insulin or supplies for anything); see also FTC Open Meeting Tr., supra note 10, at 14-15; see also COLORADO ATT’Y GEN., PRESCRIPTION INSULIN DRUG PRICING REP., at 53 (2020) (“Many survey respondents reported they feel hostage to jobs they would like to leave but need to keep for the insurance because they could not afford insulin and supplies without it.”). 15 See, e.g., COLORADO ATT’Y GEN. INSULIN REP., supra, note 14, at 53 (“One survey respondent expressed the fear of expanding his small business because of high insulin costs and overall expensive insurance costs.”). 16 See Herkert, et al., supra note 11 (“Patients with lower incomes were more likely to report cost-related underuse…”).

Page 38

lowest-cost insulin products.17 As the Commission’s previous Report on Rebate Walls explained, most consumers have insurance that covers a portion of their prescription costs.18 Health plans, usually through PBMs, use formularies to define which drugs are covered. Drug manufacturers commonly pay PBMs and other intermediaries rebates and fees to have their drugs included on formularies or placed on preferred formulary tiers.19 Some rebates and fees are conditioned on the sales volume of specific drugs or the exclusion of competing drug products from the same formulary tier.20 These rebate and fee agreements may incentivize PBMs and other intermediaries to steer patients to higher-cost drugs over less expensive alternatives.21 This practice could lead to increased costs for both patients and payers, including increased out-of-pocket costs at the point of sale. It may also insulate more expensive drugs from competing with less expensive alternatives. Nothing prevents drug manufacturers, PBMs, and health plans from negotiating good-faith rebates and fees for legitimate services that increase value to payers and patients. However, when dominant drug manufacturers or intermediaries stifle or foreclose competition from significantly less expensive generic and biosimilar alternatives, the Commission has the 17 Cefalu et al., supra note 5, at 1309 (“The current pricing and rebate system encourages high list prices. . . PBMs negotiate rebates from manufacturers using formulary placement as leverage. PBMs often exclude from formularies the insulins made by the manufacturer who offers the lowest rebate. . . People with diabetes are financially harmed by high list price and high out of pocket costs.”); INSULIN SENATE REP., supra note 4, at 71 (“Information collected for this investigation suggests that certain contracting and business practices may create incentives for PBMs to favor drugs with high rebates and, in turn, discourage manufacturers from competing to lower WAC prices.”). 18 See FTC REBATE WALL REP., supra note 2, at 2.

19 Id. at 2; INSULIN SENATE REP., supra note 4, at 67 (“manufacturers offer substantial rebates to PBMs and their clients for the purposes of securing preferred formulary placement for their products”). 20 See id., at 68 (“Manufacturers have increased their rebates in order to win preferred formulary placement and block competitors.”).

21 See e.g., Stacie Dusetzina et al., Patient and Payer Incentives to Use Patented Brand-Name Drugs vs Authorized Generic Drugs in Medicare Part D, 181 J. AM. MED. ASSOC. INTERN. MED. 1605, 1611 (2021) (describing Part D plans’ use of high-list price brand insulins, including insulin lispro (Humalog), and insulin as part (Novolog) over 50% lower-list price authorized generic versions).

Page 39

legal authority to investigate these practices and take enforcement action against unlawful conduct.22 The Commission has several legal authorities that may apply to these practices, including Section 5 of the FTC Act, Section 3 of the Clayton Act, Section 2 of the Robinson-Patman Act, and the Sherman Act.23 Exclusionary rebates that foreclose competition from less expensive alternatives may constitute unreasonable agreements in restraint of trade under Section 1 of the Sherman Act; unlawful monopolization under Section 2 of the Sherman Act; or exclusive dealing under Section 3 of the Clayton Act.24 Moreover, inducing PBMs or other intermediaries to place higher-cost drugs on formularies instead of less expensive alternatives in a manner that shifts costs to payers and patients may violate the prohibition against unfair methods of competition or unfair acts or practices under Section 5 of the FTC Act.

Finally, paying or accepting rebates or fees in exchange for excluding lower-cost drugs may violate Section 2(c) of the Robinson-Patman Act, which prohibits payments to agents, representatives, and intermediaries who represent another party’s interests in connection with the purchase or sale of goods.25 At least one court has held that this provision may reach rebates paid 22 At the request of Congress, the FTC has previously investigated certain PBM business practices. See FED. TRADE COMM’N, PHARMACY BENEFIT MANAGERS: OWNERSHIP OF MAIL-ORDER PHARMACIES (Aug. 2005). 23 The Commission’s authority to address unfair methods of competition under Section 5 of the FTC Act include, but are not limited to, conduct that would violate the Sherman Act. See, e.g., Oregon Lithoprint, Inc., Analysis to Aid Public Comment, 83 Fed. Reg. 11529, 11531 (Mar. 15, 2018) (“The Commission has long held that an invitation to collude violates Section 5 of the FTC Act even where there is no proof that the competitor accepted the invitation.”).

24 See Fed. Trade Comm’n Act, 15 U.S.C. § 45; Sherman Act §§ 1 and 2; Clayton Act, 15 U.S.C. § 14. 25 15 U.S.C. § 13(c) (“It shall be unlawful for any person engaged in commerce, in the course of such commerce, to pay or grant, or to receive or accept, anything of value as a commission, brokerage, or other compensation, or any allowance or discount in lieu thereof, except for services rendered in connection with the sale or purchase of goods, wares, or merchandise, either to the other party to such transaction or to an agent, representative, or other intermediary therein where such intermediary is acting in fact for or in behalf, or is subject to the direct or indirect control, of any party to such transaction other than the person by whom such compensation is so granted or paid.”).

Page 40

by drug manufacturers to PBMs.26 The Commission has a long history of addressing commercial bribery and will continue to do so.27 The FTC intends to closely scrutinize the impact of rebates and fees on patients and payers to determine whether any of these provisions have been violated. In addition, the Commission will monitor private litigation and file amicus briefs where it can aid courts in analyzing unlawful conduct that may raise drug prices. The Commission will also continue to study this issue to understand the full range of practices and implications. The Commission recognizes the life-and-death stakes of this work and is committed to acting expeditiously. As it has done throughout its history, the FTC will bring an interdisciplinary approach, using resources and expertise from throughout the agency to combat unlawful practices in the prescription drug industry.

See also PHILLIP E. AREEDA & HERBERT HOVENKAMP, ANTITRUST LAW: AN ANALYSIS OF ANTITRUST PRINCIPLES AND THEIR APPLICATION ⁋ 2362i (4th & 5th ed. 2015-2021) (collecting and discussing cases involving commercial bribery under Section 2(c)); JOSEPH BAUER ET AL., KINTNER'S FEDERAL ANTITRUST LAW § 26.12 (2021). 26 In re Warfarin Sodium Antitrust Litig., Civ. No. 97-659 (D. Del.)1998 WL 883469, at *16 (D. Del. Dec. 7, 1998), rev'd on other grounds, 214 F.3d 395 (3d Cir. 2000).

27 See Hon. Garland S. Ferguson, Jr., Chairman of FTC, Commercial Bribery: An Address to the Conf. on Com. Bribery to the Comm. Standards Council and the Better Bus. Bureau of N.Y .City (Oct. 17, 1930), www.ftc.gov/systemstatementsferguson_commercial_bribery (explaining the Commission’s focus on commercial bribery as an unfair method of competition even before it gained authority under the Robinson-Patman Act); see also Donald S. Clark, Sec’y of FTC, Remarks Regarding The Robinson-Patman Act: Annual Update, Before the Robinson Patman Act Comm., Section of Antitrust Law, 46th Annual Spring Meeting (Apr. 2, 1998), www.ftc.gov/public-statements/1998/04/robinson-patman-act-annual-update (recognizing the Robinson-Patman’s prohibition on commercial bribery).

Page 41

FTC Policy Statement on Enforcement Related to Gig Work American workers deserve fair, honest, and competitive labor markets. Over the past decade, internet-enabled “gig” companies have grown exponentially, and gig work now composes a significant part of the United States economy.1 One study suggests the gig economy will generate $455 billion in annual sales by 2023.2 The rapid growth of the gig economy is made possible by the contributions of drivers, shoppers, cleaners, care workers, designers, freelancers, and other workers. Protecting these workers from unfair, deceptive, and anticompetitive practices is a priority, and the Federal Trade Commission (“FTC” or “Commission”) will use its full authority to do so.3 As the Commission’s past work and current initiatives illustrate, the agency’s broad-based jurisdiction and interdisciplinary approach to market harms make it well positioned to confront the challenges this model can pose to workers.4 1 See, e.g., Ben Zipperer et al., Econ. Pol’y Inst., National Survey of Gig Workers Paints a Picture of Poor Working Conditions, Low Pay, at 1 (June 1, 2022) (“While the concept of nontraditional, short-term, and contract work has been around since well before the digital age, it wasn’t until the 2010s that digital platform companies like Uber, DoorDash, Instacart, and TaskRabbit began to rise to prominence and shape the way we define gig work today.”). 2 Mastercard & Kaiser Assocs., Mastercard Gig Economy Industry Outlook and Needs Assessment, at 2 (May 2019). 3 While this Statement focuses on potential harms to gig workers and how the Commission might address them, misconduct against any consumer—customers who use services offered through the platform, workers who supply labor, and businesses on or off the platform—is prohibited. See, e.g., Decision & Order, In re Uber Techs., Inc., Dkt. No. C-4662 (FTC Oct. 25, 2018) (requiring Uber to implement a comprehensive privacy program to protect personal data collected from both riders and drivers); Decision & Order, Amazon.com., Dkt. No. C-4746 (FTC June 10, 2021) (requiring Amazon to refund Amazon Flex drivers $61.7 million in tips that Amazon promised drivers but failed to pay); Compl. ¶¶ 61–69, In re HomeAdvisor, Inc., Dkt. No. 9407 (FTC Mar. 11, 2022) (FTC challenging a leadgeneration platform’s alleged misrepresentations to small businesses about the platform’s effectiveness); see also Letter from Protect Our Rests. to Fed. Trade Comm’n (July 21, 2021) (explaining how various practices that result in diners paying higher prices to food delivery platforms also harm small businesses). 4 This Policy Statement elaborates on principles adopted by the Commission in individual cases and rules over the course of many years. This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates at least one existing statutory or regulatory requirement. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action. Pursuant to the Congressional Review Act, 5 U.S.C. §§ 801 et seq., the Office of Information and Regulatory Affairs designated this Policy Statement as not a major rule, as defined by 5 U.S.C. § 804(2). 1 of 17

Page 42

I.

Background on Gig Work The gig economy touches nearly every aspect of American life, from food delivery to transportation to household services. Gig work involves activity where people earn income providing on-demand work, often through a digital service like an app.5 Ride-hailing companies recruit workers to drive customers in the worker’s personal vehicle. Food delivery services find workers to deliver items from restaurants, grocery stores, and other merchants to customers. Service apps connect workers with customers seeking help with cleaning, home repair, and other temporary jobs. The gig work model is expanding into healthcare, retail, and other segments of the economy.6 Demand for some services gig workers provide grew during the COVID-19 pandemic.7 Demand for other gig services, particularly transportation, decreased during that same time and caused financial struggles for some workers, illustrating the precarious nature of gig work.8 Sixteen percent of Americans report earning money through an online gig platform.9 Gig workers live throughout the United States, in urban, suburban, and rural areas.10 As highlighted 5 See, e.g., Internal Revenue Serv., Gig Economy Tax Center (last updated Mar. 15, 2022); Elka Torpey & Andrew Hogan, Working in a Gig Economy, U.S. Bureau of Labor Stat. (May 2016). Gig work also may be referred to as “crowdwork,” contract work, on-call arrangements, or temporary work. See Gallup, Inc., Gallup’s Perspective on the Gig Economy and Alternative Work Arrangements, at 7 (2018). 6 See, e.g., Fiona Greig & Daniel M. Sullivan, The Online Platform Economy Through the Pandemic JPMorgan Chase Inst. (Oct. 2021) (reporting that some gig workers “transport people or goods” while other workers “offer a growing variety of services including dog walking, home repair, telemedicine, and many others”); see also U.S. Census Bureau, Selected Industries That Contributed to the U.S. Gig Economy: 2019 (June 30, 2022). 7 See, e.g., Accenture, Platforms Work, at 21 & ex.4 (2021) (showing with Uber data that “COVID-19 suppressed demand for rideshare and enabled strong growth in delivery”).

8 See, e.g., Greig & Sullivan, The Online Platform Economy Through the Pandemic (noting that drivers for rideshare platforms were “most likely to have received unemployment insurance” during the COVID-19 pandemic). 9 Anderson et al., The State of Gig Work in 2021, at 3, 16; see also Fed. Rsrv. Sys. Bd. of Governors, Report on the Economic Well-Being of U.S. Households in 219, Featuring Supplemental Data from April 2020, at 18 (May 2020) (“Nearly one in three adults earned money from gigs.”); cf. Katherine G. Abraham et al., Nat’l Bureau of Econ. Rsch. Working Paper 24950, Measuring the Gig Economy: Current Knowledge and Open Issues (Aug. 2018) (explaining why precisely measuring the number of gig workers in the U.S. economy is so difficult). 10 See Anderson et al., The State of Gig Work in 2021, at 24 (noting that comparable percentages of adults in urban, suburban, and rural areas have earned money through an online gig platform in the past year); see also Ctr. for Rural Innovation & Rural Innovation Strategies, Inc., The Growing Gig Economy in Rural America, at 4 (Nov. 2021). 2 of 17

Page 43

in the FTC’s Serving Communities of Color report, gig workers are disproportionately people of color11: 30% of Latino adults, 20% of Black adults, and 19% of Asian adults report having engaged in gig work, compared to only 12% of White adults.12 Many gig workers have lower incomes and, because they may not be covered by wage and hour laws, can earn less than the minimum wage.13 More than half of American gig workers report that the money they earn through the gig economy is essential or important for meeting their basic needs.14 Gig workers are paid in different ways, including weekly, in “batches” after completing multiple gigs, or immediately upon completing a gig (for a fee).15 Many workers are heavily dependent on customer tips.16 Gig companies may generate revenue from multiple sources, including a “take rate”17 (a percentage of customer payments for workers’ services), customer fees, and commissions charged to merchants.

11 Fed. Trade Comm’n, Serving Communities of Color: A Staff Report on the Federal Trade Commission’s Efforts to Address Fraud and Consumer Issues Affecting Communities of Color, at 19 & n.70 (Oct. 2021). 12 Anderson et al., The State of Gig Work in 2021, at 5; see DoorDash, 2021 DoorDash ESG Report: Growing and Empowering Local Economies, at 41 (Apr. 19, 2022) (nearly 40% of DoorDash gig workers identify as people of color, 58% are women, and 15% are veterans); Uber, 2021 ESG Report, at 28 (July 2021) (about half of Uber’s U.S. delivery personnel identify as people of color).

13 See Zipperer et al., National Survey of Gig Workers, at 1 (“[A] survey of gig workers reveals that these workers often are paid low wages, in some instances less than the minimum wage [and] they face economic insecurity at high rates . . . .”); see also Anderson et al., The State of Gig Work in 2021, at 4–5, 7, 23; Gallup, Gallup’s Perspective on the Gig Economy and Alternative Work Arrangements, at 8. 14 See Anderson et al., The State of Gig Work in 2021, at 31 (reporting that 58% of current or recent gig workers said that money earned via gig jobs has been “essential or important for meeting their basic needs”). 15 See, e.g., DoorDash, What Is Fast Pay? (2020); Grubhub for Drivers, What Is Instant Cashout? (2020); Uber Techs., Inc., Your Money When You Need It (2022).

16 See Chris Benner, UC Santa Cruz, On-Demand and On-the-Edge: Ride-Hailing and Delivery Workers in San Francisco, at 28 (May 5, 2020) (“Delivery workers are particularly dependent on tips, which account for 30% of their estimated earnings.”).

17 See Cong. Rsch. Serv., R44365, What Does the Gig Economy Mean for Workers?, at 3 (Apr. 28, 2017); see also Aaron Gordon & Dhruv Mehrotra, Uber and Lyft Take a Lot More from Drivers Than They Say, Jalopnik (Aug. 26, 2019, 12:04 PM).

3 of 17

Page 44

II.

The Market for Gig Workers As with any evolving sector of the economy, the Commission is attuned to gig work’s promises and pitfalls. This Statement focuses on three market features that implicate the Commission’s consumer protection and competition missions:

Control Without Responsibility. Companies frequently promote gig work as a flexible opportunity for people to set their own hours and work on their own terms.18 These companies often categorize their workers as independent contractors. Yet in practice these firms may tightly prescribe and control their workers’ tasks in ways that run counter to the promise of independence and an alternative to traditional jobs. This tension has contributed to litigation across the country over allegations that gig workers are being misclassified as independent contractors rather than employees.19 When misclassification occurs, workers are often deprived of critical rights to which they are entitled under law (such as the right to organize, overtime pay, and health and safety protections), and saddled with inordinate risks (such as unclear and unstable pay, or responsibility for a vehicle, equipment, or supplies) and business expenses that employers commonly bear (such as insurance, gas, maintenance, and taxes).20 At the same time, 18 See, e.g., Cong. Rsch. Serv., What Does the Gig Economy Mean for Workers?, at i (“The apparent availability of gig jobs and the flexibility they seem to provide workers are frequently touted features of the gig economy.”). 19 See, e.g., Lawson v. Grubhub, Inc., 13 F.4th 908 (9th Cir. 2021); Waithaka v. Amazon.com, Inc., 966 F.3d 10 (1st Cir. 2020); Razak v. Uber Techs., Inc.¸ 951 F.3d 137 (3d Cir. 2020); Hood v. Uber Techs., Inc., Case No. 1:16-CV-998, 2019 WL 93546 (M.D.N.C. Jan. 3, 2019).

20 See, e.g., National Labor Relations Act, 29 U.S.C. §§ 151 et seq. (protecting, among other rights, employees’ rights to act together to address working conditions); U.S. Dep’t of the Treasury, The State of Labor Market Competition, at 12 (“Classifying workers as independent contractors can especially reduce costs by shifting nonwage costs typically paid by employers (e.g. healthcare benefits) onto the employee. These costs are non-trivial— approximately 30 percent of per-hour employer costs come from costs other than wages and salaries.”); see also Ken Jacobs & Michael Reich, Inst. for Rsch. on Labor & Emp., Massachusetts Uber/Lyft Ballot Proposition Would Create Subminimum Wage, at 2, Univ. Cal. Berkeley. (Sept. 2021) (estimating the financial impact of undisclosed terms of work for rideshare drivers); James A. Parrott & Michael Reich, An Earnings Standard for New York City’s App-Based Drivers: Economic Analysis and Policy Assessment, at 49 (July 2018) (noting the large amount of unpaid “idle” time for rideshare drivers). Moreover, high inflation and other economic shocks may cause certain workerborne costs to rise without any corresponding increase in pay. See Gerrit De Vynck et al., Inflation Is Helping Gig Companies Like Uber—and Hurting Their Workers, Wash. Post (Aug. 7, 2022, 6:00 AM EDT). 4 of 17

Page 45

gig companies may use nontransparent algorithms to capture more revenue from customer payments for workers’ services than customers or workers understand.21 This dynamic calls for scrutiny of promises gig platforms make, or information they fail to disclose, about the financial proposition of gig work.

Diminished Bargaining Power. Gig workers often do not have the information they need to know when work will be available, where they will have to perform it, or how they will be evaluated.22 Behind the scenes, ever-changing algorithms may dictate core aspects of workers’ relationship with a given company’s platform, leaving them with an invisible, inscrutable boss.23 Workers have little leverage to demand transparency from gig companies: A decentralized work environment, the potential lack of legal protections to organize, and a high turnover rate driven by companies’ treatment of workers as replaceable all contribute to workers’ diminished bargaining power.24 Mandatory arbitration and class-action waivers are also increasingly common among gig workers, meaning that most efforts to vindicate worker rights occur in nonpublic, isolated proceedings.25 This power imbalance may leave gig workers more 21 See, e.g., Compl. ¶¶ 30–34, In re Amazon.com, Inc., Dkt. No. C-4746 (alleging that Amazon adopted a “variable base pay” model for Amazon Flex so it could capture drivers’ tips); Dan Calacci, MIT Media Lab, Bargaining with the Algorithm: Pooling Worker Data to Estimate Gig Economy Worker Pay (Oct. 15, 2020). 22 See, e.g., Compl. ¶¶ 35–47, Amazon.com, Dkt. No. C4746 (alleging that Amazon concealed changes to an algorithm by falsely telling workers that no change had actually occurred). 23 See, e.g., Hatim A. Rahman, The Invisible Cage: Workers’ Reactivity to Opaque Algorithmic Evaluations, 66 Admin. Sci. Q. 945, 976 (2021); Spencer Soper, Fired by Bot at Amazon: “It’s You Against the Machine”, Bloomberg (June 28, 2021, 5:00 AM); see also Noam Scheiber, How Uber Uses Psychological Tricks to Push Its Drivers’ Buttons, N.Y. Times (Apr. 2, 2017).

24 See U.S. Dep’t of the Treasury, The State of Labor Market Competition, at 11 (“By removing the immediate nexus between workers and the firm for which they provide services, workers are prevented from bargaining directly with the entity that has the economic power.”); Christopher Mims, In a Tight Labor Market, Gig Workers Get Harder to Please, Wall St. J. (May 4, 2019) (noting “[t]he unusually high rate of turnover [of workers] in the gig economy”); see also Zipperer et al., National Survey of Gig Workers, at 7. 25 See, e.g., Elizabeth C. Tippett & Bridget Schaaf, How Concepcion and Italian Colors Affected Terms of Service in the Gig Economy, 70 Rutgers U. L. Rev. 459, 461 (2018) (analyzing the high prevalence of mandatory arbitration and class-action waivers in the gig economy even before Epic Systems Corp. v. Lewis, 138 S. Ct. 1612 (2018)). 5 of 17

Page 46

exposed to harms from unfair, deceptive, and anticompetitive practices and is likely to amplify such harms when they occur.

Concentrated Markets. Markets populated by businesses that run online platforms are often concentrated, resulting in reduced choice for workers, customers, and businesses. As a platform grows by attracting more users (e.g., riders), it can become more valuable to users on the other side of the platform (e.g., drivers) by generating so-called “network effects.” Because network effects can lock in a dominant player’s market position, these businesses can be incentivized to pursue tactics designed to quickly capture a large share of the market, leading the market to “tip” and raising significant barriers to entry. Gig companies in concentrated markets may be more likely to have and exert market power over gig workers or engage in anticompetitive unilateral or coordinated conduct. Such conduct may eliminate or further weaken competition among existing gig companies for workers’ services or prevent new gig companies from getting off the ground or being able to enter the market. The resulting loss in competition may enable gig companies to suppress wages below competitive rates, reduce job quality, or impose onerous terms on gig workers.26 In the absence of robust competition among gig companies, unfair and deceptive practices by one platform can proliferate across the labor market, creating a race to the bottom that participants in the gig economy, and especially gig workers, have little ability to avoid.

III.

FTC Enforcement Priorities The FTC plays a vital role in addressing these and other challenges facing gig workers, including practices directed toward customers, workers, and honest businesses. As the only federal agency dedicated to enforcing consumer protection and competition laws in broad sectors 26 See, e.g., Exec. Order No. 14,036, Promoting Competition in the American Economy, § 1, 86 Fed. Reg. 36,987, 36,987 (July 14, 2021); U.S. Dep’t of the Treasury, The State of Labor Market Competition, at i. 6 of 17

Page 47

of the economy, the FTC examines unlawful business practices and harms to market participants holistically, complementing the efforts of other enforcement agencies with jurisdiction in this space. This integrated approach to investigating unfair, deceptive, and anticompetitive conduct is especially appropriate for the gig economy, where law violations often have cross-cutting causes and effects.

While online gig platforms may seem novel, traditional legal principles of consumer protection and competition apply.27 And the manifold protections enforced by the Commission do not turn on how gig companies choose to classify working consumers.28 The Commission will use the full portfolio of laws it enforces to prevent unfair, deceptive, anticompetitive, and otherwise unlawful practices affecting gig workers.

A.

Holding Gig Companies Accountable for Their Claims and Conduct Concerning Gig Work’s Costs & Benefits Gig companies that classify their workers as independent contractors may seek to retain control over their workforce while simultaneously shifting costs and risks onto workers. So classified, workers may be deprived of the protections of an employment relationship to, for example, insist on minimum pay and recordkeeping standards,29 understand what comprises an hour of payable work,30 or share information about their income with coworkers to assess unfair compensation practices or organize for higher compensation.31 A range of FTC authorities can apply when gig companies seek to exploit this vulnerability by disclosing pay and costs in an 27 For example, the Commission regulates earnings claims made to gig workers just as it would in any other business or money-making opportunity. See Advance Notice of Proposed Rulemaking: Deceptive or Unfair Earnings Claims, 87 Fed. Reg. 13,951, 13,953 & n.26 (Mar. 11, 2022) [hereinafter “Earnings Claims ANPRM”]. 28 “The use of the word ‘consumer’” in the FTC Act “is to be read in its broadest sense.” S. Rep. No. 93–151, at 27 (1973); see, e.g., Decision & Order, Amazon.com, Dkt. No. C-4746 (FTC recovering $61.7 million in unpaid tips to Amazon Flex drivers, regardless of the drivers’ employment classification); Compl. ¶ 5, Uber Techs., Dkt. No. C-4662 (“Uber Drivers are consumers who use the [Uber] App to locate Riders in need of transportation.”). 29 See 29 U.S.C. §§ 206–07 (minimum pay and overtime), 211(c) (recordkeeping). 30 See id. § 203(o) (defining “[h]ours worked” for purposes of calculating minimum pay and overtime pay). 31 See id. § 157.

7 of 17

Page 48

unfair or deceptive manner. The Commission also recognizes that misleading claims about the costs and benefits of gig work can impair fair competition among companies in the gig economy and elsewhere.

Deceptive or Unfair Pay Practices. False, misleading, or unsubstantiated claims about earnings may violate Section 5 of the FTC Act,32 the Franchise Rule, or the Business Opportunity Rule,33 and can trigger civil penalties.34 Likewise, withholding money owed to workers without consent can violate Section 5’s prohibition against unfairness.35 Gig companies often advertise hourly pay to prospective workers or promise a specific amount or range of pay to existing workers for completing a gig.36 Yet fewer than half of gig workers understand how their pay is determined, and misleading or unsupported claims about their earnings can leave workers in a financial bind.37 Deceptive earnings claims and opaque compensation criteria can also impede competition by preventing workers from accurately comparing opportunities presented by gig companies.

32 15 U.S.C. § 45. Unfortunately, the Commission’s ability to refund consumers for violations of Section 5 is hampered following the U.S. Supreme Court’s decision in AMG Capital Management, LLC v. FTC, 141 S. Ct. 1341 (2021), which stripped the Commission of its most potent tool to recover money for consumers. Indeed, AMG would have prevented recovery of more than $81 million in consumer redress obtained in two of the Commission’s recent victories for gig workers. See Decision & Order, Amazon.com, Dkt. No. C-4746 (recovering $61.7 million for Section 5 violations); Stipulated Order, FTC v. Uber Techs., Inc., Case No. 3:17-cv-261-JST (N.D. Cal. Jan. 19, 2017) (recovering $20 million for Section 5 violations).

33 16 C.F.R. pts. 436 (Franchise Rule), 437 (Business Opportunity Rule). Whether the Franchise Rule or the Business Opportunity Rule applies to a particular gig arrangement requires a case-by-case factual analysis. See id. § 436.1(h) (defining a franchise); id. § 437.1(c) (defining a business opportunity). The Commission may seek civil penalties and consumer redress from companies that violate FTC rules. See 15 U.S.C. §§ 45(m)(1)(A), 57b(a)–(b). 34 See Fed. Trade Comm’n, Press Release, FTC Puts Businesses on Notice That False Money-Making Claims Could Lead to Big Penalties (Oct. 26, 2021); see also 15 U.S.C. § 45(m)(1)(B). 35 Cf. Decision & Order, Amazon.com, Dkt. No. C-4746 (requiring a gig company to obtain workers’ “express informed consent” before changing how workers’ tips are distributed). 36 See, e.g., Compl. ¶¶ 21–22, Uber Techs., Case No. 3:17-cv-261-JST (FTC alleging that Uber made various hourly earnings claims targeted to multiple U.S. cities that did not align with what drivers in those cities actually earned); see also Compl. ¶¶ 30–34, Amazon.com, Dkt. No. C-4746 (alleging that Amazon promised that workers would keep 100% of their tips, but instead used tips to reduce workers’ base pay). 37 See Anderson et al., The State of Gig Work in 2021, at 35 (“Overall, 44% of people who have ever earned money through online or delivery platforms say they at least somewhat understand how the companies that run these apps or sites determine how much they get paid . . . .”); see also Zipperer et al., National Survey of Gig Workers, at 6–7 (describing high rates of financial hardship among gig workers).

8 of 17

Page 49

The Commission has initiated rulemaking proceedings to strengthen its ability to detect and deter deceptive earnings claims and has sought comment on the prevalence of deceptive earning claims relating to gig work.38 In the meantime, misleading earnings claims remain prohibited by Section 5 of the FTC Act.39 Likewise, pursuant to the Franchise Rule or the Business Opportunity Rule, gig companies that require new participants to make required payments may need to disclose any claims they make about potential earnings and have a reasonable basis for, and written materials on hand to support, those claims.40 The Commission has also issued Notices of Penalty Offenses related to earnings claims and testimonials41 to place gig companies, among others, on notice that the Commission is working to deter misleading representations throughout the gig economy, including by seeking civil penalties where appropriate.42 Undisclosed Costs or Terms of Work. By the same token, deceptive claims or nondisclosures about startup costs, training fees, other expenses, or other material terms can violate Section 5,43 and the failure to make required disclosures can violate the Franchise Rule or Business Opportunity Rule.44 When a firm requires consumers to make one or more required payments to sign up for a work opportunity, that arrangement may fall under the Franchise Rule 38 See Earnings Claims ANPRM, 87 Fed. Reg. at 13,955–56.

39 See id. at 13,951–52 (describing the FTC’s extensive history of prior enforcement actions against a wide variety of companies offering employment and other work opportunities with misleading earnings claims). 40 See 16 C.F.R. § 436.5(s) (describing the disclosures that franchisors must make to franchisees about financial performance); id. § 437.4 (explaining how sellers of business opportunities must substantiate any earnings claims regarding the opportunity, including when claims are presented in the general media). 41 See Fed. Trade Comm’n, Notice of Penalty Offenses Concerning Money-Making Opportunities (Oct. 26, 2021); Fed. Trade Comm’n, Notice of Penalty Offenses Concerning Deceptive or Unfair Conduct Around Endorsements and Testimonials (Oct. 26, 2021).

42 See FTC Press Release, FTC Puts Businesses on Notice That False Money-Making Claims Could Lead to Big Penalties (announcing that Notices of Penalty Offenses were sent to more than 1,100 businesses and advising that violating the Notices could result in civil penalties that now amount to $46,517 per violation, see 16 C.F.R. § 1.98(e)).

43 See, e.g., Compl. ¶¶ 31–33, 38, Uber Techs., Case No. 3:17-cv-261-JST (alleging that Uber violated Section 5 by understating the price and overstating the advantages of its auto financing program for drivers). 44 See 16 C.F.R. §§ 436.2, 437.2.

9 of 17

Page 50

or the Business Opportunity Rule.45 The Rules require accurate, upfront disclosures—including information about the franchise or business opportunity, other workers, and prior lawsuits— before consumers make any commitment.46 B.

Combating Unlawful Practices and Unlawful Constraints Imposed on Gig Workers Gig workers may lack key information about their working conditions, and can be subject to onerous contract terms and arbitrary evaluation requirements. Increasingly, gig workers are managed by algorithms, which use extensive data collected from workers and other consumers to make important management decisions using undisclosed criteria. Multiple laws enforced by the Commission may apply when these practices are deceptive, unfair, anticompetitive, or otherwise unlawful.

Unfair or Deceptive Practices by an Automated Boss. Section 5 of the FTC Act prohibits unfair or deceptive practices in any form, including practices involving artificial intelligence (“AI”) tools or algorithm-based decision-making.47 In the gig economy, companies may employ algorithms to govern how gigs are made available to workers, how workers are paid, how worker performance is rated, and when workers are suspended or terminated from the platform. Firms may deploy surveillance technology to monitor workers’ every move without 45 See id. § 436.1(h) (defining a franchise); id. § 437.1(c) (defining a business opportunity). 46 See id. §§ 436.2(a), 436.4, 436.5 (requiring franchisors to provide a disclosure document in business relationships that qualify as franchises covered by the Franchise Rule); id. §§ 437.3, 437.4, apps. A–B (requiring a disclosure document for business opportunities and providing templates). 47 Running these algorithms requires collecting troves of sensitive data from workers, which heightens the importance of FTC rules governing data security, see, e.g., 16 C.F.R. pt. 314 (Safeguards Rule), and gig companies’ obligation under Section 5 to safeguard collected information in line with their promises, see Compl. ¶¶ 28–32, Uber Techs., Dkt. No. C-4662 (alleging that, despite public representations, Uber failed to monitor internal access to drivers’ personal information and failed to provide reasonable security against potential data breaches). Workers are also entitled under the Fair Credit Reporting Act to know when a gig platform uses a background screening or other consumer report to take an adverse action against them, whether through an algorithm or otherwise. See 15 U.S.C. § 1681m(a). If information in a consumer report results in a worker being denied the requested opportunity, the consumer must receive notice that the denial was based on a consumer report and a chance to view the report and request any needed corrections. See id.

10 of 17

Page 51

transparency about how it impacts worker pay or performance evaluation.48 Workers report unexpected drops in their performance ratings,49 unexplained changes in their pay,50 assignment of impossible or dangerous delivery routes,51 or other arbitrary evaluations that could lead to wrongful terminations.52 Companies are responsible for fulfilling their promises to their workers, even if they use automated management technologies.53 Gig companies that employ algorithmic tools to govern their workforce should ensure that they do so legally.54 Unfair Contractual Terms & Restrictions on Mobility. Restrictive contract terms may constitute unfair or deceptive acts and practices in violation of Section 5 of the FTC Act if they unfairly harm workers, render a gig company’s representations misleading, or prevent fair competition for workers. Gig companies often present workers with nonnegotiable contracts that may include lopsided provisions.55 Such take-it-or-leave-it provisions may, for example, hinder workers from seeking other jobs during or after their time with a company, bar negative reviews, 48 See Advance Notice of Proposed Rulemaking: Trade Regulation Rule on Commercial Surveillance and Data Security, 87 Fed. Reg. 51,273, 51,274 (Aug. 22, 2022) (noting the lack of transparency and informed consent around increasingly extensive data collected from workers).

49 See, e.g., Soper, Fired by Bot at Amazon: “It’s You Against the Machine”; see also Rahman, The Invisible Cage, 66 Admin. Sci. Q. at 964; Pierre Bérastégui, Eur. Trade Union Inst., Exposure to Psychosocial Risk Factors in the Gig Economy: A Systemic Review, at 47 (Jan. 2021) (noting that workers “are unsure about what data is gathered from them and how it is used to compute wages and ratings,” leading to “frustration about not being rated on the basis of ‘true’ performance”).

50 See, e.g., Alina Selyukh, At the Mercy of an App: Workers Feel the Instacart Squeeze, NPR (Nov. 25, 2019, 9:15 AM) (reporting that multiple gig platforms use “ever-changing pay structures” governed by algorithms); see also Calacci, Bargaining with the Algorithm (describing a gig platform’s pay structure as a “black-box algorithm”). 51 See Eve Livingston, Food Delivery Drivers Fired After “Cut Price” GPS App Sent Them on “Impossible” Routes, Guardian (July 2, 2022, 2:39 PM EDT).

52 See, e.g., Madhumita Murgia, Workers Demand Gig Economy Companies Explain Their Algorithms, Fin. Times (Dec. 12, 2021).

53 See Compl. ¶ 32, Amazon.com, Dkt. No. C-4746 (alleging that Amazon Flex changed the algorithm governing delivery drivers’ base pay, allowing Amazon to capture a greater portion of customer tips than it had disclosed). 54 Elisa Jillson, Fed. Trade Comm’n, Aiming for Truth, Fairness, and Equity in Your Company’s Use of AI (Apr. 19, 2021).

55 See U.S. Dep’t of the Treasury, The State of Labor Market Competition, at 14, 18 (noting that “restrictive employment agreements can both result from and reinforce employer market power,” while other clauses can reduce workers’ options “within the legal system”); Fed. Trade Comm’n, Strategic Plan for Fiscal Years 2022-2026, at 19 (Aug. 26, 2022) (announcing FTC interest in “non-compete and other potentially unfair contractual terms resulting from power asymmetries between workers and employers”).

11 of 17

Page 52

or waive fundamental protections.56 If those provisions cause substantial injury that is not reasonably avoidable and not outweighed by countervailing benefits, they may constitute an unfair act or practice under Section 5(n) of the FTC Act.57 The Commission has used its unfairness authority to prohibit certain one-sided clauses in credit contracts,58 to stop abusive use of a one-sided clause allowing a financing entity to obtain uncontested judgments against small businesses,59 to prevent contractual clauses suppressing negative consumer reviews,60 and to invalidate illusory choice-of-law and venue-selection clauses that, in very fine print, left the forum state undetermined.61 The Commission will continue to scrutinize potentially unfair terms companies impose on gig workers or other consumers.

Certain unfair terms may also implicate the antitrust laws and raise concerns about unfair methods of competition with respect to gig labor markets. The Commission will continue to investigate the effects on workers and competition of any non-compete clauses in the gig economy. Non-compete provisions may undermine free and fair labor markets by restricting workers’ ability to obtain competitive offers for their services from existing companies, resulting in lower wages and degraded working conditions.62 These provisions may also raise barriers to 56 See, e.g., Exec. Order No. 14,036, 86 Fed. Reg. at 36,987–88; FTC v. Roca Labs, Inc., 345 F. Supp. 3d 1375, 1393–97 (M.D. Fla. 2018); U.S. Dep’t of the Treasury, The State of Labor Market Competition, at 18. 57 15 U.S.C. § 45(n); FTC Unfairness Policy Statement, Letter from the FTC to Hon. Wendell Ford & Hon. John Danforth, S. Comm. on Commerce, Sci. & Transp. (Dec. 17, 1980), appended to In re Int’l Harvester Co., 104 F.T.C. 949, 1070 (1984).

58 See FTC Trade Regulation Rule; Credit Practices, 49 Fed. Reg. 7,740, 7,744 (Mar. 1, 1984) (codified at 16 C.F.R. pt. 444).

59 See 1st Am. Compl. ¶¶ 24–28, 39–41, FTC v. RCG Advances, LLC, Case No. 20-CV-4432 (S.D.N.Y. June 10, 2021).

60 See Roca Labs, 345 F. Supp. 3d at 1393; see also 15 U.S.C. § 45b; FTC v. World Patent Mktg., Inc., Case No. 17-cv-20848-GAYLES, 2017 WL 3508639, at *15–16 (S.D. Fla. Aug. 16, 2017) (preliminarily enjoining a defendant’s “consumer complaint suppression practices” as unfair). 61 See Compl. ¶¶ 18, 32–33, FTC v. NorVergence, Inc., Civil Action No. 04-5414 (D.N.J. Nov. 4, 2004). 62 See Exec. Order No. 14,036, 86 Fed. Reg. at 36,987 (noting that non-compete agreements can “mak[e] it harder for workers to bargain for higher wages and better work conditions”); Matthew S. Johnson et al., The Labor Market Effects of Legal Restrictions on Worker Mobility, at 2 (Oct. 12, 2021) (“We find that increases in [non-compete clauses] decrease workers’ earnings and mobility.”); Evan P. Starr et al., Noncompetes in the U.S. Labor Force, 64 J.L. & Econ. 53, 81 (2021) (finding that non-compete provisions imposed in employment contracts “appear to be 12 of 17

Page 53

entry for new companies.63 Such provisions may violate Section 1 of the Sherman Act64 and the FTC Act’s prohibition on unfair methods of competition.65 The Commission will also investigate contractual limitations, such as liquidated damages clauses66 or nondisclosure agreements,67 that may be excessive or overbroad and effectively operate as non-compete provisions. Moreover, the Commission recognizes that companies may be able to effectuate the same harmful results through imposing a variety of other restraints that restrict worker mobility. C.

Policing Unfair Methods of Competition That Harm Gig Workers Anticompetitive mergers or practices may prevent gig workers from obtaining competitive compensation or more favorable terms or working conditions. Such conduct may also lead to higher prices or fees, diminished service, or less favorable contractual terms for customers or businesses. Firms that undertake such conduct may run afoul of the antitrust laws, and the Commission will focus its resources on investigating potential unlawful conduct by or linked to lower job satisfaction” and do not correlate with greater pay or training); see also FTC Comm’r Noah J. Phillips, Prepared Remarks at FTC Workshop on Non-compete Clauses in the Workplace, at 2–3 (Jan. 9, 2020) (“When you can exit a job, you have greater leverage to improve the terms of your employment.”); FTC Comm’r Rebecca Kelly Slaughter, Prepared Remarks at FTC Workshop on Non-Compete Clauses in the Workplace, at 5 (Jan. 9, 2020) (prioritizing investigation into “potential restraints that may be inhibiting competition for labor” and noting that non-compete clauses can “affect people’s livelihoods and ability to earn a living”). 63 See, e.g., Matt Marx & Lee Fleming, Non-Compete Agreements: Barriers to Entry … and Exit?, 12 Innovation Pol’y & Econ. 39, 51 (2012) (“Non-competes assist in preserving the firm’s competitive position by discouraging entry.”); see also U.S. Dep’t of the Treasury, The State of Labor Market Competition, at 16 (“Lower worker mobility increases recruitment costs for all firms as fewer workers are seeking to switch jobs than otherwise would, absent the post-employment restrictive employment agreement.”).

64 15 U.S.C. § 1.

65 See, e.g., Statement of Interest of the United States at 6, Beck v. Pickert Med. Grp., P.C., Case No. CV21-02092 (Nev. Dist. Ct. Feb. 25, 2022) (“Non-compete agreements between employers and employees constitute concerted action properly subject to scrutiny under Section 1 of the Sherman Act.”); see also U.S. Dep’t of the Treasury, The State of Labor Market Competition, at 16 (“[R]estrictive employment agreements can both result from and reinforce employer market power.”).

66 See, e.g., Wegmann v. London, 648 F.2d 1072, 1073 (5th Cir. Unit A 1981) (“The contract clauses to which plaintiff object are, given the prohibitive magnitudes of liquidated damages they specify, de facto covenants not to compete . . . .”).

67 See, e.g., Brown v. TGS Mgmt. Co., 271 Cal. Rptr. 3d 303, 319 (Cal. Ct. App. 2020) (“Collectively, these overly restrictive [confidentiality] provisions operate as a de facto noncompete provision . . . .”). 13 of 17

Page 54

among gig companies, from wage-fixing to the unlawful consolidation or exercise of market power.68 Wage-Fixing & Coordination. The Commission will investigate evidence of agreements between gig companies to fix wages, benefits, fees, or other terms relating to gig work that should be subject to competition.69 The Commission will also investigate evidence of nopoaching agreements, where companies agree not to solicit or hire each other’s workers, and agreements to share competitively sensitive information that might suppress compensation for workers.70 The Commission may further examine any use by gig companies of technologyenabled methods of collusion or exclusion. Agreements among gig companies that anticompetitively harm workers violate Section 1 of the Sherman Act and may be challenged by the Commission directly, and, in the case of wage-fixing or no-poaching agreements, may be referred to the U.S. Department of Justice (“DOJ”) for potential criminal prosecution.71 Market Consolidation & Monopolization. The Commission will review and, as appropriate, challenge mergers and other combinations of gig companies that may substantially 68 At least one court has ruled that the labor-dispute exemption under Section 1 of the Sherman Act applies to workers regardless of whether they are classified as employees or independent contractors. See Confederación Hípica de P.R., Inc. v. Confederación de Jinetes Puertorriqueños, 30 F.4th 306, 314–15 (1st Cir. 2022). Commission enforcement therefore will not focus on organizing efforts undertaken by gig workers. Despite past efforts, the Commission will also refrain from other enforcement or policy efforts that might undermine the ability of gig workers to organize. See, e.g., Brief for the United States & FTC as Amici Curiae Supporting Appellant at 2, 8, Chamber of Commerce v. City of Seattle, 890 F.3d 769 (9th Cir. 2018) (No. 17-35640), 2017 WL 5166667, at *2, *8 (arguing that the state action doctrine did not apply to shield a municipal ordinance allowing drivers to organize from antitrust scrutiny).

69 See, e.g., Compl. ¶¶ 11–27, In re Your Therapy Source, LLC, Dkt. No. C-4689 (FTC July 31, 2018) (alleging an agreement and invitation to collude among staffing agencies to lower payments to their independent contractors). 70 See U.S. Dep’t of Justice & Fed. Trade Comm’n, Antitrust Guidance for Human Resource Professionals, at 4–5 (“[P]eriodic exchange of current wage information in an industry with few employers could establish an antitrust violation because, for example, the data exchange has decreased or is likely to decrease compensation.”); U.S. Dep’t of Justice & Fed. Trade Comm’n, Antitrust Guidelines for Collaborations Among Competitors, at 15 (Apr. 2000) (“[T]he sharing of information related to a market in which the collaboration operates or in which the participants are actual or potential competitors may increase the likelihood of collusion on matters such as price, output, or other competitively sensitive variables.”).

71 See U.S. Dep’t of Justice & Fed. Trade Comm’n, Antitrust Guidance for Human Resource Professionals, at 3–4 (explaining that naked wage-fixing agreements are per se illegal and DOJ intends to proceed criminally against naked wage-fixing).

14 of 17

Page 55

lessen competition between or among gig companies.72 The Commission will also investigate any exclusionary or predatory conduct by dominant firms that may unlawfully create or maintain a monopoly (a dominant seller) or a monopsony (a dominant buyer or employer), resulting in harm to customers or reduced compensation or poorer working conditions for gig workers. Such conduct may include the use of exclusive contracting, predatory pricing, or other forms of monopolization, and may be subject to legal action by the Commission as a violation of Section 2 of the Sherman Act.73 IV.

Policy, Partnerships, & Outreach In addition to robust enforcement, the Commission addresses issues in the gig economy through policy work, outreach, and partnerships with other law enforcement agencies. Governmental Collaboration. The FTC’s Regional Offices have spearheaded the agency’s efforts to identify law violations, develop policy, and collaborate with government partners in this space. The Commission is also partnering with other agencies on broad labor initiatives and individual enforcement actions. In December 2021, the FTC and DOJ hosted a workshop to promote competitive labor markets and worker mobility.74 And in July 2022, the FTC and National Labor Relations Board signed a Memorandum of Understanding that deepens the agencies’ collaboration around issues facing gig workers through sharing information, conducting cross-training for staff at each agency, and partnering on investigative efforts within each agency’s authority.75 72 See Exec. Order No. 14,036, § 1, 86 Fed. Reg. at 36,988 (directing federal attention “to enforce the antitrust laws to combat the excessive concentration of industry, the abuses of market power, and the harmful effects of monopoly and monopsony—especially as these issues arise in labor markets”). 73 15 U.S.C. § 2.

74 Fed. Trade Comm’n, Making Competition Work: Promotion Competition in Labor Markets (Dec. 6–7, 2021). 75 Memorandum of Understanding Between the Federal Trade Commission (FTC) and the National Labor Relations Board (NLRB) Regarding Information Sharing, Cross-Agency Training, and Outreach in Areas of Common Regulatory Interest (July 19, 2022).

15 of 17

Page 56

Ensuring Equity. The FTC’s Equity Action Plan reaffirms the Commission’s commitment to protecting the public, including meaningfully addressing barriers that historically underserved communities face in participating in and benefiting from a fair and thriving marketplace.76 As outlined in the Equity Action Plan, the FTC’s Bureau of Consumer Protection is focusing resources to aid staff in assessing whether certain communities are disproportionately affected or targeted by unfair or deceptive practices, including in the gig economy.77 Similarly, the Equity Action Plan outlines the FTC’s Bureau of Competition’s commitment to consider more explicitly the impact of mergers and anticompetitive conduct on workers, particularly lowwage workers.78 The FTC will address any such harms through robust law enforcement, community outreach, and new initiatives to better understand and address the impact of emerging technologies in the gig economy and elsewhere on historically underserved communities. Public Participation. The Commission continues to seek input from consumer and labor groups, industry, and experts on challenges facing gig workers through monthly Open Commission Meetings79 as well as targeted workshops like those on dark patterns80 and labormarket competition.81 Gig workers harmed by unlawful practices should continue to file reports at ReportFraud.ftc.gov so the Commission and other governmental agencies can promptly identify and take action against deceptive, unfair, and otherwise unlawful acts and practices. 76 See Fed. Trade Comm’n, Federal Trade Commission (FTC) Equity Action Plan, at 1 (Apr. 14, 2022) (promulgated pursuant to Executive Order No. 13985, Advancing Racial Equity and Support for Underserved Communities Through the Federal Government, 86 Fed. Reg. 7,009 (Jan. 25, 2021)). 77 See id. at 4–5.

78 See id. at 6–7.

79 See Fed. Trade Comm’n, Open Meetings.

80 Fed. Trade Comm’n, Bringing Dark Patterns to Light: An FTC Workshop (Apr. 29, 2021) (exploring how user interfaces can, intentionally or not, obscure, subvert, or impair consumer autonomy, decision-making, or choice). 81 FTC Workshop, Making Competition Work (exploring recent developments at the intersection of antitrust and labor, as well as implications for efforts to protect and empower workers through enforcement and rulemaking). 16 of 17

Page 57

V.

Conclusion Successfully addressing the range of consumer protection and competition challenges associated with the gig economy requires innovative and collaborative approaches by governmental enforcers that are responsive to the public’s concerns and input. The Commission will continue to capitalize on its broad jurisdiction and interdisciplinary expertise to combat unlawful practices that harm gig workers.

17 of 17

Page 58

Policy Statement Regarding the Scope of Unfair Methods of Competition Under Section 5 of the Federal Trade Commission Act Commission File No. P221202 November 10, 2022 Section 5 of the Federal Trade Commission Act (FTC Act) prohibits “unfair methods of competition in or affecting commerce.”1 On July 1, 2021, the Federal Trade Commission (FTC) rescinded its 2015 Statement of Enforcement Principles Regarding “Unfair Methods of Competition” under Section 5 of the FTC Act.2 This statement supersedes all prior FTC policy statements and advisory guidance on the scope and meaning of unfair methods of competition under Section 5 of the FTC Act.

I.

Introduction Pursuant to the FTC’s analysis of the decided cases and prior enforcement actions, this policy statement describes the key principles of general applicability concerning whether conduct is an unfair method of competition. Consistent with the Supreme Court’s interpretation of the FTC Act in at least twelve decisions, this statement makes clear that Section 5 reaches beyond the Sherman and Clayton Acts to encompass various types of unfair conduct that tend to negatively affect competitive conditions.3 1 Pub. L. No. 63-203, 38 Stat. 717; 15 U.S.C. § 45(a)(1).

2 Fed. Trade Comm’n, Statement of the Commission on the Withdrawal of the Statement of Enforcement Principles Regarding “Unfair Methods of Competition” Under Section 5 of the FTC Act (July 9, 2021), https://www.ftc.gov/legal-library/browse/statement-commission-withdrawal-statement-enforcement-principlesregarding-unfair-methods.

3 See, e.g. Fed. Trade Comm’n v. Ind. Fed’n of Dentists, 476 U.S. 447, 454 (1986) (holding that “[t]he standard of "unfairness" under the FTC Act is, by necessity, an elusive one, encompassing not only practices that violate the Sherman Act and the other antitrust laws”); Fed. Trade Comm’n v. Sperry & Hutchinson Co., 405 U.S. 233, 242 (1972) (holding that “the Commission has broad powers to declare trade practices unfair."); Fed. Trade Comm’n v. Texaco, 393 U.S. 223, 262 (1968) (holding that “[i]n large measure the task of defining "unfair methods of competition" was left to the [FTC]. . . and that the legislative history shows that Congress concluded that the best check on unfair competition would be [a practical and expert administrative body] . . . [that applies] the rule enacted by Congress to particular business situations”); Fed. Trade Comm’n v. Brown Shoe, 384 U.S. 316, 321 (1966) (holding that the FTC “has broad powers to declare trade practices unfair[,] particularly . . . with regard to trade practices which conflict with the basic policies of the Sherman and Clayton Acts”); Atlantic Refining Co. v. Fed. Trade Comm’n, 381 U.S. 357, 369 (1965) (holding that all that is necessary is to discover conduct that runs counter to the public policy declared in the Act. . .” and that “there are many unfair methods of competition that do not assume the proportions of antitrust violations”); Fed. Trade Comm’n v. Colgate-Palmolive et al., 380 U.S. 377, 384- 85 (1965) (noting that the proscriptions in section 5 are flexible); PAN AM v. United States, 371 U.S. 296, 306 -308 (1963) (“[Section 5] was designed to bolster and strengthen antitrust enforcement[,] and the definitions are not limited to precise practices that can readily be catalogued. They take their meaning from the facts of each case and the impact of particular practices on competition and monopoly”); Fed. Trade Comm’n v. Nat’l Lead Co., 352 U.S. 419, 428-29 (1957) (affirming past rulings finding that the commission is clothed with “wide discretion in. . . [bringing] an end to the unfair practices found to exist[;]. . . [is] ‘the expert body to determine what remedy is necessary to eliminate the unfair or deceptive trade practices which have been disclosed[;] . . . has wide latitude for

Page 59

This statement is intended to assist the public, business community, and antitrust practitioners by laying out the key general principles that apply to whether business practices constitute unfair methods of competition under Section 5 of the FTC Act. In considering whether conduct, either in a specific instance or as a category, constitutes an unfair method of competition, the Commission will directly consult applicable law. This statement does not pertain to any other statutory provision within the FTC’s jurisdiction.4

II.

Background and Legislative History of Section 5 of the FTC Act

A.

The text, structure, and legislative history of Section 5 show that its mandate extends beyond the Sherman and Clayton Acts and reaches unfair conduct with a tendency to negatively affect competitive conditions

As the Commission explained in its July 2021 withdrawal of the previous policy statement, the text, structure, and history of Section 5 reaches more broadly than the antitrust laws.5 Congress passed the FTC Act to push back against the judiciary’s adoption and use of the open-ended rule of reason for analyzing Sherman Act claims,6 which it feared would deliver inconsistent and unpredictable results and “substitute the court in the place of Congress.”7

judgment and[;]. . . [that] to attain the objectives Congress envisioned, [the FTC] cannot be required to confine its road block to the narrow lane the transgressor has traveled”); American Airlines, Inc. v. North American Airlines, Inc., 351 U.S. 79, 85 (1956) (finding that "[u]nfair or deceptive practices or unfair methods of competition". . . are broader concepts than the common-law idea of unfair competition”); Fed. Trade Comm’n v. Motion Picture Advertising Service Co., 344 U.S. 392, 394-95 (1953) (noting that “Congress advisedly left the concept [of unfair methods of competition] flexible . . . [and] designed it to supplement and bolster the Sherman Act and the Clayton Act[,] [so as] to stop . . . acts and practices [in their incipiency] which, when full blown, would violate those Acts[,]. . . as well as to condemn as "unfair methods of competition" existing violations of them”); Fed. Trade Comm’n v. Cement Institute, 333 U.S. 683, 708 (1948) (holding that conduct that falls short of violating the Sherman Act may violate Section 5); Fed. Trade Comm’n v. R. F. Keppel & Bro., Inc., 291 U.S. 304, 310 (1934) (finding that unfair methods of competition not limited to those “which are forbidden at common law or which are likely to grow into violations of the Sherman Act”).

4 This statement does not address the Commission’s authority to prevent unfair or deceptive acts or practices in 15 U.S.C. §§ 45(a),(n). This statement is limited to the scope of standalone unfair methods of competition Section 5 violations. Such standalone unfair methods of competition Section 5 claims may be brought under one or more of the theories set forth in this policy statement and combined with claims under other parts of the FTC Act or other statutes enforced by the Commission as warranted.

This statement does not address the language of 15 U.S.C. § 45(b), which states that the Commission will act when it has reason to believe such action is in the public interest. See generally Hills Bros. v. Fed. Trade Comm’n, 9 F.2d 481, 483–84 (9th Cir. 1926) (“the interest of the public, like the question whether the commission has reason to believe that any person, partnership, or corporation has been or is using any unfair method of competition in commerce, is committed to the discretion of the commission, is to be determined by the commission before proceedings are instituted, and is not thereafter a subject of controversy either before the commission or before the court, except in so far as the question of public interest is necessarily involved in the merits of the case, and, if the commission finds that the method of competition in question is prohibited by the act, no other or further finding on the question of public interest is required.”); see also Parke, Austin & Lipscomb, Inc., et al. v. Fed. Trade Comm’n, 142 F.2d 437, 441 (2d Cir. 1944).

5 Statement of Commission, supra note 2.

6 Standard Oil Co. of New Jersey v. United States, 221 U.S. 1, 60 (1911). 7 S. REP. NO. 62-1326, at 10 (1913) (“Cummins Report”). Senator Francis Newlands, one of the chief sponsors of the bill that became the FTC Act, expressed concern that Standard Oil left antitrust regulation “to the varying judgments of different courts.” 47 CONG. REC. 1225 (1911). After analyzing a series of Supreme Court decisions

Page 60

Congress therefore determined it would “establish[ ] a commission for the better administration of the law and to aid in its enforcement.”8 This led to the creation of the FTC in 1914 and to the enactment of a prohibition of “unfair methods of competition,” a new standard in federal competition law.9

In enacting Section 5, Congress’s aim was to create a new prohibition broader than, and different from, the Sherman and Clayton Acts. Congress purposely introduced the phrase, “unfair methods of competition,” in the FTC Act to distinguish the FTC’s authority from the definition of “unfair competition” at common law.10 It also made clear that Section 5 was designed to extend beyond the reach of the antitrust laws.11 Concluding that a static definition would soon become outdated,12 Congress wanted to give the Commission flexibility to adapt to changing circumstances.13

The key function of the FTC in applying its mandate to combat unfair methods of competition, according to Congress, would be to identify unfair forms of competition.14 The legislative record demonstrates that Congress enacted Section 5 to protect against various types of unfair or oppressive conduct in the marketplace.15 During debates over the meaning of unfair

interpreting the Sherman Act, a Senate committee feared that the rule of reason resulted in a situation where, “in each instance it [would be] for the court to determine whether the established restraint of trade is a due restraint or an undue restraint.” Cummins Report, at 10. It lamented that the rule of reason had made it “impossible to predict with any certainty” whether courts would condemn the many “practices that seriously interfere with competition” and found it inconceivable that “the courts . . . be permitted to test each restraint of trade by the economic standard which the individual members of the court may happen to approve.” Id. at 10, 12. The committee believed this would result in a loss of confidence by the public in the courts and eventually lead to a “repudiat[ion] [of] the fundamental principles of representative government.” Id. at 11.

8 Id. at 12.

9 Federal Trade Commission Act of 1914, Pub. L. No. 63-203, 38 Stat. 717 (codified as amended at 15 U.S.C. § 41– 58). See 51 CONG. REC. 12146 (1914) (statement of Sen. Hollis) (“The Sherman Act is adequate for the abolition of monopoly; it is, however, but imperfectly adequate for the regulation of competition. The present Congress is charged with the duty of supplying the defect in the law”).

10 See 51 CONG. REC. 12936 (1914) (statement of Sen. Reed) (“It is my opinion that if we employ the term “unfair competition” as it is employed in this bill, without adding anything to it, the courts will adopt as the meaning of Congress that meaning which has been affixed to the term by all of the law dictionaries and by a great many legal authorities.”). See also 51 CONG. REC. 12814 (1914) (statement of Sen. George Sutherland). 11 See E.I. du Pont de Nemours v. Fed. Trade Comm’n (Ethyl), 729 F.2d 128, 136 (2d Cir. 1984) (“Congress’ aim was to protect society against oppressive anti-competitive conduct and thus assure that the conduct prohibited by the Sherman and Clayton Acts would be supplemented as necessary and any interstices filled”) (citing H.R. REP. NO. 63-1142, at 19 (1914) (Conf. Rep.)); 51 CONG. REC. 11236 (1914) (statement of Sen. Cummins) (stating that the purpose of Section 5 was “to make some things punishable, to prevent some things, that cannot be punished or prevented under the antitrust law”).

12 H.R. REP. NO. 63-1142, at 19.

13 See id. at 18–19.

14 Id. at 19.

15 Id. at 2 (declaring “unfair and oppressive competition to be unlawful”); S. REP. NO. 63-597, at 17 (1914) (citing a previous version of the bill, S. 2941, which would allow the commission to revoke the registration of any corporation using “materially unfair or oppressive methods of competition”); 51 CONG. REC. 8861 (1914) (statement of Rep. Hinebaugh) (seeking to prevent “unfair or oppressive competition” and proceeding to list examples); id. at 8979 (statement of Rep. Murdock) (seeking to protect to protect “smaller, weaker business organizations from the oppressive and unfair competition of their more powerful rivals”); id. at 13117 (statement of Sen. Reed) (“intended to reach unfair, dishonest, crooked, oppressive, coercive acts. It is not intended to cover mere mistakes”).

Page 61

methods of competition, members of Congress had no difficulty identifying concrete examples.16 One congressman noted that when it comes to unfair methods of competition, “[t]here is that in the common sense of fairness and right dealing which indicates plainly the distinction between close bargaining and oppression.”17 Both the House and Senate also expressed a common understanding that unfair methods of competition encompassed conduct that tended to undermine “competitive conditions” in the marketplace.18

Congress evinced a clear aim that “unfair methods of competition” need not require a showing of current anticompetitive harm or anticompetitive intent in every case. First, the legislative history is replete with statements to the effect that Congress wanted the FTC to stop monopolies in their “incipiency.”19 Requiring the FTC to show current anticompetitive effects,

16 For instance, a Senate report referenced practices “such as local price cutting, interlocking directorates, and holding companies intended to restrain substantial competition.” S. REP. NO. 63-597, at 13. In considering what conduct should be prohibited, the House distinguished between “artificial bases” of monopolistic power and “natural bases.” See H.R. REP. NO. 63-533, at 23–25. The House viewed artificial bases of monopolistic power to include, for instance, the acceptance of rates or terms of service from common carriers not granted to other shippers; price discrimination not justified by differences in cost or distribution; procuring the secrets of competitors by bribery or any illegal means; procuring conduct on the part of employees of competitors inconsistent with their duties to their employers; making oppressive exclusive contracts; the maintenance of secret subsidiaries or secretly controlled agencies held out as independent; the destruction or material lessening of competition through the use of interlocking directorates; and the charging of exorbitant prices where the seller has a substantial monopoly. Id. Natural bases included control of natural resources, transportation facilities, financial resources, or any other economic condition inherent in the character of the industry, such as patent rights. Id. See also 51 CONG. REC. 11084–86 (1914) (statement of Sen. Newlands) (discussing jurisprudence on unfair competition); id. at 14928-14931 (statement of Rep. Covington) (discussing jurisprudence on unfair competition); id. at 11108 (statement of Sen. Newlands) (providing specific examples of unfair competition, such as local price cutting and organizing “bogus independent concerns . . . for the purpose of entering the field of the adversary and cutting prices with a view to his destruction[,]” among other things); id. at 11230 (statement of Sen. Robinson) (providing examples of unfair competition).

17 51 CONG. REC. 8979 (statement of Sen. Murdock).

18 See S. REP. NO. 1326, at 3–4 (stating that “Congress should maintain the policy established by the anti-trust law” to “‘maintain[ ] competitive conditions,” and that “every possible effort to create and preserve competitive conditions should be made”); id. at 2, 3-4, 11, & 13; S. REP. NO. 63-597, at 10 (“a commission is a necessary adjunct to the preservation of competition and to the practical enforcement of the law”); H.R. Rep. No. 63-533, at 2 (1914) (reported by Rep. Covington) (“The administration idea and the idea of business men generally, is for the preservation of proper competitive conditions in our great interstate commerce.”). The FTC Act’s legislative history makes it clear that Congress intended the statute to protect a broad array of market participants including workers and rival businesses. See 51 CONG. REC. 13312 (1914) (statement of Sen. Reed) (“it is not required to show restraint of trade or monopoly, but that the acts complained of hinder the business of another, or prohibit another from engaging in business, or restrain trade”); id. (statement of Sen. White) (“one of the main objects of this legislation is to prevent a rival in business from using unfair competition to drive his competitor out of business and to prevent this before the business is destroyed”); 51 CONG. REC. 8979 (1914) (statement of Rep. Murdock) (purpose of new Commission “is to protect the smaller, weaker business organizations from the oppressive and unfair competition of their more powerful rivals”). The goals of “protecting consumers against the high prices and [guarding] the interests of employees” were expressed by the House. See H.R. REP. NO. 533, 63d Cong., 2d Sess. 14 (1914) (quoting from the Preliminary Report of the Industrial Commission, submitted to Congress in 1900). See also 51 CONG. REC. 8854 (1914) (statement of Rep. Morgan) (among goals of Section 5 “to secure labor the highest wage, the largest amount of employment under the most favorable conditions and circumstances”). 19 H.R. REP. NO. 63-1142, at 19 (“[t]he most certain way to stop monopoly at the threshold is to prevent unfair competition”); 51 CONG. REC. 13118) (1914) (statement of Sen. Reed) (“the same class of conspiracies exactly as the Sherman Antitrust Act deals with, except that we propose to strike those acts in their incipiency instead of after

Page 62

which are typically seen only after the monopoly has passed the “embryonic” stage, would undercut Congress’s hope to prohibit unfair business practices prior to, or near, monopoly power.20 In addition, many of the practices listed by Congress as patently unfair do not automatically carry with them measurable effects.21 Second, in considering and rejecting a definition of “unfair methods of competition” that would have required a showing of intent, legislators noted that such a requirement would inappropriately restrict the new provision to the metes and bounds of the antitrust laws and place an undue burden on the Commission in proving its cases.22

Congress struck an intentional balance when it enacted the FTC Act. It allowed the Commission to proceed against a broader range of anticompetitive conduct than can be reached under the Clayton and Sherman Acts, but it did not establish a private right of action under Section 5, and it limited the preclusive effects of the FTC’s enforcement actions in private antitrust cases under the Sherman and Clayton Acts.23

they have been actually worked out into a complete system of monopoly or restraint of trade”); id. at 14941 (statement of Rep. Stevens) (noting that section five “[would] give to this commission the power of preventing in their conception and in their beginning some of these unfair processes in competition which have been the chief source of monopoly”); id. at 12030 (statement of Sen. Newlands) (remarking that a commission would “check monopoly in the embryo”); id. at 11455 (statement of Sen. Cummins) (stating that the new law would “seize the offender before his ravages have gone to the length necessary in order to bring him within the law that we already have”); id. at 11087 (statement of Sen. Newlands) (citing the Cummins Report, which anticipated that a commission “could be vastly more effectual than through the courts alone, which in most cases will take no cognizance of violations of the law for months or years after the violation occurred, and when the difficulty of awarding reparation for the wrong is almost insurmountable”).

20 51 CONG. REC. 13118 (statement of Sen. Reed) (declaring that Congress intended “to do something that will strike a death blow to monopoly. . . to arrest it in its infancy . . . [and] to strike those acts in their incipiency instead of after they have been actually worked out into a complete system of monopoly or restraint of trade.”); id. at 14927 (statement of Rep. Covington) (“the best and most, effective way to deal with the various practices of unfair or destructive competition which, if permitted to go on unchecked and uncontrolled, become potential for restraint of trade or monopoly”); id. at 14929 (statement of Rep. Covington) (“We are seeking . . . to deal, with those practices of unfair trade in their incipient stages which if left untrammeled and uncontrolled become the acts which constitute in their culmination restraint of trade and monopoly and the groundwork of the trusts which have menaced us industrially”).

21 51 CONG. REC. 12217 (statement of Sen. Newlands) (“all you would have to prove would be an unfair method whose tendency was to stifle competition.”); 51 CONG. REC. 13312 (statement of Sen. White) (stating that “one of the main objects of this legislation is to prevent a rival in business from using unfair competition to drive his competitor out of business and to prevent this before the business is destroyed” and that “the unfair acts and practices had to have the effect to destroy or unreasonably hinder the business of another would neutralize this useful feature of the enactment”); 51 CONG. REC. 13311 (statement of Sen. Cummins) (“if the effect is to restrain trade or to create a monopoly[,] we have a complete and perfect prohibition in the antitrust law”); 51 CONG. REC. 13312 (1914) (statement of Sen. Reed) (“it is not required to show restraint of trade or monopoly, but that the acts complained of hinder the business of another, or prohibit another from engaging in business, or restrain trade”); 51 CONG. REC. 8979 (statement of Rep. Murdock) (purpose of new Commission “is to protect the smaller, weaker business organizations from the oppressive and unfair competition of their more powerful rivals.”). 22 51 CONG. REC. 13311 (1914) (statement of Sen. Cummins) (“[t]here can be unfair competition in which the public is interested without any intent as described in the amendment”); id. (“[i]f the effect is to restrain trade or to create a monopoly we have a complete and perfect prohibition in the antitrust law”); id. at 13312 (statement of Sen. White) (“but we will have to carry the additional burden of proving the specific intent . . . [t]he proof of the specific intent with which an act was done is, as all lawyers know difficult to make”). 23 Treble damages are not available under the FTC Act. Civil penalties and Section 19’s monetary remedies are limited to unfair and deceptive acts or practices. See 15 U.S.C. § 45(m)(1)(A); 15 U.S.C. § 57b. A finding that

Page 63

The Supreme Court has affirmed this same broad view of the scope of Section 5 on numerous occasions.24 It has condemned coercive and otherwise facially unfair practices that have a tendency to stifle or impair competition.25 The federal circuit courts have likewise consistently held that the FTC’s authority extends not only to “the letter,” but also to “the spirit” of the antitrust laws.26

B.

Congress created the FTC as an expert body charged with elucidating the meaning of Section 5

Congress was careful and deliberate when it created the FTC, an independent agency. The five Commissioners would serve for terms of seven years, which would “give them an opportunity to acquire the expertness” needed to determine what constitutes an unfair method of competition.27 The Commission would provide guidance to the business community on the legality of business practices (including by issuing advisory opinions),28 serve as an aid to the courts,29 and act as an enforcer against unfair methods of competition.30 Congress gave the Commission powers to conduct quasi-judicial hearings,31 directly seek injunctive relief in federal court,32 pursue investigations, prepare reports, and make rules.33 To balance the Commission’s powers, Congress created checks to ensure that the FTC would be accountable to it34 and that the

conduct is an unfair method of competition under Section 5 is not given collateral estoppel effect in subsequent private antitrust actions. Holloway v. Bristol-Myers Corp., 485 F.2d 986 (D.C. Cir. 1973) (holding that private litigants cannot sue for violations of the FTC Act). See also 51 CONG. REC. 13115 (1914) (statement of Sen. Newlands) (“I do not believe in the principle, of assessing threefold damages.”); id. at 11317 (statement of Sen. McCumber) (moving to strike treble damages provision).

24 See supra, note 3.

25 Texaco, 393 U.S. at 225–26 (citing Atlantic Refining Co., 381 U.S. at 376). 26 Ethyl, 729 F.2d at 136–37 (citing Sperry & Hutchinson, 405 U.S. at 239); Grand Union Co. v. Fed. Trade Comm’n, 300 F.2d 92, 98–99 (2d Cir. 1962)). Cf., Chuck’s Feed & Seed Co. v. Ralston Purina Co., 810 F.2d 1289, 1292–93 (4th Cir. 1987) (describing Section 5 “as a kind of penumbra around the federal antitrust statutes”). 27 S. REP. NO. 63-597 at 11. See also id. at 11 (anticipating that the Commission would “build up a comprehensive body of information for the use and advantage of the Government and the business world”); id. at 22 (“we want trained experts; we want precedents; we want a body of administrative law built up.”). 28 See id. at 6–7 (citing an address by President Wilson, stating that “the business men of the country . . . desire the advice, the definite guidance and information which can be supplied by an administrative body.”); id. at 10 (anticipating that the Commission would “aid the business public.”). 29 See H.R. REP. NO. 63-533, at 8 (anticipating that the commission would use its investigatory powers in “aid of the courts.”).

30 S. REP. NO. 63-597, at 10 (anticipating that the Commission would have “sufficient power ancillary to the Department of Justice to aid materially and practically in the enforcement of the Sherman law and to aid the business public as well, and, incidentally, to build up a comprehensive body of information for the use and advantage of the Government and the business world”). See also H.R. REP. NO. 63-533, at 9. 31 15 U.S.C. § 45(b) (providing for adjudicatory hearings).

32 15 U.S.C. § 53(b).

33 Id. § 46(a),(b) (authorizing the Commission to investigate corporations and require reports); id. § 46(g) (authorizing the Commission to “make rules and regulations for the purpose of carrying out the provisions of this subchapter”); Nat’l Petroleum Refiners Ass’n v. Fed. Trade Comm’n, 482 F.2d 672, 673 (D.C. Cir. 1973) (holding that “the Federal Trade Commission is authorized to promulgate rules defining the meaning of the statutory standards of the illegality the Commission is empowered to prevent”). 34 See, e.g., 15 U.S.C. § 46(d),(f),(h) (requiring reports to Congress); Id. § 57a(f)(7) (requiring annual reports to Congress); Id. § 57b-2(d)(1)(A) (providing for disclosure of protected information to Congress). Congress also holds

Page 64

FTC’s decisions would be reviewable by federal courts of appeal.35 In the ensuing years, Congress has conducted vigorous oversight of the FTC and the courts have not hesitated to review Commission decisions.36

Congress intended for the FTC to be entitled to deference from the courts as an independent, expert agency.37 Over the years, courts have consistently held that FTC determinations as to what practices constitute an unfair method of competition deserve “great weight,”38 recognizing that the Commission is an expert agency, rather than “a carbon copy of the Department of Justice.”39

Even when courts have rejected the Commission’s factual conclusions, they have consistently reaffirmed the scope of its Section 5 authority.40 For example, Ethyl, Boise, and OAG cited prior decisions of the Supreme Court that affirm the distinctive scope of Section 5,41 but ultimately found that the particular facts at issue lacked evidence of unfairness, either “some indicia of oppressiveness”42 or some evidence that the conduct tended to negatively affect the market.43 All three appellate decisions reiterated the well-accepted principle that the Commission “is not confined to [the] letter” of the antitrust laws, and that “[i]t may bar incipient violations of

the FTC accountable though the budgetary, appointment, and oversight processes, and through numerous statutory enactments and amendments relating to the FTC’s powers over the course of the hundred-plus years since the passage of the Federal Trade Commission Act.

35 15 U.S.C. § 45(b). Respondents in adjudicative proceedings may receive judicial review of the Commission’s decision in their circuit of residence or any circuit where they committed the conduct underlying the alleged violation: an unusually expansive form of judicial oversight. See, e.g., J. Thomas Rosch Commissioner, Fed. Trade Comm’n, Three Questions About Part Three: Administrative Proceedings at the FTC, Remarks Before the American Bar Association Section of Antitrust Law Fall Forum, Washington, D.C. 18 (Nov. 8, 2012), https://www.ftc.gov/sites/default/files/documents/public_statements/three-questions-about-part-three-administrativeproceedings-ftc/121108fallforum.pdf.

36 See William E. Kovacic, The Federal Trade Commission and Congressional Oversight of Antitrust Enforcement, 17 TULSA L.J. 587, 623–27 (1982). See also Ethyl, 729 F.2d at 137; Boise Cascade Corp. v. Fed. Trade Comm’n, 637 F.2d 573, 581–82 (9th Cir. 1980); Official Airline Guides, Inc. v. Fed. Trade Comm’n (OAG), 630 F.2d 920, 927 (2d Cir. 1980).

37 S. REP. NO. 63-597 at 11, 22.

38 OAG, 630 F.2d at 927 (quoting Cement Institute, 333 U.S. at 720); Atlantic Refining Co., 381 U.S. at 368; Fed. Trade Comm’n v. R.F. Keppel & Bro., Inc., 291 U.S. 304, 314 (1934). See also Ind. Fed’n of Dentists, 476 U.S. at 455; Texaco, 393 U.S. at 226; Motion Picture Advert. Serv. Co., 344 U.S. at 396. 39 Fed. Trade Comm’n v. Dean Foods Co., 384 U.S. 597, 618–19 (1966) (Fortas, J., dissenting). See also 51 CONG. REC. 12146 (statement of Sen. Henry Hollis) (observing that the DOJ would be able to focus on “the great task of prosecuting suits for the dissolution of monopolies, leaving to the trade commission the important service of policing competition, so as to protect small business men, keep an open field for new enterprise, and prevent the development of trusts”).

40 See, e.g., Ethyl, 729 F.2d at 128; Boise, 637 F.2d at 573; OAG, 630 F.2d at 920. 41 Boise, 637 F.2d at 581; Ethyl, 729 F.2d at 136–37; OAG, 630 F.2d at 927. 42 Ethyl, 729 F.2d at 139 (holding that “before business conduct in an oligopolistic industry may be labelled “unfair” within the meaning of § 5 a minimum standard demands that, absent a tacit agreement, at least some indicia of oppressiveness must exist”); OAG, 630 F.2d at 927–28 (finding that the monopolist had “no purpose to restrain competition or to enhance or expand his monopoly, and [did] not act coercively”). 43Boise, 637 F.2d at 581 (finding that “without proof of anticompetitive effects” it could not assume that there was a “deliberate restraint on competition”). Boise’s applicability to cases outside the realm of delivered pricing is limited – the court’s decision was driven by the Commission’s inconsistent position on delivered pricing practices in prior statements, its shifting litigation strategy, and the Commission’s failure to meets its own standard. Id. at 575–77, 582.

Page 65

those statutes.”44 They also agreed that Section 5 reaches “conduct which, although not a violation of the letter of the antitrust laws, is close to a violation or is contrary to their spirit,”45 and further recognized the importance of deference to the Commission where it acts against conduct that is unfair.46

III.

Unfair Methods of Competition

Relying on the text, structure, legislative history of Section 5, precedent, and the FTC’s experience applying the law, this statement describes the most significant general principles concerning whether conduct is an unfair method of competition under Section 5 of the FTC Act.47

1.

The conduct must be a method of competition

Conduct must be a “method of competition” to violate Section 5. A method of competition is conduct undertaken by an actor in the marketplace—as opposed to merely a condition of the marketplace, not of the respondent’s making, such as high concentration or barriers to entry.48 The conduct must implicate competition, but the relationship can be indirect. For example, misuse of regulatory processes that can create or exploit impediments to competition (such as those related to licensing, patents, or standard setting) constitutes a method of competition.49 Conversely, violations of generally applicable laws by themselves, such as environmental or tax laws, that merely give an actor a cost advantage would be unlikely to constitute a method of competition.

2.

That is unfair

The method of competition must be unfair, meaning that the conduct goes beyond competition on the merits. Competition on the merits may include, for example, superior products or services, superior business acumen, truthful marketing and advertising practices,

44 Ethyl, 729 F.2d at 136. See also Boise, 637 F.2d at 581. 45 Ethyl, 729 F.2d at 136–37.

46 Ind. Fed’n Dentists, 476 U.S. at 454.

47 Whether the conduct violates accepted norms of unfairness derived from external standards expressed in statutes, common law, and regulations outside of the federal antitrust laws may also be relevant to whether the conduct is an unfair method competition. See Ind. Fed’n of Dentists, 476 U.S. at 454 (“The standard of “unfairness” under the FTC Act …encompass[es] not only practices that violate the Sherman Act and the other antitrust laws. . . but also practices that the Commission determines are against public policy for other reasons.”). See also Sperry & Hutchinson, 405 U.S. at 244; Motion Picture Advertising Co., 344 U.S. at 395; R.F. Keppel & Bro., 291 U.S. at 313. This framework will not be used to analyze matters that constitute a violation of the letter of the antitrust laws. 48 See Ethyl, 729 F.2d at139.

49 Statement of the Federal Trade Commission In the Matter of Google Inc., FTC File No. 121-0120 (Jan. 3, 2013), https://www.ftc.gov/system/files/documents/public_statements/410931/130103googlemotorolastmtofcomm.p df; Statement of the Federal Trade Commission In the Matter of Robert Bosch GmbH, FTC. File No. 121-0081 (Apr. 24. 2013); Analysis of Proposed Consent Decree to Aid in Public Comment: In the Matter of Negotiated Data Solutions, LLC, FTC File No. 051-0094 (Jan. 23, 2008); In re Dell Computer Corp., 121 F.T.C. 616 (1996) (consent order). Cf., Walker Process Eqpt., Inc. v. Food Machinery Corp., 382 U.S. 172 (1965) (fraud on the patent office may constitute antitrust violation).

Page 66

investment in research and development that leads to innovative outputs, or attracting employees and workers through the offering of better employment terms. 50

There are two key criteria to consider when evaluating whether conduct goes beyond competition on the merits. First, the conduct may be coercive, exploitative, collusive, abusive, deceptive, predatory, or involve the use of economic power of a similar nature.51 It may also be otherwise restrictive or exclusionary, depending on the circumstances, as discussed below. Second, the conduct must tend to negatively affect competitive conditions.52 This may include, for example, conduct that tends to foreclose or impair the opportunities of market participants, reduce competition between rivals, limit choice, or otherwise harm consumers.

These two principles are weighed according to a sliding scale. Where the indicia of unfairness are clear, less may be necessary to show a tendency to negatively affect competitive conditions.53 Even when conduct is not facially unfair, it may violate Section 5.54 In these circumstances, more information about the nature of the commercial setting may be necessary to determine whether there is a tendency to negatively affect competitive conditions. The size, power, and purpose of the respondent may be relevant, as are the current and potential future effects of the conduct.

The second principle addresses the tendency of the conduct to negatively affect competitive conditions—whether by affecting consumers, workers, or other market participants. In crafting Section 5, Congress recognized that unfair methods of competition may take myriad forms and hence that different types of evidence can demonstrate a tendency to interfere with competitive conditions. Because the Section 5 analysis is purposely focused on incipient threats to competitive conditions,55 this inquiry does not turn to whether the conduct directly caused

50 See generally U.S. v. Grinnell Corp., 384 U.S. 563, 571 (1966) (distinguishing unlawful acquisition or maintenance of monopoly power from consequences of “a superior product, business acumen, or historic accident”); U.S. v. Alum. Co. of America, 148 F.2d 416, 430 (2d Cir. 1945) (distinguishing conduct based on “superior skill, foresight and industry.”).

51 See e.g., Sperry & Hutchinson, 405 U.S. at 905 (construing Section 5 to reach conduct shown to exploit consumers, citing R.F. Keppel & Bro., 291 U.S. at 313); Atlantic Refining Co., 381 U.S. at 369 (finding an unfair method of competition where the defendant “utilize[ed] … economic power in one market to curtail competition in another,” which was “bolstered by actual threats and coercive practices”); Texaco, 393 U.S. at 228-29 (finding an unfair method of competition where the defendant used its “dominant economic power … in a manner which tended to foreclose competition”); Ethyl, 729 F.2d at 140 (finding that unfair methods of competition includes practices that are “collusive, coercive, predatory, restrictive, or deceitful” as well as “exclusionary”). 52 See, e.g., S. REP. NO. 1326, at 3–4 (1913) (stating that “Congress should maintain the policy established by the anti-trust law” to “‘maintain[ ] competitive conditions,” and that “every possible effort to create and preserve competitive conditions should be made”). Id. at 2, 3-4, 11, & 13; see also H.R. Rep. No. 63-533, at 2 (1914) (reported by Rep. Covington) (The administration idea and the idea of business men generally, is for the preservation of proper competitive conditions in our great interstate commerce”). 53 Ethyl, 729 F.2d at 137-39.

54 Hastings Mfg. Co. v. Fed. Trade Comm’n, 153 F.2d 253, 257 (6th Cir. 1946). 55 See generally supra notes 11 & 18. See also Fashion Originators’ Guild Am. v. Fed. Trade Comm’n (FOGA), 312 U.S. 457, 466 (1941) (holding that it was not determinative that petitioners had not yet “achieved a complete monopoly”; rather it was “sufficient if it really tends to that end, and to deprive the public of the advantages which flow from free competition”).

Page 67

actual harm in the specific instance at issue.56 Instead, the second part of the principle examines whether the respondent’s conduct has a tendency to generate negative consequences; for instance, raising prices, reducing output, limiting choice, lowering quality, reducing innovation, impairing other market participants, or reducing the likelihood of potential or nascent competition. These consequences may arise when the conduct is examined in the aggregate along with the conduct of others engaging in the same or similar conduct,57 or when the conduct is examined as part of the cumulative effect of a variety of different practices by the respondent.58 Moreover, Section 5 does not require a separate showing of market power or market definition when the evidence indicates that such conduct tends to negatively affect competitive conditions.59 Given the distinctive goals of Section 5, the inquiry will not focus on the “rule of reason” inquiries more common in cases under the Sherman Act, but will instead focus on stopping unfair methods of competition in their incipiency based on their tendency to harm competitive conditions.

IV.

Potential Cognizable Justifications

In the event that conduct prima facie constitutes an unfair method of competition, liability normally ensues under Section 5 absent additional evidence. There is limited caselaw on what, if any, justifications may be cognizable in a standalone Section 5 unfair methods of competition case, and some courts have declined to consider justifications altogether.60 In instances where a party chooses to assert justifications as an affirmative defense, the FTC can

56 See Sperry & Hutchinson, 405 U.S. at 244 (explaining that “unfair competitive practices [are] not limited to those likely to have anticompetitive consequences after the manner of the antitrust laws”); Ethyl, 729 F.2d at 138 (finding that evidence of actual harm can be “a relevant factor in determining whether the challenged conduct is unfair” but is not required); Boise, 637 F.2d at 581-82. In re Coca-Cola Co., 117 F.T.C. 795, 915 (1994) (rejecting argument that Section 5 violation requires showing “anticompetitive effects”). See also supra notes 19-21 and accompanying text (explaining that a showing of an actual anticompetitive injury is unnecessary to prove a violation of Section 5 because that section was designed to stop in their incipiency acts and practices that could lead to violations of the Sherman and Clayton Acts).

57 Motion Picture Advertising, 344 U.S. at 395.

58 Consent Order, Statement in Support of Consent, In the Matter of Intel Corp., File No. 061-0247 (Dkt. 9341) (July 28, 2010); The Vons Co., FTC Complaints and Order, 1987-1993 Transfer Binder, Trade Reg. Rep. (CCH) ¶ 23,200 (Aug. 7, 1992).

59 Atlantic Refining Co., 381 U.S. at 371 (“unnecessary to embark upon a full scale economic analysis of competitive effects.”); Texaco, 393 U.S. at 230 (holding that “[i]t is enough that the Commission found that the practice in question unfairly burdened competition for a not insignificant volume of commerce.”); L.G. Balfour Co. v. Fed. Trade Comm’n, 442 F.2d 1, 19-20 (7th Cir. 1971) (No proof of foreclosure necessary in an exclusive dealing contract case under Section 5 (citing Brown Shoe).

60 Atlantic Refining Co., 381 U.S. at 371 (considering the defendant’s argument that the distribution contracts at issue “may well provide Atlantic with an economical method of assuring efficient product distribution among its dealers” and nonetheless holding that the “Commission was clearly justified in refusing the participants an opportunity to offset these evils by a showing of economic benefit to themselves”); Texaco, 393 U.S. at 230 (following the same reasoning as Atlantic Refining and finding that the “anticompetitive tendencies of such system [were] clear”); Balfour, 442 F.2d at 15 (while relevant to consider the advantages of a trade practice on individual companies in the market, this cannot excuse an otherwise illegal business practice). For provisions of the antitrust laws where courts have not accepted justifications as part of the legal analysis, the Commission will similarly not accept justifications when these claims are pursued through Section 5.

Page 68

draw on the Commission’s long experience evaluating asserted justifications when enforcing Section 5, as well as its review of decided cases and past enforcement actions.61

First, it would be contrary to the text, meaning, and case law of Section 5 to justify facially unfair conduct on the grounds that the conduct provides the respondent with some pecuniary benefits.62 At the same time, some practices may impact competitive conditions in a manner that both harms and benefits market participants other than the party; at times, the harms and benefits may redound to the same participants, and at times they may be disparately distributed – that is, a practice may harm some market participants while simultaneously providing legitimate benefits to others.

If parties in these cases choose to assert a justification, the subsequent inquiry would not be a net efficiencies test or a numerical cost-benefit analysis. The unfair methods of competition framework explicitly contemplates a variety of non-quantifiable harms, and justifications and purported benefits may be unquantifiable as well. The nature of the harm is highly relevant to the inquiry; the more facially unfair and injurious the harm, the less likely it is to be overcome by a countervailing justification of any kind.63 In addition, whether harmed parties share in the purported benefits of the practice may be relevant to the inquiry.

Some well-established limitations on what defenses are permissible in an antitrust case apply in the Section 5 context as well. It is the party’s burden to show that the asserted justification for the conduct is legally cognizable,64 non-pretextual,65 and that any restriction used to bring about the benefit is narrowly tailored to limit any adverse impact on competitive

61 See supra § II (B) (discussing Congressional intent to create an expert Commission entitled to deference for its determinations).

62 Supra note 51.

63 See FOGA, 312 U.S. at 467-68 (finding the Commission did not need to hear evidence of justifications where “[t]he purpose and object of this combination, its potential power, its tendency to monopoly, the coercion it could and did practice upon a rival method of competition, all brought it within the policy of the prohibition declared by the Sherman and Clayton Acts”).

64 See, e.g. Ind. Fed. Dentists, 476 U.S. at 463 (making clear that justifications that run directly counter to the “basic policy of the Sherman Act,” in this instance, limiting consumer access to relevant information because “an unrestrained market in which consumers are given access to the information they believe to be relevant to their choices will lead them to make unwise, and even dangerous, choices” are not cognizable); id. at 464 (affirming Commission’s finding that there was insufficient evidence that the restraint conferred the claimed benefit at all). See also Fed. Trade Comm’n v. Superior Ct. Trial Lawyers Ass’n, 493 U.S. 411, 423-24 (1990); NCAA v. Board of Regents, 468 U.S. 85, 113-15 (1984); United States v. Addyston Pipe Steel Co. 85 F. 271 (6th Cir. 1898), aff’d 175 U.S. 211 (1899).

65 Pretextual justifications include those that are not set forth in documents prior to, or contemporaneous with, the introduction of the conduct, or not plausibly based on the known facts. See, e.g. Ind. Fed’n of Dentists, 476 U.S. at 464 (affirming the Commission’s finding that there was insufficient evidence that the restraint conferred the claimed benefit at all). See also United States v. Microsoft Corp., 253 F.3d 35, 62-64, 72, 74, 76-77 (D.C. Cir. 2001); Eastman Kodak Co. v. Image Technical Tech. Svcs, 504 U.S. 541, 472, 484-85 (1992); Aspen Skiing Co. v. Aspen Highlands Skiing Corp., 472 U.S. 585, 608-10 (1985); Texas Specialty Physicians v. Fed. Trade Comm’n, 528 F.3d 346, 368-70 (5th Cir. 2008); United States v. Dentsply Int’l, Inc., 399 F.3d 181, 196-97 (3d Cir. 2005). See also Fed. Trade Comm’n & U.S. Dep’t of Justice, Antitrust Guidelines for Collaboration Among Competitors §3.36a (2000) (2000 Collaboration Guidelines) (“Efficiency claims are not considered if they are vague or speculative or otherwise cannot be verified by reasonable means”).

Page 69

conditions.66 In addition, the asserted benefits must not be outside the market where the harm occurs.67 Finally, it is the party’s burden to show that, given all the circumstances, the asserted benefits outweigh the harm and are of the kind that courts have recognized as cognizable in standalone Section 5 cases.68

V.

Historical Examples of Unfair Methods of Competition

For the purpose of providing further guidance, the FTC lists here a non-exclusive set of examples and citations of past decisions and consent decrees based on Section 5, and, where applicable, other antitrust laws, focusing on conduct that constitutes an incipient violation of the antitrust laws or that violates the spirit of the antitrust laws. These illustrative examples are drawn from case law and from FTC experience.

A non-exclusive set of examples of conduct that have been found to violate Section 5 include:

• Practices deemed to violate Sections 1 and 2 of the Sherman Act or the provisions of the Clayton Act, as amended (the antitrust laws).69

• Conduct deemed to be an incipient violation of the antitrust laws. Incipient violations include conduct by respondents who have not gained full-fledged monopoly or market power, or by conduct that has the tendency to ripen into violations of the antitrust laws.70 Past examples of such use of Section 5 of the FTC Act include:

o invitations to collude,71

66 NCAA v. Alston, 141 S. Ct. 2141, 2162-64 (2021); Polygram Holding, Inc. v. Fed. Trade Comm’n, 416 F.3d 29, 38 (D.C. Cir. 2005); 2000 Collaboration Guidelines § 3.36b.

67 United States v. Philadelphia Nat’l Bank, 374 U.S. 321, 370-71 (1963); 2000 Collaboration Guidelines § 3.36a. 68 At all times, the burden of persuasion would remain with the Commission in administrative proceedings pursuant to 5 U.S.C. §556(d).

69 Motion Picture Advertising, 344 U.S. at 395 (conduct fell “within the prohibitions of the Sherman Act and is therefore an unfair method of competition within the meaning of s. 5(a).”); Cement Institute, 333 U.S. at 683; FOGA, 312 U.S. at 463; Fed. Trade Comm’n v. Pacific States Paper Trade Ass’n, 273 U.S. 52 (1926). 70 FOGA, 312 U.S. at 466 (FTC may challenge combinations “not merely in their fruition, but also in their incipiency combinations which could lead to . . .trade restraints and practices deemed undesirable”); Motion Picture Advertising, 344 U.S. at 394-95 (“[i]t is also clear that the Federal Trade Commission Act was designed to supplement and bolster the Sherman and the Clayton Act. . . to stop in their incipiency acts and practices which, when full blown, would violate those Acts.”); Cement Institute, 333 U.S. at 708; Triangle Conduit & Cable Co. v. Fed. Trade Comm’n, 168 F.2d 175, 181 (7th Cir. 1948).

71 The Commission has challenged both public and private invitations to collude as unfair methods of competition. This type of conduct, if consummated would constitute a per se violation of the antitrust laws. Invitations to collude, even if unaccepted, represent both an incipient violation as well as a violation of the spirit of the antitrust laws within the meaning of the 2022 Section 5 policy statement. Under either theory, an invitation to collude constitutes an unfair method of competition under Section 5. In Re Quality Trailer Products Corp., 115 F.T.C. 944 (1992) (consent); In re Valassis Communs., Dkt. C-4160, 2006 FTC LEXIS 25 (2006) (consent); In re A.E. Clevite, 116 F.T.C. 389 (1993) (consent); In re YKK (USA), 108 F.T.C. 628 (1993) (consent); In re Precision Moulding Co., 122 F.T.C. 104 (1996) (consent); In re Stone Container Corp., 125 F.T.C. 853 (1998) (consent); In re U-Haul Int’l, Inc., File No. 081-0157, 6 (2010) (consent); In re Delta/AirTran Baggage Fee Antitrust Litig., 245 F.Supp. 2d 1343,

Page 70

o mergers, acquisitions, or joint ventures that have the tendency to ripen into violations of the antitrust laws,72

o a series of mergers, acquisitions, or joint ventures that tend to bring about the harms that the antitrust laws were designed to prevent, but individually may not have violated the antitrust laws,73 and

o loyalty rebates, tying, bundling, and exclusive dealing arrangements that have the tendency to ripen into violations of the antitrust laws by virtue of industry conditions and the respondent’s position within the industry.74

• Conduct that violates the spirit of the antitrust laws. This includes conduct that tends to cause potential harm similar to an antitrust violation, but that may or may not be covered by the literal language of the antitrust laws or that may or may not fall into a “gap” in those laws.75 As such, the analysis may depart from prior precedent based on the provisions of the Sherman and Clayton Acts. Examples of such violations, to the extent not covered by the antitrust laws, include:

o practices that facilitate tacit coordination,76

o parallel exclusionary conduct that may cause aggregate harm,77

1369-70 (N.D. Ga. 2017), aff’d sub. Nom., Siegel v. Delta Air Lines, Inc., 714 F. App’x 986 (11th Cir. 2018), cert. denied, 139 S. Ct. 827 (2019). Depending on the circumstances, an invitation to collude may also constitute attempted monopolization under Section 2 of the Sherman Act, United States v. American Airlines, 743 F.2d 1114 (5th Cir. 1984), or wire fraud, United States v. Ames Sintering, 927 F.2d 232 (6th Cir. 1990). Under appropriate circumstances, the Commission will refer evidence of per se illegal cartel agreements to the Department of Justice for criminal prosecution. See Commission Statement Regarding Criminal Referral and Partnership Process, File No. P094207 (Nov. 18, 2021), https://www.ftc.gov/system/files/documents/public_statements/1598439/commission_statement_regarding_criminal _referrals_and_partnership_process_updated_p094207.pdf.

72 Yamaha Motor Co. v. Fed. Trade Comm’n, 657 F.2d 971 (8th Cir. 1981), cert. denied, 456 U.S. 915 (1982). 73 Vons, 1987-1993 Transfer Binder ¶ 23,200. Such series of acquisitions or related conduct may also constitute an unfair method competition as a violation of the spirit of the antitrust laws. See infra note 82 and cases cited therein. 74 Luria Bros. v. Fed. Trade Comm’n, 389 F.2d 847, 864 (3d Cir. 1968), cert. denied, 393 U.S. 829 (1968). 75 Remarks of Jon Leibowitz, Comm’r, Fed. Trade Comm’n, “Tales from the Crypt” Episodes ’08 and ’09: The Return of Section 5 (“Unfair Methods of Competition in Commerce are Hereby Declared Unlawful”), Section 5 Workshop, at 4 (Oct. 17, 2008), https://www.ftc.gov/sites/default/files/documents/public_events/section-5-ftc-actcompetition-statute/jleibowitz.pdf (“Simply put, consumers can still suffer plenty of harm for reasons not encompassed by the Sherman Act as it is currently enforced in the federal courts.”). 76 Cement Institute, 333 U.S. at 709-21 (multiple basing point pricing system contributed to unlawful coordinated pricing); Analysis to Aid Public Comment, In re BMG Music et. al, 65 Fed. Reg. 31,319 (2000), Docket No. C-3973 (2000) (Decision & Order) (distributors of pre-recorded music, acting in parallel but without agreement, impose identical coercive limits on retailer advertising of discounts). See generally William E. Kovacic, Antitrust Policy and Horizontal Collusion in the 21st Century, 9 LOY. CONSUMER L. REV. 97, 107 (1997) (“[T]he FTC remains perhaps the best vehicle for articulating standards designed to discourage anticompetitive coordination among competitors.”).

77 Leegin Creative Leather Prods., Inc. v. PSKS, Inc., 551 U.S. 877, 897 (2007) (holding that the extent of adoption of resale price maintenance across the industry is relevant to legality); Motion Picture Advertising, 344 U.S. at 395

Page 71

o conduct by a respondent that is undertaken with other acts and practices that cumulatively may tend to undermine competitive conditions in the market,78

o fraudulent and inequitable practices that undermine the standard-setting process or that interfere with the Patent Office’s full examination of patent applications,79

o price discrimination claims such as knowingly inducing and receiving disproportionate promotional allowances against buyers not covered by Clayton Act,80

o de facto tying, bundling, exclusive dealing, or loyalty rebates that use market power in one market to entrench that power or impede competition in the same or a related market,81

o a series of mergers or acquisitions that tend to bring about the harms that the antitrust laws were designed to prevent, but individually may not have violated the antitrust laws,82

o mergers or acquisitions of a potential or nascent competitor that may tend to lessen current or future competition,83

(“respondent and the three other major companies have foreclosed to competitors 75 percent of all available outlets.”); Standard Oil Co. of California v. United States, 337 U.S. 293, 309, 314 (1949) (taking into account extent of industry use of similar practices). See also C. Scott Hemphill & Tim Wu, Parallel Exclusion, 122 YALE L.J. 1182, 1243-45 (2012) (“parallel exclusion is a suitable subject for FTC enforcement under Section 5 of the FTC Act.”). 78 Intel Consent Order at 9341; Vons, 1987-1993 Transfer Binder ¶ 23,200. 79 U.S. DEP’T OF JUSTICE & FED. TRADE COMM’N, ANTITRUST GUIDELINES FOR THE LICENSING OF INTELLECTUAL PROPERTY § 6 (2017); In re American Cyanamid Co., 72 F.T.C. 623, 684-85, aff’d sub nom, Charles Pfizer & Co., 401 F.2d 574 (6th Cir. 1968), cert. denied, 394 U.S. 920 (1969) (actual or attempted enforcement of patents obtained by inequitable conduct falling short of fraud).

80 Alterman Foods v. Fed. Trade Comm’n, 497 F.2d 993 (5th Cir. 1974); Colonial Stores v. Fed. Trade Comm’n, 450 F.2d 733 (5th Cir. 1971); R.H. Macy & Co. v. Fed. Trade Comm’n, 326 F.2d 445 (2d Cir. 1964); American News Co. v. Fed. Trade Comm’n, 300 F.2d 104 (2d Cir. 1962); Grand Union Co. v. Fed. Trade Comm’n, 300 F.2d 92 (2d Cir. 1962); In re Foremost-McKesson, Inc., 109 F.T.C. 127 (1987). 81 Atlantic Refining Co., 381 U.S. at 357; Texaco, Inc., 393 U.S. at 223; Shell Oil Co. v. Fed. Trade Comm’n, 360 F.2d 470 (5th Cir. 1966); Brown Shoe, 384 U.S. at 316.

82 The Vons Cos., 1987-1993 Transfer Binder ¶ 23,200. Section 5 has also been used to challenge individual transactions that do not meet the technical requirements of Section 7. In re Beatrice Foods, 67 F.T.C. 473 (1965), supplemented, 68 F.T.C. 1003 (1965), modified, 71 F.T.C. 797 (1967); In re Dean Foods, Co., 70 F.T.C. 1146 (1966); In re Foremost Dairies, Inc., 60 F.T.C. 944 (1962).

83 See, e.g., Fed. Trade Comm’n v. Facebook, 581 F.Supp. 3d 34 (D.D.C. 2022) (denying motion to dismiss challenging acquisition of WhatsApp and Instagram); Analysis of Agreement Containing Consent Orders to Aid Public Comment, In the Matter of Novartis AG, File No. 141-0141 (consent decree requiring divestiture in transaction eliminating future competition in oncology compounds); Analysis of Agreement Containing Consent Orders to Aid Public Comment, In the Matter of Össur Americas Holdings, Inc., File No. 191-0177 (consent decree requiring divestiture in transaction eliminating future competition in myoelectric elbows). See also Fed. Trade Comm’n v. Procter & Gamble Co., 386 U.S. 568 (1967) (barring acquisition of leading firm where acquirer was most likely potential entrant). See generally PHILIP AREEDA & HERBERT HOVENKAMP, ANTITRUST LAW: AN ANALYSIS OF ANTITRUST PRINCIPLES AND THEIR APPLICATION ¶ 701at p. 200 (4th ed. 2015) (acquisition of “an

Page 72

o using market power in one market to gain a competitive advantage in an adjacent market by, for example, utilizing technological incompatibilities to negatively impact competition in adjacent markets,84

o conduct resulting in direct evidence of harm, or likely harm to competition, that does not rely upon market definition,85

o interlocking directors and officers of competing firms not covered by the literal language of the Clayton Act,86

o commercial bribery and corporate espionage that tends to create or maintain market power,87

o false or deceptive advertising or marketing which tends to create or maintain market power,88 or

actual or likely potential competitor is properly classified, for it tends to augment or reinforce the monopoly by means other than competition on the merits.”); C. Scott Hemphill & Tim Wu, Nascent Competitors, 168 U. PA. L. REV. 1879 (2020).

84 Eastman Kodak, 504 U.S. at 451; Newcal Industries v. Ikon Office Solution, 513 F.3d 1038 (9th Cir. 2008); SmithKline Corp. v. Eli Lilly & Co., 575 F.2d 1056 (3d Cir. 1978); LePage’s v. 3M Co., 324 F.3d 141 (3d Cir. 2003) (en banc).

85 Ind. Fed’n of Dentists, 476 U.S. at 460-61 (finding of sustained effects legally sufficient even in absence of elaborate market analysis); Toy’s “R” Us v. Fed. Trade Comm’n, 221 F.3d 928, 937 (7th Cir. 2000) (finding “sufficient proof of anticompetitive effects [such] that no more elaborate market analysis was necessary”). Cf., Fed. Trade Comm’n v. Staples, Inc., 970 F.Supp. 1066, 1075-6 (D.D.C. 1997) (relying in part on direct evidence that pricing for key products from office superstores lower where three such stores exist in same metropolitan area and higher where only one or two such stores present).

86 Perpetual Federal Savings & Loan, 90 F.T.C. 608 (1977) (complaint dismissed due to subsequent legislation). Cf., TRW, Inc. v. FTC, 647 F.2d 942 (9th Cir. 1981) (noting automatic nature of liability under Clayton §8 when prerequisites of statute established).

87 See Policy Statement of the Federal Trade Commission on Rebates and Fees in Exchange for Excluding Lower- Cost Drug Products (2022), at 6 n. 27 (“The Commission has a long history of addressing commercial bribery and will continue to do so.”), https://www.ftc.gov/legal-library/browse/policy-statement-federal-trade-commissionrebates-fees-exchange-excluding-lower-cost-drug-products; See Hon. Garland S. Ferguson, Jr., Chairman, Fed. Trade Comm’n, Commercial Bribery: An Address to the Conf. on Com. Bribery to the Comm. Standards Council and the Better Bus. Bureau of N.Y. (Oct. 17, 1930) (explaining the Commission’s focus on commercial bribery as an unfair method of competition even before it gained authority under the Robinson-Patman Act); see also Donald S. Clark, Sec’y, Fed. Trade Comm’n, Remarks Regarding The Robinson-Patman Act: Annual Update, Before the Robinson Patman Act Comm., Section of Antitrust Law, 46th Annual Spring Meeting (Apr. 2, 1998), See e.g., In re Lockheed Corp., 92 F.T.C. 968 (1978) (commercial bribery).

88 In re Coleco Industries, 111 F.T.C. 651 (1989) (consent decree barring claims of product availability unless actually available or company has reasonable basis for such claim); In re Xerox Corp., 86 F.T.C. 364 (1975) (repeated publicizing release date of new products with knowledge that products would not be available by that date); Analysis of Proposed Consent Order to Aid Public Comment: In the Matter of Intel Corp., Dkt No. 9341 at 5- 6 (describing acts of deception in Commission complaint). Cf, Microsoft, 253 F.3d at 76-77 (acts of deception relating to compatibility of Microsoft version of Java with competing software applications as unlawful monopoly maintenance under the Sherman Act). See generally Maurice E. Stucke, When a Monopolist Deceives, 76 ANTITRUST L.J. 823 (2010). See also DANIEL A. CRANE, THE INSTITUTIONAL STRUCTURE OF ANTITRUST ENFORCEMENT 138 (2011) (The Commission is on strongest ground when challenging market power created by fraud or deception).

Page 73

o discriminatory refusals to deal which tend to create or maintain market power.89

VI.

The Path Forward The FTC is committed to faithfully discharging its statutory obligations, including through enforcing and administering the prohibition against “unfair methods of competition” on a standalone basis, as laid out in Section 5 of the FTC Act, or in conjunction with its other statutory authorities.

89 Aspen, 472 U.S. at 610-11 (affirming antitrust liability for termination of joint venture where no legitimate business justification present for such conduct); Eastman Kodak, 504 U.S. at 483-85 (denying summary judgment where defendant manufacturer of copiers refused to deal with third party service providers); In re Grand Caillou Packing Co., 65 F.T.C. 799 (1964), aff’d in part and rev’d in part sub nom., LaPeyre v. Fed. Trade Comm’n, 366 F.2d 117 (5th Cir. 1966) (violation of Section 5 for monopoly manufacturer of shrimp peeling machines to lease machines at substantially different rates in different regions of the US); Analysis of Proposed Consent Order to Aid Public Comment: In the Matter of Intel Corp., Dkt No. 9341 at 4 (describing alleged threatens of refusal to deal with customers who purchased non-Intel CPUs). See generally Brett Frischmann & Spencer Weber Waller, Revitalizing Essential Facilities, 75 ANTITRUST L.J. 1 (2008).

Page 74

Policy Statement of the Federal Trade Commission on Biometric Information and Section 5 of the Federal Trade Commission Act1 The increasing use of consumers’ biometric information and related marketing of technologies that use or purport to use biometric information (“biometric information technologies”)2 raise significant concerns with respect to consumer privacy, data security, and the potential for bias and discrimination. The Federal Trade Commission is committed to combatting unfair or deceptive acts related to the collection and use of consumers’ biometric information and the marketing and use of biometric information technologies. As used in this document, the term “biometric information” refers to data that depict or describe physical, biological, or behavioral traits, characteristics, or measurements of or relating to an identified or identifiable person’s body. Biometric information includes, but is not limited to, depictions, images, descriptions, or recordings of an individual’s facial features, iris or retina, finger or handprints, voice, genetics, or characteristic movements or gestures (e.g., gait or typing pattern). Biometric information also includes data derived from such depictions, images, descriptions, or recordings, to the extent that it would be reasonably possible to identify the person from whose information the data had been derived. By way of example, both a photograph of a person’s face and a facial recognition template, embedding, faceprint, or other data that encode measurements or characteristics of the face depicted in the photograph constitute biometric information.

Recent years have seen a proliferation of biometric information technologies. For instance, facial, iris, or fingerprint recognition technologies collect and process biometric information to identify individuals. Other biometric information technologies use or purport to use biometric information in order to determine characteristics of individuals, ranging from the individuals’ age, gender, or race to the individuals’ personality traits, aptitudes, or demeanor. Many biometric information technologies are developed using machine learning or similar datadriven processes that require large quantities of biometric information for “training” or testing purposes.

The Commission has been analyzing consumer protection issues related to biometric information for over a decade. Among other examples,3 in 2011, as the commercial use of facial 1 This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates one or more existing statutory or regulatory requirements. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action under the FTC Act or other statutes. Pursuant to the Congressional Review Act (5 U.S.C. § 801 et seq.), the Office of Information and Regulatory Affairs designated this Policy Statement as not a “major rule,” as defined by 5 U.S.C. § 804(2).

2 In some contexts, the terms “biometrics” or “biometric technologies” have been used to refer specifically to technologies that are used to identify individuals. We use the term “biometric information technologies” to refer to the broader category of all technologies that use or purport to use biometric information for any purpose. 3 See, e.g., Press Release, FTC, FTC to Host Identity Authentication Workshop (Feb. 21, 2007) https://www.ftc.gov/news-events/news/press-releases/2007/02/ftc-host-identity-authentication-w (announcing a public workshop on topics including biometrics and other emerging authentication technologies); You Don’t Say: An FTC Workshop on Voice Cloning Technologies, FTC (Jan. 28, 2020), https://www.ftc.gov/news­ events/events/2020/01/you-dont-say-ftc-workshop-voice-cloning-technologies.

Page 75

recognition technology began to take off, the FTC hosted a public workshop, “Face Facts: A Forum on Facial Recognition Technology.”4 The workshop brought together stakeholders from government, academia, and industry to discuss the then-current capabilities and commercial uses of facial recognition technology, as well as potential consumer benefits of and privacy and security concerns about such technology. Following the workshop, in 2012, the FTC published a report entitled “Facing Facts: Best Practices For Common Uses of Facial Recognition Technologies.”5 Since 2012, some biometric information technologies, such as facial recognition technology, have made significant advances. For example, NIST found that between 2014 and 2018, facial recognition became 20 times better at finding a matching photograph from a database.6 Such improvements are due in significant part to advancements in machine learning,7 along with data collection, storage, and processing capabilities sufficient to support the use of these technologies.8 Simultaneously, many biometric information technologies have become less expensive to deploy.9 Owing in part to these developments, the use of biometric information technologies is increasingly pervasive. For example, the use of facial recognition and other biometric information technologies in physical locations – such as retail stores, arenas, airports, and other venues – is reportedly growing.10 4 FTC, FACE FACTS: A FORUM ON FACIAL RECOGNITION TECHNOLOGY (Dec. 8, 2011), https://www.ftc.gov/news­ events/events/2011/12/face-facts-forum-facial-recognition-technology. 5 FTC, FACING FACTS: BEST PRACTICES FOR COMMON USES OF FACIAL RECOGNITION TECHNOLOGIES (Oct. 2012), https://www.ftc.gov/reports/facing-facts-best-practices-common-uses-facial-recognition-technologies. Recommendations in this report remain relevant, such as reasonable data security protections for biometric information and appropriate data retention and disposal policies and procedures. 6 NAT’L INSTITUTE FOR STANDARDS AND TECH., FACE RECOGNITION VENDOR TEST (FRVT) PART 2: IDENTIFICATION 6 (2018), https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8238.pdf; See also NIST, Press Release, NIST Evaluation Shows Advance in Face Recognition Software’s Capabilities (Nov. 30, 2018) https://www.nist.gov/news-events/news/2018/11/nist-evaluation-shows-advance-face-recognition-softwares­ capabilities.

7 See id.

8 See A.K. Jain et al., 50 years of biometric research: Accomplishments, challenges, and opportunities, Pattern Recognition Letters 79 (2016) 100 (stating that “exponential improvements in computing and storage have enabled the deployment of more powerful algorithms to process the captured biometric data” and discussing how, “cloud­ based biometrics can facilitate rapid analytics (e.g., recognizing a face using a smartphone camera, where the phone accesses the cloud).”) 9 See id. (“[E]xponential improvements in the performance and cost of processors and memory have already played a dominant role in the development of better biometric sensors. . . . In the case of biometric recognition, the direct impact of the rapid improvements in [integrated circuits] is the development of smaller, cheaper, and higher quality biometric sensors.”).

10 See, e.g., National Retail Federation and Loss Prevention Research Council, 2022 Retail Security Survey: The State of National Retail Security and Organized Retail Crime, 17, https://nrf.com/research/national-retail-security­ survey-2022 (stating that 12.3% of respondents were implementing or planning to implement facial recognition for loss prevention); Fast, Frictionless Biometric Payments Gaining Ground in Grocery Stores, PYMNTS (May 24, 2022) https://www.pymnts.com/news/retail/2022/grocery-stores-will-be-big-winners-this-holiday-season/; Aaron Mok, These 16 US airports are reportedly testing facial recognition technology on passengers that could roll out nationwide next year, BUSINESS INSIDER (Dec. 6, 2022) https://www.businessinsider.com/these-16-us-airports-are­ reportedly-testing-facial-recognition-tech-2022-12; Kashmir Hill and Corey Kilgannon, Madison Square Garden Uses Facial Recognition to Ban Its Owner’s Enemies, NYTIMES (Dec. 22, 2022) https://www.nytimes.com/2022/12/22/nyregion/madison-square-garden-facial-recognition.html; Randy Wimbley and David Komer, Black teen kicked out of skating rink after facial recognition camera misidentified her,

Page 76

During this same time period, the use of facial recognition and other biometric information technologies and the risks they pose have been the focus of significant public scrutiny and concern both in the U.S.11 and abroad.12 U.S. states and localities have passed laws specifically focused on regulating the commercial use of facial recognition and other biometric information technologies.13 The requirements in these laws vary – for example, banning the use of facial recognition in certain locations,14 requiring signs at the entrances of commercial establishments that collect biometric identifiers,15 or requiring consent to collect biometric information.16 In 2019 and 2021, the Commission also brought enforcement actions against companies that allegedly misrepresented their use of facial recognition technology.17 Consumers, businesses, and society now face new and increasing risks associated with the collection and use of biometric information. For example, biometric information can be used for the production of counterfeit videos or voice recordings (so-called “deepfakes”) that would allow bad actors to convincingly impersonate individuals in order to commit fraud or to defame or harass the individuals depicted.18 Large databases of biometric information may also be attractive targets for malicious actors because of the information’s potential to be used for other FOX2DETROIT (July 14, 2021) https://www.fox2detroit.com/news/teen-kicked-out-of-skating-rink-after-facial­ recognition-camera-misidentified-her.

11 See, e.g., Privacy in the Age of Biometrics: Hearing Before the Subcomm. On Investigations and Oversight of the H. Comm. On Science, Space, and Technology (2022), https://www.congress.gov/event/117th-congress/house­ event/114964?s=1&r=8; Facial Recognition Technology (Part III): Ensuring Commercial Transparency & Accuracy: Hearing Before the House Committee on Oversight and Government Reform (2020), https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=110380; Rebecca Koenig, New Advocacy Campaign Calls for Banning Facial Recognition on College Campuses, EDSURGE (Jan. 22, 2020), https://www.edsurge.com/news/2020-01-22-new-advocacy-campaign-calls-for-banning-facial-recognition-on­ college-campuses.

12 See, e.g., Proposal for a Regulation Laying Down Harmonized Rule on Artificial Intelligence, European Commission, 2021 O.J. (C 206), https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-laying-down­ harmonised-rules-artificial-intelligence; Global Privacy Assembly, Adopted Resolution on Facial Recognition Technology, (2020), https://edps.europa.eu/sites/default/files/publication/final_gpa_resolution_on_facial_recognition_technology_en.pdf 13 See, e.g., Washington Biometric Privacy Protection Act, Wash. Rev. Code § 19.375 (2022) (effective July 23, 2017); Prohibit the Use of Face Recognition Technologies by Private Entities in Places of Public Accommodation in the City of Portland, PORTLAND, OR., CITY CODE Chapter 34.10 (2022) (effective Jan. 1, 2021); Biometric Identifier Information, NEW YORK, N.Y., ADMIN. CODE §§ 22-1201 – 1205 (2023) (effective July 9, 2021). Even prior to 2012, two states, Illinois and Texas, had enacted biometric privacy laws. See Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14 (effective Oct. 3, 2008); Texas Capture or Use of Biometric Identifier, Tex. Bus. & Com. Code § 503.001 (effective Apr. 1, 2009). Additionally, states’ comprehensive privacy laws address biometric information. See, e.g., Colorado Privacy Act, 2021 Colo. Legis. Serv. Ch. 483 (S.B. 21-190) (West) (effective July 1, 2023).

14 PORTLAND, OR., CITY CODE Chapter 34.10 (prohibiting use of face recognition technologies by private entities in places of public accommodation).

15 NEW YORK, N.Y., ADMIN. CODE § 22-1202(a).

16 740 Ill. Comp. Stat. 14/15(b).

17 Complaint, In re Everalbum, FTC File No. 1923172 (May 6, 2021); Complaint, United States v. Facebook, No. 19-cv-2184 (D.D.C. July 24, 2019).

18 For example, in 2020, the Commission hosted a workshop to address the potential benefits and risks to consumers of technology that allows researchers to create a near-perfect voice clone with less than a five second recording of a person’s voice. FTC, You Don’t Say: An FTC Workshop on Voice Cloning Technologies (Jan. 28, 2020), https://www.ftc.gov/news-events/events/2020/01/you-dont-say-ftc-workshop-voice-cloning-technologies.

Page 77

illicit purposes, including to achieve further unauthorized access to devices, facilities or data.19 These issues pose risks not only to individual consumers, but also to businesses and society.20 Even outside of fraud, uses of biometric information or biometric information technology can pose significant risks to consumers. For instance, using biometric information technologies to identify consumers in certain locations could reveal sensitive personal information about them—for example, that they have accessed particular types of healthcare, attended religious services, or attended political or union meetings.21 Moreover, without clear disclosures and meaningful choices for consumers about the use of biometric information technologies, consumers may have little way to avoid these risks or unintended consequences of these technologies.22 Some technologies using biometric information, such as facial recognition technology, may perform differently across different demographic groups in ways that facilitate or produce discriminatory outcomes. For example, research published by the National Institute of Standards and Technology (NIST) found that many facial recognition algorithms produce significantly more false positive “matches” for images of West and East African and East Asian faces than for images of Eastern European faces.23 The research also found rates of false positives to be higher 19 See, e.g., Joseph Cox, How I Broke Into a Bank Account With an AI-Generated Voice, Motherboard, VICE (Feb. 23, 2023), https://www.vice.com/en/article/dy7axa/how-i-broke-into-a-bank-account-with-an-ai-generated-voice; Parmy Olson, Faces Are the Next Target for Fraudsters, WALL STREET JOURNAL (July 7, 2021), https://www.wsj.com/articles/faces-are-the-next-target-for-fraudsters-11625662828 (reporting, among other things, the successful hack of a Chinese facial recognition system by fraudsters who uploaded videos they had created from high-definition photographs purchased on the black market). Researchers have reportedly demonstrated techniques for replicating and using non-face biometric identifiers such as fingerprints to circumvent access controls. See, e.g., Alex Hern, Hacker fakes German minister's fingerprints using photos of her hands, THE GUARDIAN (Dec. 30, 2014), https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of­ her-hands. Unauthorized access could also be achieved using synthetic identifiers created by combining biometric information about a large number of individuals. See Philip Bontrager et al., DeepMasterPrint: Generating Fingerprints for Presentation Attacks (2017), https://www.researchgate.net/publication/317061803_DeepMasterPrint_Generating_Fingerprints_for_Presentation_ Attacks.

20 See, e.g., 50 years of biometric research: Accomplishments, challenges, and opportunities, Pattern Recognition Letters 79 (2016) 80–105 (discussing that “biometric system[s] may be vulnerable to a number of security threats . . . which may eventually affect the security of the end application.”); Bobby Chesney and Danielle Citron, Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security, 107 California Law Review 1753, 1758 (2018) (discussing that some harms of deepfakes may be “distortion of policy debates, manipulation of elections, erosion of trust in institutions, exacerbation of social divisions, damage to national security, and disruption of international relations.”).

21 See FTC, FACING FACTS: BEST PRACTICES FOR COMMON USES OF FACIAL RECOGNITION TECHNOLOGIES, supra n.4, at ii (recommending that businesses consider the sensitivity of information that may be collected by facial recognition systems in light of the locations in which the systems operate). 22 See generally FTC, FACING FACTS: BEST PRACTICES FOR COMMON USES OF FACIAL RECOGNITION TECHNOLOGIES, supra n.4, at iii (summarizing recommendations about providing clear notice and choices to consumers about the use of facial recognition technology).

23 See FRVT Demographic Effects in Face Recognition, NAT’L INSTITUTE FOR STANDARDS AND TECH., https://pages.nist.gov/frvt/html/frvt_demographics.html (last accessed Aug. 31, 2022); NAT’L INSTITUTE FOR STANDARDS AND TECH., FACE RECOGNITION VENDOR TEST (FRVT) PART 8: SUMMARIZING DEMOGRAPHIC DIFFERENTIALS (2022), https://pages.nist.gov/frvt/reports/demographics/nistir_8429.pdf; NAT’L INSTITUTE FOR STANDARDS AND TECH., FACE RECOGNITION VENDOR TEST (FRVT) PART 3: DEMOGRAPHIC EFFECTS 2 (2019), https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf.

Page 78

in women than men, and in the elderly and children compared to middle-aged adults.24 Demographic differentials may be even more pronounced when analyzed intersectionally (e.g., when comparing light-skinned males to dark-skinned females, rather than simply males to females and light-skinned subjects to dark-skinned subjects).25 Similarly, some biometric information technologies, such as those that process facial images or voice recordings, may be particularly prone to error when the subject of the analysis is a person with a disability.26 In light of this potential for bias, such technologies can lead or contribute to harmful or unlawful discrimination. This is particularly concerning when such technologies are used to determine whether consumers can receive important benefits and opportunities or are subject to penalties or less desirable outcomes. For example, if biometric information technologies are used to provide access to financial accounts, a false negative may result in the consumer being denied access to their own account, whereas a false positive may result in an identity thief gaining access to the account.27 If biometric information technologies are used for security surveillance, false positives may result in individuals being falsely accused of crimes, subjected to searches or questioning, or denied access to physical premises.

In light of the evolving technologies28 and risks to consumers, the Commission sets out below a non-exhaustive list of examples of practices it will scrutinize in determining whether companies collecting and using biometric information or marketing or using biometric information technologies are complying with Section 5 of the FTC Act.29 24 Id.

25 See, e.g., Joy Buolamwini and Timnit Gebru, Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification, 81 Proceedings of Machine Learning Research 1, 11 (2018) (assessing commercial gender classification systems and finding that all three performed worst for females with darker skin tones). 26 See, e.g., U.S. EQUAL EMP. OPPORTUNITY COMM’N, EEOC-NVTA-2022-2, THE AMERICANS WITH DISABILITIES ACT AND THE USE OF SOFTWARE, ALGORITHMS, AND ARTIFICIAL INTELLIGENCE TO ASSESS JOB APPLICANTS AND EMPLOYEES (2022), https://www.eeoc.gov/laws/guidance/americans-disabilities-act-and-use-software-algorithms­ and-artificial-intelligence (noting the potential that technologies analyzing the voice will be less accurate for individuals with speech impediments); SELIN E. NUGENT ET AL., INST. FOR ETHICAL A.I., RECRUITMENT AI HAS A DISABILITY PROBLEM: QUESTIONS EMPLOYERS SHOULD BE ASKING TO ENSURE FAIRNESS IN RECRUITMENT 12 (2020) (noting practical considerations that may affect the accuracy of facial analysis technology for individuals with certain disabilities).

27 See generally, Joseph Cox, How I Broke Into a Bank Account With an AI-Generated Voice, Motherboard, VICE (Feb. 23, 2023), https://www.vice.com/en/article/dy7axa/how-i-broke-into-a-bank-account-with-an-ai-generated­ voice.

28 In some instances, biometric information technologies may utilize algorithms and/or artificial intelligence. The guidance below is consistent with and builds on previous publications by the Commission and Commission staff on those topics. See, e.g., FTC, COMBATTING ONLINE HARMS THROUGH INNOVATION (June 2022); FTC, BIG DATA A TOOL FOR INCLUSION OR EXCLUSION? UNDERSTANDING THE ISSUES (Jan. 2016); Elisa Jillson, Aiming for truth, fairness, and equity in your company’s use of AI, FTC: BUS. BLOG (Apr. 19, 2021) https://www.ftc.gov/business­ guidance/blog/2021/04/aiming-truth-fairness-equity-your-companys-use-ai; Andrew Smith, Using Artificial Intelligence and Algorithms, FTC: BUS. BLOG (Apr. 8, 2020), https://www.ftc.gov/business­ guidance/blog/2020/04/using-artificial-intelligence-algorithms. 29 Other laws and regulations enforced by the Commission, including but not limited to the Children’s Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) and its implementing Rule (16 C.F.R. Part 312), the Health Breach Notification Rule (16 C.F.R. Part 318), and the Gramm-Leach-Bliley Act’s Safeguards Rule (16 C.F.R. Part 314) and Regulation P (12 C.F.R. Part 1016), may also govern the collection, use, or storage of biometric information.

Page 79

Deception  False or unsubstantiated marketing claims relating to the validity, reliability, accuracy, performance, fairness, or efficacy of technologies using biometric information As with other types of technologies, false or unsubstantiated marketing claims relating to the validity, reliability, accuracy, performance, fairness, or efficacy of technologies using biometric information constitute deceptive practices in violation of Section 5 of the FTC Act.30 These claims can mislead both individual consumers and businesses that use these technologies. If prospective users rely on false or unsubstantiated claims in choosing one product over another, honest technology vendors who do not oversell their product’s capabilities may be placed at a competitive disadvantage. Moreover, if business customers rely on these claims to use technologies that don’t work as promised, they may ultimately harm consumers by, for instance, wrongly denying them benefits and opportunities. Thus, the Commission intends to carefully scrutinize claims about these technologies.

As with all marketing claims, the law requires that representations about biometric information technologies be substantiated when made—that is, persons or individuals making such claims must have a reasonable basis for their claims.31 For example, businesses should be careful not to make false or unsubstantiated claims that technologies are unbiased. Claims of validity or accuracy are deceptive if they are true only for certain populations and if such limitations are not clearly stated.32 Further, businesses must not make false or unsubstantiated claims about real-world validity, accuracy, or performance of biometric information technologies when the claims are based on tests or audits that do not replicate real-world conditions or how the technology will be operationalized by its intended users.33 Businesses also should not make false or unsubstantiated claims that the technologies will deliver particular results or outcomes, such as reductions in rates of theft, violent incidents, fraud, or the elimination of bias in hiring.34 30 See Complaint, FTC v. Aura Labs, Inc., No. 8:16-cv-2147 (C.D. Cal. Dec. 2, 2016) (alleging company’s representations that mobile application measured blood pressure with accuracy comparable to a traditional blood pressure cuff were false, misleading, or unsubstantiated); Complaint, FTC v. New Consumer Solutions, LLC, No. 1:15-cv-01614 (N.D. Il. Feb. 23, 2015) (alleging company’s representations that a mobile application could detect melanoma by analyzing pictures of consumers’ skin were false or unsubstantiated). 31 See, e.g., FTC Policy Statement Regarding Advertising Substantiation, appended to In re Thompson Med. Co., Inc., 104 F.T.C. 648, 839 (1984), aff’d, 791 F.2d 189 (D.C. Cir. 1986). Where a company’s claims of accuracy, efficacy, or lack of bias refer to specific facts or figures, they must generally be supported by a high level of substantiation, such as scientific or engineering tests. See also Thompson Med., 104 F.T.C. at 822. 32 See, e.g., Complaint, In re Everalbum, FTC File No. 1923172 (May 6, 2021) (alleging company’s representations that it was not using facial recognition unless user enabled it were deceptive, where the representations were true only for users in Texas, Illinois, Washington, and the European Union, and users outside of those locations were not provided a setting to turn off facial recognition); In re J.B. Williams Co., Inc., 68 F.T.C. 481, 1965 WL 92965, *5 (1965), aff’d, 381 F.2d 884 (6th Cir. 1967) (claims that product could reduce fatigue were deceptive, where product was efficacious only in a small minority of cases where tiredness symptoms were due to an iron deficiency, and was of no benefit in all other cases).

33 See Opinion of the Commission at 43-46, In re ECM Biofilms, Inc., FTC File No. 1223118 (Oct. 19, 2015) (laboratory tests performed under aerobic conditions were not competent and reliable evidence of biodegradation in landfills, which are anaerobic environments), aff’d, 851 F.3d 599 (6th Cir. 2017). 34 Claims that “significantly involve. . . safety,” as well as claims relating to the performance or other central characteristics of a product or service, are generally material. FTC Policy Statement on Deception (Oct. 14, 1983), appended to Cliffdale Associates, Inc., 103 F.T.C. 110, 174 (1984). See also Complaint, In re Tapplock, FTC File

Page 80

 Deceptive statements about the collection and use of biometric information False or misleading statements about the collection and use of biometric information constitute deceptive acts in violation of Section 5 of the FTC Act, as does failing to disclose any material information needed to make a representation non-misleading. In recent years, the Commission has taken action against businesses that it charged with engaging in deceptive practices related to the collection and use of biometric information.35 The Commission will continue to carefully scrutinize businesses’ conduct in this area to ensure they are not misleading consumers. Businesses should not make false statements about the extent to which they collect or use biometric information or whether or how they implement technologies using biometric information.36 Businesses also must ensure that they are not telling half-truths—for example, a business should not make an affirmative statement about some purposes for which it will use biometric information but fail to disclose other material uses of the information.37 Unfairness The use of biometric information or biometric information technology may be an unfair practice within the meaning of the FTC Act. Under Section 5, a practice is unfair if it causes or is likely to cause substantial injury to consumers that is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or competition.38 As discussed above, the collection and use of biometric information can create a serious risk of harm to consumers. Such harms are not reasonably avoidable by consumers if the collection and use of such information is not clearly and conspicuously disclosed or if access to essential goods and services is conditioned on providing the information. For instance, if businesses automatically and surreptitiously collect consumers’ biometric information as they enter or move through a store, the consumers have no ability to avoid the collection or use of that information. Our past cases illustrate that collecting, retaining, or using consumers’ personal information in ways that cause or are likely to cause substantial injury, or disseminating No. 1923011 (May 18, 2020) (alleging that representations that smart padlock was secure were deceptive, where padlock had foreseeable information security vulnerabilities and could be quickly unlocked by unscrewing the back panel); Complaint, FTC v. Lifelock, Inc., No. 2:10-cv-00530-MHM (D. Az. Mar. 8, 2010) (alleging that representations that service provided complete protection against all forms of identity theft were deceptive). 35 See Complaint, In re Everalbum, FTC File No. 1923172 (May 6, 2021) (alleging that the company misrepresented that it was not using face recognition unless the user enabled it or turned it on); See also Complaint, United States v. Facebook, No. 19-cv-2184 (D.D.C. July 24, 2019) (alleging that the company misrepresented that users would have to “turn[ ] on” facial-recognition technology, violating a provision of a prior Commission order that prohibited misrepresenting the extent to which users could control the privacy of their data). 36 Id.

37 See Complaint, United States v. Twitter, No. 3:22-cv-03070 (N.D. Cal. May 25, 2022) (alleging that statements that users’ telephone numbers provided for two-factor authentication would be used for security purposes were deceptive when the company failed to adequately disclose that such numbers would also be used for targeted advertising); Complaint, In re Sears Holdings Mgmt. Corp., FTC File No. 082 3099 (Aug. 31, 2009) (alleging that respondents’ statement that they would track consumers’ “online browsing” was deceptive in light of failure to adequately disclose tracking of nearly all of the Internet behavior occurring on consumers’ computers as well as certain non-Internet related activities taking place on those computers). 38 15 U.S.C. § 45(n); see also Letter from the FTC to Hon. Wendell Ford & Hon. John Danforth, Ranking Minority Member, S. Comm. on Com., Sci. & Transp., Consumer Subcomm., Comm’n Statement of Pol’y on the Scope of Consumer Unfairness Jurisdiction (Dec. 17, 1980), reprinted in In re Int’l Harvester Co., 104 F.T.C. 949, 1070, 1073 (1984) (the “Unfairness Policy Statement”).

Page 81

technology that enables others to do so without taking reasonable measures to prevent harm to consumers can be an unfair practice in violation of Section 5 of the FTC Act.39 For example, the FTC has previously charged that businesses have engaged in unfair practices by failing to protect consumers’ personal information using reasonable data security practices; by engaging in invasive surveillance, tracking, or collection of sensitive personal information that was concealed from consumers or contrary to their expectations;40 by, in certain circumstances, implementing privacy-invasive default settings;41 by disseminating an inaccurate technology that, if relied on by consumers, could endanger them or others;42 and by offering for sale technologies with the potential to cause or facilitate harmful and illegal conduct like covert tracking, and failing to take reasonable measures to prevent such conduct.43 Additionally, the FTC has charged that certain discriminatory practices can be unfair.44 Though many biometric information technologies are new, businesses must continue to abide by longstanding legal requirements and obligations. In order to avoid liability under the FTC Act, businesses should implement reasonable privacy and data security measures to ensure that any biometric information that they collect or maintain is protected from unauthorized access—whether that access stems from an external 39 See generally, Privacy and Security, FTC (last visited Mar. 29, 2023 11:28 AM), https://www.ftc.gov/business­ guidance/privacy-security (collecting the FTC’s published business guidance related to data privacy and security). 40 See, e.g., Complaint, In re Lenovo, Inc., FTC File No. 1523134 3134 (Dec. 20, 2017) (alleging that preinstallation of ad-injecting software that, without adequate notice or informed consent, acted as a man-in-the-middle between consumers and all websites with which they communicated was unfair; and that failure to take reasonable measures to assess and address security risks created by the preinstalled software was unfair); Complaint, FTC v. Vizio, Inc. Case No. 2:17-cv-00758 (D.N.J. Feb. 6, 2017) (alleging that collection of sensitive television viewing activity without consent and contrary to consumer expectations, and sharing of such information with third parties, was an unfair practice); Complaint, In re Showplace, Inc., FTC File No. 1123151, (Apr. 11, 2013) (alleging that rent-to-own store’s use of monitoring and tracking software installed on rented computers was an unfair practice). 41 See Complaint, United States v. Epic Games, Inc., Case No. 5:22-CV-00518 (E.D.N.C. Dec. 19, 2022) (alleging that developing and operating a ubiquitous, freely-available, and internet-enabled video game directed at children and teens that publicly broadcasted players’ display names while putting children and teens in direct, real-time contact with others through on-by-default lines of voice and text communication (even after instituting an age gate on the service) was unfair); see also, Complaint, FTC v. Frostwire LLC, Case No. 111-cv-23643 (S.D. Fla. Oct. 11, 2011) (alleging that distributing an application with default settings that caused or were likely to cause consumers to unwittingly publicly share files already present on, or subsequently saved on, the consumers’ mobile devices, including, among others, consumers’ pictures, videos, and documents, was an unfair practice). 42 See Complaint, FTC v. Breathometer, Inc., No. 3:17-cv-314 (N.D. Cal. Jan. 23, 2017) (alleging that failing to notify consumers or take corrective action upon learning that device measuring blood alcohol levels was inaccurate was an unfair practice).

43 See, e.g., Complaint, In re Support King, LLC, FTC File No. 1923003 (Dec. 20, 2021) (alleging that the provider of software called “Spyfone,” which allowed users to surreptitiously monitor and track others’ devices, unfairly failed to take reasonable steps to ensure that the purchasers use the monitoring products and services only for legitimate and lawful purposes); Complaint, In re Retina-X Studios, LLC, FTC File No. 1723118 (Mar. 26, 2020) (alleging a failure to take reasonable steps to ensure that monitoring products and services that required circumventing certain security protections on mobile devices would be used only for legitimate and lawful purposes by the purchaser); Complaint, In re DesignerWare, LLC, FTC File No. 1123151 (Apr. 11, 2013) (alleging that furnishing rent-to-own stores with monitoring and tracking software to be installed on rented computers was an unfair practice).

44 See Complaint, FTC v. Passport Automotive Group, Case. No. 8:22-cv-02670-GLS (D. Md. Oct. 18, 2022) (alleging that imposing higher costs on Black and Latino consumers than on similarly situated non-Latino White consumers was unfair); see also Elisa Jillson, Aiming for truth, fairness, and equity in your company’s use of AI, FTC: BUS. BLOG (Apr. 19, 2021), https://www.ftc.gov/business-guidance/blog/2021/04/aiming-truth-fairness­ equity-your-companys-use-ai.

Page 82

cybersecurity intrusion or an internal incursion by unauthorized employees, contractors, or service providers.45 Businesses must also take care that their own collection and use of biometric information is not likely to cause substantial consumer injury. Determining whether a business’s use of biometric information or biometric information technology violates Section 5 requires a holistic assessment of the business’s relevant practices. In making such assessments, the Commission will draw on applicable lessons that can be derived from its past work—including, but not limited to, in privacy and data security matters. Importantly, in some situations, the adoption of a contemplated practice may be unjustifiable when weighing the potential risks to consumers against the anticipated benefits of the practice. For example, if more accurate, less risky alternatives are available, using a technology that is proven to have high error rates may present unjustifiable risk to consumers, even if the technology is more convenient, more efficient, or more profitable for the business considering implementing the technology. The Commission’s assessment will take into account factors including, but not limited to, the following:

 Failing to assess foreseeable harms to consumers before collecting biometric information.46 Prior to collecting consumers’ biometric information, or deploying a biometric information technology, businesses should conduct a holistic assessment of the potential risks to consumers associated with the collection and/or use.47 For example, assessments should take into account the context in which the collection or use will take place and the extent to which the specific biometric information technologies to be used have been tested by the business or a third party.48 The results of testing should be evaluated in light of how well the testing environment mirrors real world implementation and use, including the particular context in which the technology will be deployed. Assessments should also consider the role of human operators. Businesses should not conclude without evidence that the involvement of a human operator is sufficient to mitigate risks to consumers. Businesses should assess whether deploying a biometric information technology system leads to or contributes to outcomes that disproportionately harm particular demographics of consumers. These assessments should take into account 45 Collecting or retaining biometric information without any legitimate business need or keeping that information indefinitely creates an increased risk of harm to consumers. See, e.g., Complaint, In re BJ’s Wholesale Club, Inc., FTC File No. 0423160 (Sept. 20, 2005) (alleging a failure to employ reasonable and appropriate data security measures where, among other things, the company created unnecessary risks to sensitive financial information by storing it for up to 30 days when it no longer had a business need to keep the information); Complaint, In re Residual Pumpkin Entity, LLC, FTC File No. 1923209 (June 23, 2022) (alleging that company created unnecessary risks to personal information by storing it indefinitely on its network without a business need). 46 See, e.g., Complaint, In re EPN, Inc., FTC File No. 1123143 (Oct. 3, 2012) (alleging a failure to assess risks to consumer personal information it collected and stored online.) 47 See, e.g., Complaint, In re Lenovo, Inc., FTC File No. 1523134 (Dec. 20, 2017) (alleging that respondent’s failure to take reasonable measures to assess and address security risks created by third-party software it installed on laptops it offered to consumers was an unfair practice); Complaint, In re SettlementOne Credit Corp., FTC File No. 0823208 (Aug. 17, 2011) (alleging that respondents failed to assess the risks of allowing end users with unverified or inadequate security to access consumer reports through respondents’ portal). 48 See, e.g., Complaint, In re Upromise, Inc., FTC File No. 1023116 (Mar. 27, 2012) (alleging unfair conduct, where defendant allegedly engaged a service provider to develop software that it distributed to consumers but failed, among other things, to assess and address risks posed by the software by testing, post-deployment monitoring, or other means).

Page 83

whether technical components of the system, such as algorithms, have been specifically tested for differential performance across demographic groups—including intersectionally.

 Failing to promptly address known or foreseeable risks,49 including by failing to identify and implement readily available tools for reducing or eliminating risks.50 For instance, if there is evidence that a particular biometric information technology is often prone to certain types of errors or biases, businesses should proactively take appropriate measures to reduce or eliminate the risk that such errors could lead to consumer injury. Steps taken to address risks may include organizational measures, such as policies and procedures to appropriately limit access to biometric information.51 They may also include technical measures. For example, businesses should timely update relevant systems, including both software components like algorithms and hardware components that are used to capture, process, or store biometric information, in order to ensure that the systems operate effectively and do not put consumers at risk.52  Engaging in surreptitious and unexpected collection or use of biometric information. 53 In some situations, such conduct may be unfair in and of itself. For instance, businesses may violate the law if they use or facilitate the use of biometric information or biometric information technology to surreptitiously identify or track a consumer in a manner that exposes the consumer to risks such as stalking, exposure to stigma, reputational harm, or 49 See, e.g., FTC v. Wyndham Worldwide Corp., 10 F.Supp.3d 602, 624-26 (D.N.J. Apr. 7, 2014) (holding that the FTC’s complaint adequately stated a claim for unfair data security practices where it alleged, among other things, defendant permitted its hotels to connect insecure servers to its network, including servers with outdated operating systems that could not receive patches to address known security vulnerabilities), aff’d, 799 F.3d 236 (3d Cir. 2015); Complaint, FTC v. Equifax, Inc., No. 1:19-cv-03297-TWT (N.D. Ga. July 22, 2019) (alleging failure to implement reasonable procedures to detect, respond to, and timely correct critical and other high-risk security vulnerabilities across Defendant’s systems); Complaint, In re Lookout Services, Inc., FTC File No. 1023076 (June 15, 2011) (alleging respondent’s failure to adequately assess or address the vulnerability of its web application to widelyknown security flaws).

50 See, e.g., Complaint, In re Residual Pumpkin Entity, LLC, FTC File No. 1923209 (June 23, 2022) (alleging a failure to implement readily available protections against well-known and reasonably foreseeable vulnerabilities); Complaint, In re Compete, Inc., FTC File No. 1023155 (Feb. 20, 2013) (alleging a failure to use readily available, low-cost measures to assess/address the risk that data collection software would collect sensitive consumer information it was not authorized to collect).

51 See, e.g., Complaint, In re Residual Pumpkin Entity, LLC, FTC File No. 1923209 (June 23, 2022) (alleging that Residual Pumpkin failed to establish or enforce rules sufficient to make user credentials hard to guess and failed to implement patch management policies and procedures to ensure the timely remediation of critical security vulnerabilities and use of obsolete versions of database and web server software that no longer received patches); Complaint, FTC v. Equifax, Inc., No. 1:19-cv-03297-TWT (N.D. Ga. July 22, 2019) (alleging failure to implement or enforce reasonable access controls to prevent unauthorized access to sensitive personal information). 52 See, e.g., Complaint, In re Residual Pumpkin Entity, LLC, FTC File No. 1923209 (June 23, 2022) (alleging failure to implement patch management policies and procedures to ensure the timely remediation of critical security vulnerabilities and use of obsolete versions of database and web server software that no longer received patches). 53 See, e.g., Complaint, In re Aaron’s, Inc., FTC File No. 1223264 (Mar. 10, 2014) (alleging that allowing franchisees to install software facilitating surreptitious collection of private information on rented computers was an unfair practice, and noting that consumers were unable to avoid harm because collection was surreptitious).

Page 84

extreme emotional distress.54 Additionally, as discussed above, failing to clearly and conspicuously disclose the collection and use of biometric information makes such collection and use unavoidable by the consumer. Injuries to consumers may also be compounded if there is no mechanism for accepting and addressing consumer complaints and disputes related to businesses’ use of biometric information technologies.  Failing to evaluate the practices and capabilities of third parties, including affiliates, vendors, and end users, who will be given access to consumers’ biometric information or will be charged with operating biometric information technologies. Businesses should seek relevant assurances and contractual agreements that require third parties to take appropriate steps to minimize risks to consumers. They should also go beyond contractual measures to oversee third parties and ensure they are meeting those requirements and not putting consumers at risk.55 Such oversight may include organizational and technical measures (including taking steps to ensure access to necessary information) to supervise, monitor or audit the third parties’ compliance with any requirements.

 Failing to provide appropriate training for employees and contractors whose job duties involve interacting with biometric information or technologies that use such information.56 54 See, e.g., Complaint, In re Support King, FTC File No. 1923003 (Dec. 20, 2021) (alleging that respondents’ SpyFone monitoring products and services substantially injure device users by enabling purchasers to stalk them surreptitiously); Complaint, In re Retina-X Studios, LLC, FTC File No. 1723118 (Mar. 26, 2020) (similarly alleging respondent’s products and services substantially injure device users by enabling purchasers to surreptitiously stalk them); Complaint, FTC v. EMP Media, Inc., No. 2:18-cv-00035 (D. Nev. Jan. 9, 2018) (alleging that defendants published consumers’ intimate images without consent in a manner enabling the public to identify or contact the individuals depicted, causing a number of harms to consumers including an unwarranted invasion of privacy into consumers’ lives, depression, anxiety, loss of reputation, safety fears, medical and legal costs, and lost time, was unfair)).

55 See, e.g., FTC v. Wyndham Worldwide Corp., 799 F.3d 236, 241 (3d Cir. 2015) (affirming denial of motion to dismiss FTC’s complaint alleging unfair data security practices, which included allegations defendant allowed hotel property management systems to connect to its network without taking appropriate precautions, such as ensuring that the hotels implemented adequate information security policies and procedures); Complaint, In re GeneLink, Inc., FTC File No. 1123095 (May 8, 2014) (alleging that company unfairly failed to employ reasonable and appropriate measures to prevent unauthorized access to consumers’ personal information because, among other things, it failed to provide reasonable oversight of service providers); See, e.g., Complaint, In re Upromise, Inc., FTC File No. 1023116 (Mar. 27, 2012) (alleging failure to take adequate measures to ensure that its service provider employed reasonable and appropriate measures to protect consumer information and to implement the information collection program in a manner consistent with contractual provisions designed to protect consumer information). 56 See, e.g., Complaint, In re SkyMed Int’l , Inc., FTC File No. 1923140 (Jan. 26, 2021) (alleging a failure to provide adequate guidance or training for employees or third-party contractors regarding information security and safeguarding consumers’ personal information); Complaint, In re Zoom Video Communc’ns, Inc., FTC File No. 1923167 (Jan. 19, 2021) (alleging that failure to implement a training program on secure software development principles contributed to unfair conduct).

Page 85

 Failing to conduct ongoing monitoring of technologies that the business develops, offers for sale,57 or uses58 in connection with biometric information to ensure that the technologies are functioning as anticipated, that users of the technology are operating it as intended, and that use of the technology is not likely to harm consumers. The Commission notes that a practice need not be equally likely to harm all consumers in order to be considered unfair. In determining what constitutes reasonable practices to protect consumers from potential harms associated with the use of biometric information, therefore, the Commission will—and businesses should—consider the practices from the perspective of any population of consumers that is particularly at risk of those harms.59 Finally, the Commission wishes to emphasize that—particularly in view of rapid changes in technological capabilities and uses—businesses should continually assess whether their use of biometric information or biometric information technologies causes or is likely to cause consumer injury in a manner that violates Section 5 of the FTC Act. If so, businesses must cease such practices, whether or not the practices are specifically addressed in this statement. 57 See, e.g., Complaint, In re ASUSTeK Computer Inc., FTC File No. 1423156 (July 18, 2016) (alleging a failure to perform vulnerability and penetration testing on software that respondent offered for sale, including for well-known and reasonably foreseeable vulnerabilities that could be exploited to gain unauthorized access to consumers’ sensitive personal information and local networks).

58 See, e.g., Complaint, FTC v. Equifax, Inc., No. 1:19-cv-03297-TWT (N.D. Ga. July 22, 2019) (alleging failure to implement reasonable procedures to detect, respond to, and timely correct critical and other high-risk security vulnerabilities across Defendant’s systems); Complaint, In re SettlementOne Credit Corp., FTC File No. 0823208 (Aug. 19, 2011) (alleging that respondents failed to implement reasonable steps to maintain an effective system of monitoring access to consumer reports by end users).

59 See, e.g., Unfairness Policy Statement, supra n. 36, at 1074 (“[S]ome may exercise undue influence over highly susceptible classes of purchasers, as by promoting fraudulent ‘cures’ to seriously ill cancer patients.”); Complaint, In re Philip Morris, Inc., 82 F.T.C. 16 (1973) (alleging respondent engaged in an “unfair and deceptive act and practice” by distributing free-sample razor blades in home-delivered newspapers, which posed a particular hazard to young children).

Page 86

Merger Guidelines U.S. Department of Justice and the Federal Trade Commission

Issued: December 18, 2023

Page 87

1. Overview These Merger Guidelines identify the procedures and enforcement practices the Department of Justice and the Federal Trade Commission (the “Agencies”) most often use to investigate whether mergers violate the antitrust laws. The Agencies enforce the federal antitrust laws, specifically Sections 1 and 2 of the Sherman Act, 15 U.S.C. §§ 1, 2; Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45; and Sections 3, 7, and 8 of the Clayton Act,1 15 U.S.C. §§ 14, 18, 19.2 Congress has charged the Agencies with administering these statutes as part of a national policy to promote open and fair competition, including by preventing mergers and acquisitions that would violate these laws. “Federal antitrust law is a central safeguard for the Nation’s free market structures” that ensures “the preservation of economic freedom and our free-enterprise system.”3 It rests on the premise that “[t]he unrestrained interaction of competitive forces will yield the best allocation of our economic resources, the lowest prices, the highest quality and the greatest material progress, while at the same time providing an environment conducive to the preservation of our democratic political and social institutions.”4 Section 7 of the Clayton Act (“Section 7”) prohibits mergers and acquisitions where “in any line of commerce or in any activity affecting commerce in any section of the country, the effect of such acquisition may be substantially to lessen competition, or to tend to create a monopoly.” Competition is a process of rivalry that incentivizes businesses to offer lower prices, improve wages and working conditions, enhance quality and resiliency, innovate, and expand choice, among many other benefits. Mergers that substantially lessen competition or tend to create a monopoly increase, extend, or entrench market power and deprive the public of these benefits. Mergers can lessen competition when they diminish competitive constraints, reduce the number or attractiveness of alternatives available to trading partners, or reduce the intensity with which market participants compete. Section 7 was designed to arrest anticompetitive tendencies in their incipiency.5 The Clayton Act therefore requires the Agencies to assess whether mergers present risk to competition. The Supreme Court has explained that “Section 7 itself creates a relatively expansive definition of antitrust liability: To show that a merger is unlawful, a plaintiff need only prove that its effect ‘may be substantially to lessen competition’” or to tend to create a monopoly.6 Accordingly, the Agencies do not attempt to

1 As amended under the Celler-Kefauver Antimerger Act of 1950, Pub. L. No. 81-899, 64 Stat. 1125 (1950), and the Hart- Scott-Rodino Antitrust Improvements Act of 1976, 15 U.S.C. § 18a. 2 Although these Guidelines focus primarily on Section 7 of the Clayton Act, the Agencies consider whether any of these statutes may be violated by a merger. The various provisions of the Sherman, Clayton, and FTC Acts each have separate standards, and one may be violated when the others are not.

3 North Carolina State Bd. of Dental Examiners v. FTC, 574 U.S. 494, 502 (2015). 4 NCAA v. Board of Regents, 468 U.S. 85, 104 n.27 (1984) (quoting Northern Pac. R. Co. v. United States, 356 U.S. 1, 4-5 (1958)); see also NCAA v. Alston, 141 S. Ct. 2141, 2147 (2021) (quoting Board of Regents, 468 U.S. at 104 n.27). 5 See, e.g., Brown Shoe Co. v. United States, 370 U.S. 294, 318 nn.32-33 (1962); see also United States v. AT&T, Inc., 916 F.3d 1029, 1032 (D.C. Cir. 2019) (Section 7 “halt[s] incipient monopolies and trade restraints outside the scope of the Sherman Act.” (quoting Brown Shoe, 370 U.S. at 318 n.32)); Saint Alphonsus Medical Center-Nampa v. St. Luke’s, 778 F.3d 775, 783 (9th Cir. 2015) (Section 7 “intended to arrest anticompetitive tendencies in their incipiency.” (quoting Brown Shoe, 370 U.S. at 322)); Polypore Intern., Inc. v. FTC, 686 F.3d 1208, 1213-14 (11th Cir. 2012) (same). Some other aspects of Brown Shoe have been subsequently revisited.

6 California v. Am. Stores Co., 495 U.S. 271, 284 (1990) (quoting 15 U.S.C. § 18 with emphasis) (citing Brown Shoe, 370 U.S. at 323).

Page 88

predict the future or calculate precise effects of a merger with certainty. Rather, the Agencies examine the totality of the evidence available to assess the risk the merger presents. Competition presents itself in myriad ways. To assess the risk of harm to competition in a dynamic and complex economy, the Agencies begin the analysis of a proposed merger by asking: how do firms in this industry compete, and does the merger threaten to substantially lessen competition or to tend to create a monopoly? The Merger Guidelines set forth several different analytical frameworks (referred to herein as “Guidelines”) to assist the Agencies in assessing whether a merger presents sufficient risk to warrant an enforcement action. These frameworks account for industry-specific market realities and use a variety of indicators and tools, ranging from market structure to direct evidence of the effect on competition, to examine whether the proposed merger may harm competition.

How to Use These Guidelines: When companies propose a merger that raises concerns under one or more Guidelines, the Agencies closely examine the evidence to determine if the facts are sufficient to infer that the effect of the merger may be to substantially lessen competition or to tend to create a monopoly (sometimes referred to as a “prima facie case”).7 Section 2 describes how the Agencies apply these Guidelines. Specifically, Guidelines 1-6 describe distinct frameworks the Agencies use to identify that a merger raises prima facie concerns, and Guidelines 7-11 explain how to apply those frameworks in several specific settings. In all of these situations, the Agencies will also examine relevant evidence to determine if it disproves or rebuts the prima facie case and shows that the merger does not in fact threaten to substantially lessen competition or tend to create a monopoly. Section 3 identifies rebuttal evidence that the Agencies consider, and that merging parties can present, to rebut an inference of potential harm under these frameworks.8 Section 4 sets forth a non-exhaustive discussion of analytical, economic, and evidentiary tools the Agencies use to evaluate facts, understand the risk of harm to competition, and define relevant markets.

These Guidelines are not mutually exclusive, as a single transaction can have multiple effects or raise concerns in multiple ways. To promote efficient review, for any given transaction the Agencies may limit their analysis to any one Guideline or subset of Guidelines that most readily demonstrates the risks to competition from the transaction.

Guideline 1: Mergers Raise a Presumption of Illegality When They Significantly Increase Concentration in a Highly Concentrated Market. Market concentration is often a useful indicator of a merger’s likely effects on competition. The Agencies therefore presume, unless sufficiently disproved or rebutted, that a merger between competitors that significantly increases concentration and creates or further consolidates a highly concentrated market may substantially lessen competition. Guideline 2: Mergers Can Violate the Law When They Eliminate Substantial Competition Between Firms. The Agencies examine whether competition between the merging parties is substantial since their merger will necessarily eliminate any competition between them.

7 See, e.g., United States v. AT&T, Inc., 916 F.3d at 1032 (explaining that a prima facie case can demonstrate a “reasonable probability” of harm to competition either through “statistics about the change in market concentration” or a “fact-specific” showing (quoting Brown Shoe, 370 U.S. at 323 n.39)); United States v. Baker Hughes, 908 F.2d 981, 982-83 (D.C. Cir. 1990). 8 These Guidelines pertain only to the Agencies’ consideration of whether a merger or acquisition may substantially lessen competition or tend to create a monopoly. The consideration of remedies appropriate for mergers that pose that risk is beyond the Merger Guidelines’ scope. The Agencies review proposals to revise a merger in order to alleviate competitive concerns consistent with applicable law regarding remedies.

Page 89

Guideline 3: Mergers Can Violate the Law When They Increase the Risk of Coordination. The Agencies examine whether a merger increases the risk of anticompetitive coordination. A market that is highly concentrated or has seen prior anticompetitive coordination is inherently vulnerable and the Agencies will infer, subject to rebuttal evidence, that the merger may substantially lessen competition. In a market that is not highly concentrated, the Agencies investigate whether facts suggest a greater risk of coordination than market structure alone would suggest.

Guideline 4: Mergers Can Violate the Law When They Eliminate a Potential Entrant in a Concentrated Market. The Agencies examine whether, in a concentrated market, a merger would (a) eliminate a potential entrant or (b) eliminate current competitive pressure from a perceived potential entrant.

Guideline 5: Mergers Can Violate the Law When They Create a Firm That May Limit Access to Products or Services That Its Rivals Use to Compete. When a merger creates a firm that can limit access to products or services that its rivals use to compete, the Agencies examine the extent to which the merger creates a risk that the merged firm will limit rivals’ access, gain or increase access to competitively sensitive information, or deter rivals from investing in the market. Guideline 6: Mergers Can Violate the Law When They Entrench or Extend a Dominant Position. The Agencies examine whether one of the merging firms already has a dominant position that the merger may reinforce, thereby tending to create a monopoly. They also examine whether the merger may extend that dominant position to substantially lessen competition or tend to create a monopoly in another market.

Guideline 7: When an Industry Undergoes a Trend Toward Consolidation, the Agencies Consider Whether It Increases the Risk a Merger May Substantially Lessen Competition or Tend to Create a Monopoly. A trend toward consolidation can be an important factor in understanding the risks to competition presented by a merger. The Agencies consider this evidence carefully when applying the frameworks in Guidelines 1-6.

Guideline 8: When a Merger is Part of a Series of Multiple Acquisitions, the Agencies May Examine the Whole Series. If an individual transaction is part of a firm’s pattern or strategy of multiple acquisitions, the Agencies consider the cumulative effect of the pattern or strategy when applying the frameworks in Guidelines 1-6.

Guideline 9: When a Merger Involves a Multi-Sided Platform, the Agencies Examine Competition Between Platforms, on a Platform, or to Displace a Platform. Multi-sided platforms have characteristics that can exacerbate or accelerate competition problems. The Agencies consider the distinctive characteristics of multi-sided platforms when applying the frameworks in Guidelines 1-6. Guideline 10: When a Merger Involves Competing Buyers, the Agencies Examine Whether It May Substantially Lessen Competition for Workers, Creators, Suppliers, or Other Providers. The Agencies apply the frameworks in Guidelines 1-6 to assess whether a merger between buyers, including employers, may substantially lessen competition or tend to create a monopoly. Guideline 11: When an Acquisition Involves Partial Ownership or Minority Interests, the Agencies Examine Its Impact on Competition. The Agencies apply the frameworks in Guidelines 1-6 to assess if an acquisition of partial control or common ownership may substantially lessen competition. * * *

Page 90

This edition of the Merger Guidelines consolidates, revises, and replaces the various versions of Merger Guidelines previously issued by the Agencies. The revision builds on the learning and experience reflected in those prior Guidelines and successive revisions. These Guidelines reflect the collected experience of the Agencies over many years of merger review in a changing economy and have been refined through an extensive public consultation process. As a statement of the Agencies’ law enforcement procedures and practices, the Merger Guidelines create no independent rights or obligations, do not affect the rights or obligations of private parties, and do not limit the discretion of the Agencies, including their staff, in any way. Although the Merger Guidelines identify the factors and frameworks the Agencies consider when investigating mergers, the Agencies’ enforcement decisions will necessarily continue to require prosecutorial discretion and judgment. Because the specific standards set forth in these Merger Guidelines will be applied to a broad range of factual circumstances, the Agencies will apply them reasonably and flexibly to the specific facts and circumstances of each merger.

Similarly, the factors contemplated in these Merger Guidelines neither dictate nor exhaust the range of theories or evidence that the Agencies may introduce in merger litigation. Instead, they set forth various methods of analysis that may be applicable depending on the availability and/or reliability of information related to a given market or transaction. Given the variety of industries, market participants, and acquisitions that the Agencies encounter, merger analysis does not consist of uniform application of a single methodology. The Agencies assess any relevant and meaningful evidence to evaluate whether the effect of a merger may be substantially to lessen competition or to tend to create a monopoly. Merger review is ultimately a fact-specific exercise. The Agencies follow the facts and the law in analyzing mergers as they do in other areas of law enforcement. These Merger Guidelines include references to applicable legal precedent. References to court decisions do not necessarily suggest that the Agencies would analyze the facts in those cases identically today. While the Agencies adapt their analytical tools as they evolve and advance, legal holdings reflecting the Supreme Court’s interpretation of a statute apply unless subsequently modified. These Merger Guidelines therefore reference applicable propositions of law to explain core principles that the Agencies apply in a manner consistent with modern analytical tools and market realities. References herein do not constrain the Agencies’ interpretation of the law in particular cases, as the Agencies will apply their discretion with respect to the applicable law in each case in light of the full range of precedent pertinent to the issues raised by each enforcement action.

Page 91

2. Applying the Merger Guidelines This section discusses the frameworks the Agencies use to assess whether a merger may substantially lessen competition or tend to create a monopoly.

2.1. Guideline 1: Mergers Raise a Presumption of Illegality When They Significantly Increase Concentration in a Highly Concentrated Market. Market concentration and the change in concentration due to the merger are often useful indicators of a merger’s risk of substantially lessening competition. In highly concentrated markets, a merger that eliminates a significant competitor creates significant risk that the merger may substantially lessen competition or tend to create a monopoly. As a result, a significant increase in concentration in a highly concentrated market can indicate that a merger may substantially lessen competition, depriving the public of the benefits of competition.

The Supreme Court has endorsed this view and held that “a merger which produces a firm controlling an undue percentage share of the relevant market, and results in a significant increase in the concentration of firms in that market[,] is so inherently likely to lessen competition substantially that it must be enjoined in the absence of [rebuttal] evidence.”9 In the Agencies’ experience, this legal presumption provides a highly administrable and useful tool for identifying mergers that may substantially lessen competition.

An analysis of concentration involves calculating pre-merger market shares of products10 within a relevant market (see Section 4.3 for a discussion of market definition and Section 4.4 for more details on computing market shares). The Agencies assess whether the merger creates or further consolidates a highly concentrated market and whether the increase in concentration is sufficient to indicate that the merger may substantially lessen competition or tend to create a monopoly.11 The Agencies generally measure concentration levels using the Herfindahl-Hirschman Index (“HHI”).12 The HHI is defined as the sum of the squares of the market shares; it is small when there are many small firms and grows larger as the market becomes more concentrated, reaching 10,000 in a market with a single firm. Markets with an HHI greater than 1,800 are highly concentrated, and a change of more than 100 points is a significant increase.13 A merger that creates or further consolidates a highly

9 United States v. Phila. Nat’l Bank, 374 U.S. 321, 363 (1963); see, e.g., FTC v. v. Hackensack Meridian Health, Inc., 30 F.4th 160, 172-73 (3d Cir. 2022); United States v. AT&T, Inc., 916 F.3d at 1032. 10 These Guidelines use the term “products” to encompass anything that is traded between firms and their suppliers, customers, or business partners, including physical goods, services, or access to assets. Products can be as narrow as an individual brand, a specific version of a product, or a product that includes specific ancillary services such as the right to return it without cause or delivery to the customer’s location. 11 Typically, a merger eliminates a competitor by bringing two market participants under common control. Similar concerns arise if the merger threatens to cause the exit of a current market participant, such as a leveraged buyout that puts the target firm at significant risk of failure.

12 The Agencies may instead measure market concentration using the number of significant competitors in the market. This measure is most useful when there is a gap in market share between significant competitors and smaller rivals or when it is difficult to measure shares in the relevant market.

13 For illustration, the HHI for a market of five equal firms is 2,000 (5 x 202 = 2,000) and for six equal firms is 1,667 (6 x 16.672 = 1667).

Page 92

concentrated market that involves an increase in the HHI of more than 100 points14 is presumed to substantially lessen competition or tend to create a monopoly.15 The Agencies also may examine the market share of the merged firm: a merger that creates a firm with a share over thirty percent is also presumed to substantially lessen competition or tend to create a monopoly if it also involves an increase in HHI of more than 100 points.16 Indicator Threshold for Structural Presumption Market HHI greater than 1,800 Post-merger HHI AND Change in HHI greater than 100

Share greater than 30% Merged Firm’s Market Share AND Change in HHI greater than 100 When exceeded, these concentration metrics indicate that a merger’s effect may be to eliminate substantial competition between the merging parties and may be to increase coordination among the remaining competitors after the merger. This presumption of illegality can be rebutted or disproved. The higher the concentration metrics over these thresholds, the greater the risk to competition suggested by this market structure analysis and the stronger the evidence needed to rebut or disprove it. 2.2. Guideline 2: Mergers Can Violate the Law When They Eliminate Substantial Competition Between Firms.

A merger eliminates competition between the merging firms by bringing them under joint control.17 If evidence demonstrates substantial competition between the merging parties prior to the

14 The change in HHI from a merger of firms with shares a and b is equal to 2ab. For example, in a merger between a firm with 20% market share and a firm with 5% market share, the change in HHI is 2 x 20 x 5 = 200. 15 The first merger guidelines to reference an HHI threshold were the merger guidelines issued in 1982. These guidelines referred to mergers with HHI above 1,000 as concentrated markets, with HHI between 1,000 and 1,800 as “moderately concentrated” and above 1,800 as “highly concentrated,” while they referred to an increase in HHI of 100 as a “significant increase.” Each subsequent iteration until 2010 maintained those thresholds. See Fed. Trade Comm’n & U.S. Dep’t of Justice, Horizontal Merger Guidelines § 1.51 (1997); Fed. Trade Comm’n & U.S. Dep’t of Justice, Horizontal Merger Guidelines § 1.51 (1992); U.S. Dep’t of Justice, Merger Guidelines § 3(A) (1982). During this time, courts routinely cited to the guidelines and these HHI thresholds in decisions. See, e.g., Chicago Bridge & Iron Co. N.V. v. FTC, 534 F.3d 410, 431 (5th Cir. 2008); FTC v. H.J. Heinz Co., 246 F.3d 708, 716 (D.C. Cir. 2001); FTC v. Univ. Health, Inc., 938 F.2d 1206, 1211 (11th Cir. 1991). Although the Agencies raised the thresholds for the 2010 guidelines, based on experience and evidence developed since, the Agencies consider the original HHI thresholds to better reflect both the law and the risks of competitive harm suggested by market structure and have therefore returned to those thresholds. 16 Phila. Nat’l Bank, 374 U.S. at 364-65 (“Without attempting to specify the smallest market share which would still be considered to threaten undue concentration, we are clear that 30% presents that threat.”). 17 The competitive harm from the elimination of competition between the merging firms, without considering the risk of coordination, is sometimes referred to as unilateral effects. The elimination of competition between the merging firms can also lessen competition with and among other competitors. When the elimination of competition between the merging firms

Page 93

merger, that ordinarily suggests that the merger may substantially lessen competition.18Although a change in market structure can also indicate risk of competitive harm (see Guideline 1), an analysis of the existing competition between the merging firms can demonstrate that a merger threatens competitive harm independent from an analysis of market shares.

Competition often involves firms trying to win business by offering lower prices, new or better products and services, more attractive features, higher wages, improved benefits, or better terms relating to various additional dimensions of competition. This can include competition to research and develop products or services, and the elimination of such competition may result in harm even if such products or services are not yet commercially available. The more the merging parties have shaped one another’s behavior, or have affected one another’s sales, profits, valuation, or other drivers of behavior, the more significant the competition between them.

The Agencies examine a variety of indicators to identify substantial competition. For example: Strategic Deliberations or Decisions. The Agencies may analyze the extent of competition between the merging firms by examining evidence relating to strategic deliberations or decisions in the regular course of business. For example, in some markets, the firms may monitor each other’s pricing, marketing campaigns, facility locations, improvements, products, capacity, output, input costs, and/or innovation plans. This can provide evidence of competition between the merging firms, especially when they react by taking steps to preserve or enhance the competitiveness or profitability of their own products or services.

Prior Merger, Entry, and Exit Events. The Agencies may look to historical events to assess the presence and substantiality of direct competition between the merging firms. For example, the Agencies may examine the competitive impact of recent relevant mergers, entry, expansion, or exit events. Customer Substitution. Customers’ willingness to switch between different firms’ products is an important part of the competitive process. Firms are closer competitors the more that customers are willing to switch between their products. The Agencies use a variety of tools, detailed in Section 4.2, to assess customer substitution.

Impact of Competitive Actions on Rivals. When one firm takes competitive actions to attract customers, this can benefit the firm at the expense of its rivals. The Agencies may gauge the extent of competition between the merging firms by considering the impact that competitive actions by one of the merging firms has on the other merging firm. The impact of a firm’s competitive actions on a rival is generally greater when customers consider the firm’s products and the rival’s products to be closer substitutes, so that a firm’s competitive action results in greater lost sales for the rival, and when the profitability of the rival’s lost sales is greater.

Impact of Eliminating Competition Between the Firms. In some instances, evidence may be available to assess the impact of competition from one firm on the other’s actions, such as firm choices

leads them to compete less aggressively with one another, other firms in the market can in turn compete less aggressively, decreasing the overall intensity of competition.

18 See also United States v. First Nat’l Bank & Trust Co. of Lexington, 376 U.S. 665, 669-70 (1964) (per curiam) (“[I]t [is] clear that the elimination of significant competition between [merging parties] constitutes an unreasonable restraint of trade in violation of § 1 of the Sherman Act. . . . It [can be] enough that the two . . . compete[], that their competition [is] not insubstantial and that the combination [would] put an end to it.”); ProMedica Health Sys., Inc. v. FTC, 749 F.3d 559, 568-70 (6th Cir. 2014), cert. denied, 575 U.S. 996 (2015).

Page 94

about price, quality, wages, or another dimension of competition. Section 4.2 describes a variety of approaches to measuring such impacts.

Additional Evidence, Tools, and Metrics. The Agencies may use additional evidence, tools, and metrics to assess the loss of competition between the firms. Depending on the realities of the market, different evidence, tools, or metrics may be appropriate.

Section 4.2 provides additional detail about the approaches that the Agencies use to assess competition between or among firms.

2.3. Guideline 3: Mergers Can Violate the Law When They Increase the Risk of Coordination.

The Agencies determine that a merger may substantially lessen competition when it meaningfully increases the risk of coordination among the remaining firms in a relevant market or makes existing coordination more stable or effective.19 Firms can coordinate across any or all dimensions of competition, such as price, product features, customers, wages, benefits, or geography. Coordination among rivals lessens competition whether it occurs explicitly—through collusive agreements between competitors not to compete or to compete less—or tacitly, through observation and response to rivals. Because tacit coordination often cannot be addressed under Section 1 of the Sherman Act, the Agencies vigorously enforce Section 7 of the Clayton Act to prevent market structures conducive to such coordination.

Tacit coordination can lessen competition even when it does not rise to the level of an agreement and would not itself violate the law. For example, in a concentrated market a firm may forego or soften an aggressive competitive action because it anticipates rivals responding in kind. This harmful behavior is more common the more concentrated markets become, as it is easier to predict the reactions of rivals when there are fewer of them.

To assess the extent to which a merger may increase the likelihood, stability, or effectiveness of coordination, the Agencies often consider three primary factors and several secondary factors. The Agencies may consider additional factors depending on the market. 2.3.A. Primary Factors The Agencies may conclude that post-merger market conditions are susceptible to coordinated interaction and that the merger materially increases the risk of coordination if any of the three primary factors are present.

Highly Concentrated Market. By reducing the number of firms in a market, a merger increases the risk of coordination. The fewer the number of competitively meaningful rivals prior to the merger, the greater the likelihood that merging two competitors will facilitate coordination. Markets that are highly concentrated after a merger that significantly increases concentration (see Guideline 1) are presumptively susceptible to coordination. If merging parties assert that a highly concentrated market is not susceptible to coordination, the Agencies will assess this rebuttal evidence using the framework

19 See Brooke Grp. Ltd. v. Brown & Williamson Tobacco Corp., 509 U.S. 209, 229-30 (1993) (“In the § 7 context, it has long been settled that excessive concentration, and the oligopolistic price coordination it portends, may be the injury to competition the Act prohibits.”).

Page 95

described below. Where a market is not highly concentrated, the Agencies may still consider other risk factors.

Prior Actual or Attempted Attempts to Coordinate. Evidence that firms representing a substantial share in the relevant market appear to have previously engaged in express or tacit coordination to lessen competition is highly informative as to the market’s susceptibility to coordination. Evidence of failed attempts at coordination in the relevant market suggest that successful coordination was not so difficult as to deter attempts, and a merger reducing the number of rivals may tend to make success more likely.

Elimination of a Maverick. A maverick is a firm with a disruptive presence in a market. The presence of a maverick, however, only reduces the risk of coordination so long as the maverick retains the disruptive incentives that drive its behavior. A merger that eliminates a maverick or significantly changes its incentives increases the susceptibility to coordination. 2.3.B. Secondary Factors The Agencies also examine whether secondary factors demonstrate that a merger may meaningfully increase the risk of coordination, even absent the primary risk factors. Not all secondary factors must be present for a market to be susceptible to coordination. Market Concentration. Even in markets that are not highly concentrated, coordination becomes more likely as concentration increases. The more concentrated a market, the more likely the Agencies are to conclude that the market structure suggests susceptibility to coordination. Market Observability. A market is more susceptible to coordination if a firm’s behavior can be promptly and easily observed by its rivals. Rivals’ behavior is more easily observed when the terms offered to customers are readily discernible and relatively observable (that is, known to rivals). Observability can refer to the ability to observe prices, terms, the identities of the firms serving particular customers, or any other competitive actions of other firms. Information exchange arrangements among market participants, such as public exchange of information through announcements or private exchanges through trade associations or publications, increase market observability. Regular monitoring of one another’s prices or customers can indicate that the terms offered to customers are relatively observable. Pricing algorithms, programmatic pricing software or services, and other analytical or surveillance tools that track or predict competitor prices or actions likewise can increase the observability of the market.

Competitive Responses. A market is more susceptible to coordination if a firm’s prospective competitive reward from attracting customers away from its rivals will be significantly diminished by its rivals’ likely responses. This is more likely to be the case the stronger and faster the responses from its rivals because such responses reduce the benefits of competing more aggressively. Some factors that increase the likelihood of strong or rapid responses by rivals include: (1) the market has few significant competitors, (2) products in the relevant market are relatively homogeneous, (3) customers find it relatively easy to switch between suppliers, (4) suppliers use algorithmic pricing, or (5) suppliers use meeting-competition clauses. The more predictable are rivals’ responses to strategic actions or changing competitive conditions, and the more interactions firms have across multiple markets, the greater the susceptibility to coordination.

Aligned Incentives. Removing a firm that has different incentives from most other firms in a market can increase the risk of coordination. For example, a firm with a small market share may have

Page 96

less incentive to coordinate because it has more to gain from winning new business than other firms. The same issue can arise when a merger more closely aligns one or both merging firms’ incentives with the other firms in the market. In some cases, incentives might be aligned or strengthened when firms compete with one another in multiple markets (“multi-market contact”). For example, firms might compete less aggressively in some markets in anticipation of reciprocity by rivals in other markets. The Agencies examine these and any other market realities that suggest aligned incentives increase susceptibility to coordination.

Profitability or Other Advantages of Coordination for Rivals. The Agencies regard coordinated interaction as more likely to occur when participants in the market stand to gain more from successful coordination. Coordination generally is more profitable or otherwise advantageous for the coordinating firms the less often customers substitute outside the market when firms offer worse terms. Rebuttal Based on Structural Barriers to Coordination Unique to the Industry. When market structure evidence suggests that a merger may substantially lessen competition through coordination, the merging parties sometimes argue that anticompetitive coordination is nonetheless impossible due to structural market barriers to coordinating. The Agencies consider this rebuttal evidence using the framework in Section 3. In so doing, the Agencies consider whether structural market barriers to coordination are “so much greater in the [relevant] industry than in other industries that they rebut the normal presumption” of coordinated effects.20 In the Agencies’ experience, structural conditions that prevent coordination are exceedingly rare in the modern economy. For example, coordination is more difficult when firms are unable to observe rivals’ competitive offerings, but technological change has made this situation less common than in the past and reduced many traditional barriers or obstacles to observing the behavior of rivals in a market. The greater the level of concentration in the relevant market, the greater must be the structural barriers to coordination in order to show that no substantial lessening of competition is threatened.

2.4. Guideline 4: Mergers Can Violate the Law When They Eliminate a Potential Entrant in a Concentrated Market.

Mergers can substantially lessen competition by eliminating a potential entrant. For instance, a merger can eliminate the possibility that entry or expansion by one or both firms would have resulted in new or increased competition in the market in the future. A merger can also eliminate current competitive pressure exerted on other market participants by the mere perception that one of the firms might enter. Both of these risks can be present simultaneously. A merger that eliminates a potential entrant into a concentrated market can substantially lessen competition or tend to create a monopoly.21 The more concentrated the market, the greater the magnitude of harm to competition from any lost potential entry and the greater the tendency to create a monopoly. Accordingly, for mergers involving one or more potential entrants, the higher the market concentration, the lower the probability of entry that gives rise to concern.

20 See H.J. Heinz Co., 246 F.3d at 724.

21 United States v. Marine Bancorp., 418 U.S. 602, 630 (1974). A concentrated market is one with an HHI greater than 1,000 (See Guideline 1, n.15).

Page 97

2.4.A. Actual Potential Competition: Eliminating Reasonably Probable Future Entry In general, expansion into a concentrated market via internal growth rather than via acquisition benefits competition.22 Merging a current and a potential market participant eliminates the possibility that the potential entrant would have entered on its own—entry that, had it occurred, would have provided a new source of competition in a concentrated market.

To determine whether an acquisition that eliminates a potential entrant into a concentrated market may substantially lessen competition,23 the Agencies examine (1) whether one or both24 of the merging firms had a reasonable probability of entering the relevant market other than through an anticompetitive merger, and (2) whether such entry offered a substantial likelihood of ultimately producing deconcentration of the market or other significant procompetitive effects.25 Reasonable Probability of Entry. The Agencies’ starting point for assessment of a reasonable probability of entry is objective evidence regarding the firm’s available feasible means of entry, including its capabilities and incentives. Relevant objective evidence can include, for example, evidence that the firm has sufficient size and resources to enter; evidence of any advantages that would make the firm well-situated to enter; evidence that the firm has successfully expanded into similarly situated markets in the past or already participates in adjacent or related markets; evidence that the firm has an incentive to enter; or evidence that industry participants recognize the company as a potential entrant. This analysis is not limited to whether the company could enter with its pre-merger production facilities, but also considers overall capability, which can include the ability to expand or add to its capabilities on its own or in collaboration with someone other than the acquisition target. Subjective evidence that the company considered entering absent the merger can also indicate a reasonable probability that the company would have entered without the merger. Subjective evidence that the company considered organic entry as an alternative to merging generally suggests that, absent the merger, entry would be reasonably probable.

Likelihood of Deconcentration or Other Significant Procompetitive Effects. New entry can yield a variety of procompetitive effects, including increased output or investment, higher wages or improved working conditions, greater innovation, higher quality, and lower prices. If the merging firm had a reasonable probability of entering a highly concentrated relevant market, this suggests benefits that would have resulted from its entry would be competitively significant, unless there is substantial direct evidence that the competitive effect would be de minimis. To supplement the suggestion that new entry yields procompetitive effects, the Agencies will consider projections of the potential entrant’s

22 See Ford Motor Co. v. United States, 405 U.S. 562, 587 (1972) (referring to the “typical[]” competitive concern when “a potential entrant enters an oligopolistic market by acquisition rather than internal expansion” as being “that such a move has deprived the market of the pro-competitive effect of an increase in the number of competitors”). 23 Harm from the elimination of a potential entrant can occur in markets that do not yet consist of commercial products, even if the market concentration of the future market cannot be measured using traditional means. Where there are few equivalent potential entrants, including one or both of the merging firms, that indicates that the future market, once commercialized, will be concentrated. The Agencies will consider other potential entrants’ capabilities and incentives in comparison to the merging potential entrant to assess equivalence.

24 United States v. Penn-Olin Chemical Co., 378 U.S. 158 (1964) (holding that a merger between two firms, each or both of which might have entered the relevant market, could violate Section 7). 25 See id. at 175-76; Marine Bancorp., 418 U.S. at 622, 633 (“[T]he proscription expressed in § 7 against mergers ‘when a “tendency” toward monopoly or [a] “reasonable likelihood” of a substantial lessening of competition in the relevant market is shown’ applies alike to actual- and potential-competition cases.” (quoting Penn-Olin, 378 U.S. at 171)); see also Yamaha Motor Co. v. FTC, 657 F.2d 971, 980-981 (8th Cir. 1981) (acquisition of potential entrant violated Section 7).

Page 98

competitive significance, such as market share, its business strategy, the anticipated response of competitors, or customer preferences or interest.

A merger of two potential entrants can also result in a substantial lessening of competition. The merger need not involve a firm that has a commercialized product in the market or an existing presence in the same geographic market. The Agencies analyze similarly mergers between two potential entrants and those involving a current market participant and a potential entrant. 2.4.B. Perceived Potential Competition: Lessening of Current Competitive Pressure A perceived potential entrant can stimulate competition among incumbents. That pressure can prompt current market participants to make investments, expand output, raise wages, increase product quality, lower product prices, or take other procompetitive actions. The acquisition of a firm that is perceived by market participants as a potential entrant can substantially lessen competition by eliminating or relieving competitive pressure.

To assess whether the acquisition of a perceived potential entrant may substantially lessen competition, the Agencies consider whether a current market participant could reasonably consider one of the merging companies to be a potential entrant and whether that potential entrant has a likely influence on existing competition.26 Market Participant Could Reasonably Consider a Firm to Be a Potential Entrant. The starting point for this analysis is evidence regarding the company’s capability of entering or applying competitive pressure. Objective evidence is highly probative and includes evidence of feasible means of entry or communications by the company indicating plans to expand or reallocate resources in a way that could increase competition in the relevant market. Objective evidence can be sufficient to find that the firm is a potential entrant; it need not be accompanied by any subjective evidence of current market participants’ internal perceptions or direct evidence of strategic reactions to the potential entrant. If such evidence is available, it can weigh in favor of finding that a current market participant could reasonably consider the firm to be a potential entrant.

Likely Influence on Existing Rivals. Direct evidence that the firm’s presence or behavior has affected or is affecting current market participants’ strategic decisions is not necessary but can establish a showing of a likely influence. Even without such direct evidence, circumstantial evidence that the firm’s presence or behavior had an effect on the competitive reactions of firms in the market may also show likely influence. Objective evidence establishing that a current market participant could reasonably consider one of the merging firms to be a potential entrant can also establish that the firm has a likely influence on existing market participants. Subjective evidence indicating that current market participants—including, for example, customers, suppliers, or distributors—internally perceive the merging firm to be a potential entrant can also establish a likely influence. 2.4.C. Distinguishing Potential Entry from Entry as Rebuttal When evaluating a potentially unlawful merger of current competitors, the Agencies will assess whether entry by other firms would be timely, likely, and sufficient to replace the lost competition using the standards discussed in Section 3.2. The existence of a perceived or actual potential entrant may not meet that standard when considering a merger between firms that already participate in the relevant market. The competitive impact of perceived and actual potential entrants is typically attenuated

26 See United States v. Falstaff Brewing Corp., 410 U.S. 526, 533-36 (1973); Marine Bancorp., 418 U.S. at 624-25.

Page 99

compared to competition between two current market participants. However, because concentrated markets often lack robust competition, the loss of even an attenuated source of competition such as a potential entrant may substantially lessen competition in such markets. Moreover, because the Agencies seek to prevent threats to competition in their incipiency, the likelihood of potential entry that could establish that a merger’s effect “may be” to substantially lessen competition will generally not equal the likelihood of entry that would rebut a demonstrated risk that competition may be substantially lessened. 2.5. Guideline 5: Mergers Can Violate the Law When They Create a Firm that May Limit Access to Products or Services That Its Rivals Use to Compete.

The Agencies evaluate whether a merger may substantially lessen competition when the merged firm can limit access to a product, service, or route to market27 that its rivals may use to compete. Mergers involving products or services rivals may use to compete can threaten competition in several ways, for example: (A) the merged firm could limit rivals’ access to the products or services, thereby weakening or excluding them, lessening competition; (B) the merged firm may gain or increase access to rivals’ competitively sensitive information, thereby facilitating coordination or undermining their incentives to compete; or (C) the threat of limited access can deter rivals and potential rivals from investing.

These problems can arise from mergers involving access to any products, services, or routes to market that rivals use to compete, and that are competitively significant to those rivals, whether or not they involve a traditional vertical relationship such as a supplier and distributor relationship. Many types of related products can implicate these concerns, including products rivals currently or may in the future use as inputs, products that provide distribution services for rivals or otherwise influence customers’ purchase decisions, products that provide or increase the merged firm’s access to competitively sensitive information about its rivals, or complements that increase the value of rivals’ products. Even if the related product is not currently being used by rivals, it might be competitively significant because, for example, its availability enables rivals to obtain better terms from other providers in negotiations. The Agencies refer to any product, service, or route to market that rivals use to compete in that market as a “related product.”

The Agencies analyze competitive effects in the relevant market in which the merged firm competes with rivals that use the related product. The Agencies do not always define a market around the related product, although they may do so (see Section 2.5.A.2). 2.5.A. The Risk that the Merged Firm May Limit Access A merger involving products, services, or routes to market that rivals use to compete may substantially lessen competition when the merged firm has both the ability and incentive to limit access to the related product so as to weaken or exclude some of its rivals (the “dependent” rivals) in the relevant market.

The merged firm could limit access to the related product in different ways. It could deny rivals access altogether, deny access to some features, degrade its quality, worsen the terms on which rivals

27 A “route to market” refers to any way a firm accesses its trading partners, such as distribution channels, marketplaces, or customers.

Page 100

can access the related product, limit interoperability, degrade the quality of complements, provide less reliable access, tie up or obstruct routes to market, or delay access to product features, improvements, or information relevant to making efficient use of the product. All these ways of limiting access are sometimes referred to as “foreclosure.”28 Dependent rivals can be weakened if limiting their access to the related product would make it harder or more costly for them to compete; for example, if it would lead them to charge higher prices or offer worse terms in the relevant market, reduce the quality of their products so that they were less attractive to trading partners, or interfere with distribution so that those products were less readily available. Competition can also be weakened if the merger facilitates coordination among the merged firm and its rivals, for example by giving the merged firm the ability to threaten to limit access to uncooperative rivals.

Rivals or potential rivals may be excluded from the relevant market if limiting their access to the related product could lead them to exit the market or could deter them from entering. For example, potential rivals may not enter if the merged firm ties up or obstructs so many routes to market that the remaining addressable market is too small. Exclusion can arise when a new entrant would need to invest not only in entering the relevant market, but also in supplying its own substitute for the related product, sometimes referred to as two-stage entry or multi-level entry. Because the merged firm could use its ability to limit access to the related product in a range of ways, the Agencies focus on the overall risk that the merged firm will do so, and do not necessarily identify which precise actions the merged firm would take to lessen competition. 2.5.A.1.

Ability and Incentive to Foreclose Rivals The Agencies assess the merged firm’s ability and incentive to substantially lessen competition by limiting access to the related product for a group of dependent rivals in the relevant market by examining four factors.

1. Availability of Substitutes. The Agencies assess the availability of substitutes for the related product. The merged firm is more able to limit access when there are few alternative options to the merged firm’s related product, if these alternatives are differentiated in quality, price, or other characteristics, or if competition to supply them is limited.

2. Competitive Significance of the Related Product. The Agencies consider how important the related product is for the dependent firms and the extent to which they would be weakened or excluded from the relevant market if their access was limited.

3. Effect on Competition in the Relevant Market. The Agencies assess the importance of the dependent firms for competition in the relevant market. Competition can be particularly affected when the dependent firms would be excluded from the market altogether. 4. Competition Between the Merged Firm and the Dependent Firms. The merged firm’s incentive to limit the dependent firms’ access depends on how strongly it competes with them. If the dependent firms are close competitors, the merged firm may benefit from higher sales or prices in the relevant market when it limits their access. The Agencies may also assess the potential for the merged

28 See Illumina, Inc. v. FTC, No. 23-60167, slip op. at 17 (5th Cir. Dec. 15, 2023) (“[T]here are myriad ways in which [the merged firm] could engage in foreclosing behavior . . . such as by making late deliveries or subtly reducing the level of support services.”).

Page 101

firm to benefit from facilitating coordination by threatening to limit dependent rivals’ access to the related product. These benefits can make it profitable to limit access to the related product and thereby substantially lessen competition, even though it would not have been profitable for the firm that controlled the related product prior to the merger.

The Agencies assess the extent of competition with rivals and the risk of coordination using analogous methods to the ones described in Guidelines 2 and 3, and Section 4.2. * * * In addition to the evidentiary, analytical, and economic tools in Section 4, the following additional considerations and evidence may be important to this assessment: Barriers to Entry and Exclusion of Rivals. The merged firm may benefit more from limiting access to dependent rivals or potential rivals when doing so excludes them from the market, for example by creating a need for the firm to enter at multiple levels and to do so with sufficient scale and scope (multi-level entry).

Prior Transactions or Prior Actions. If firms used prior acquisitions or engaged in prior actions to limit rivals’ access to the related product, or other products its rivals use to compete, that suggests that the merged firm has the ability and incentive to do so. However, lack of past action does not necessarily indicate a lack of incentive in the present transaction because the merger can increase the incentive to foreclose.

Internal Documents. Information from business planning and merger analysis documents prepared by the merging firms might identify instances where the firms believe they have the ability and incentive to limit rivals’ access. Such documents, where available, are highly probative. The lack of such documents, however, is less informative.

Market Structure. Evidence of market structure can be informative about the availability of substitutes for the related product and the competition in the market for the related product or the relevant market. (See Section 2.5.A.2) 2.5.A.2.

Analysis of Industry Factors and Market Structure The Agencies also sometimes determine, based on an analysis of factors related to market structure, that a merger may substantially lessen competition by allowing the merged firm to limit access to a related product.29 The Agencies’ assessment can include evidence about the structure, history, and probable future of the market.

Structure of the Related Market. In some cases, the market structure of the related product market can give an indication of the merged firm’s ability to limit access to the related product. In these cases, the Agencies define a market (termed the “related market”) around the related product (see Section 4.3). The Agencies then define the “foreclosure share” as the share of the related market to which the merged firm could limit access. If the share or other evidence show that the merged firm is

29 See Brown Shoe, 370 U.S. at 328-34; Illumina, slip op. at 20-22 (“There is no precise formula when it comes to applying these factors. Indeed, the Supreme Court has found a vertical merger unlawful by examining only three of the Brown Shoe factors.” (cleaned up)); Fruehauf Corp. v. FTC, 603 F.2d 345, 353 (2d Cir. 1979); U.S. Steel Corp. v. FTC, 426 F.2d 592, 599 (6th Cir. 1970).

Page 102

approaching or has monopoly power over the related product, and the related product is competitively significant, those factors alone are a sufficient basis to demonstrate that the dependent firms do not have adequate substitutes and the merged firm has the ability to weaken or exclude them by limiting their access to the related product. (See Considerations 1 and 2 in Section 2.5.A.1).30 Structure of the Relevant Market. Limiting rivals’ access to the related product will generally have a greater effect on competition in the relevant market if the merged firm and the dependent rivals face less competition from other firms. In addition, the merged firm has a greater incentive to limit access to the dependent firms when it competes more closely with them. Market share and concentration measures for the merged firm, the dependent rivals, and the other firms, can sometimes provide evidence about both issues.

Nature and Purpose of the Merger. When the nature and purpose of the merger is to foreclose rivals, including by raising their costs, that suggests the merged firm is likely to foreclose rivals. Trend Toward Vertical Integration. The Agencies will generally consider evidence about the degree of integration between firms in the relevant and related markets, as well as whether there is a trend toward further vertical integration and how that trend or the factors driving it may affect competition. A trend toward vertical integration may be shown through, for example: a pattern of vertical integration following mergers by one or both of the merging companies; or evidence that a merger was motivated by a desire to avoid having its access limited due to similar transactions among other companies that occurred or may occur in the future.

* * * If the parties offer rebuttal evidence, the Agencies will assess it under the approach laid out in Section 3.31 When assessing rebuttal evidence focused on the reduced profits of the merged firm from limiting access from rivals, the Agencies examine whether the reduction in profits would prevent the full range of reasonably probable strategies to limit access. When evaluating whether this rebuttal evidence is sufficient to conclude that no substantial lessening of competition is threatened by the merger, the Agencies will give little weight to claims that are not supported by an objective analysis, including, for example, speculative claims about reputational harms. Moreover, the Agencies are unlikely to credit claims or commitments to protect or otherwise avoid weakening the merged firm’s rivals that do not align with the firm’s incentives. The Agencies’ assessment will be consistent with the principle that firms act to maximize their overall profits and valuation rather than the profits of any particular business

30 See Brown Shoe, 370 U.S. at 328 (“If the share of the market foreclosed is so large that it approaches monopoly proportions, the Clayton Act will, of course, have been violated . . . .”). The Agencies will generally infer, in the absence of countervailing evidence, that the merging firm has or is approaching monopoly power in the related product if it has a share greater than 50% of the related product market. A merger involving a related product with share of less than 50% may still substantially lessen competition, particularly when that related product is important to its trading partners. 31 A common rebuttal argument is that the merger would lead to vertical integration of complementary products and as a result, “eliminate double marginalization,” since in specific circumstances such a merger can confer on the merged firm an incentive to decrease prices to purchasers. The Agencies examine whether elimination of double marginalization satisfies the approach to evaluating procompetitive efficiencies in Section 3.3, including examining: (a) whether the merged firm will be more vertically integrated as a result of the merger, for example because it increases the extent to which it uses internal production of an input when producing output for the relevant market; (b) whether contracts short of a merger have eliminated or could eliminate double marginalization such that it would not be merger-specific, and (c) whether the merged firm has the incentive to reduce price in the relevant market given that such a reduction would reduce sales by the merged firm’s rivals in the relevant market, which would in turn lead to reduced revenue and margin on sales of the related product to the dependent rivals.

Page 103

unit. A merger may substantially lessen competition or tend to create a monopoly regardless of the claimed intent of the merging companies or their executives. (See Section 4.1) If the merged firm has the ability and incentive to limit access to the related product and lessen competition in the relevant market, there are many ways it could act on those incentives. The merging parties may put forward evidence that there are no reasonably probable ways in which they could profitably limit access to the related product and thereby make it harder for rivals to compete, or that the merged firm will be more competitive because of the merger.

2.5.B. Mergers Involving Visibility into Rivals’ Competitively Sensitive Information If rivals would continue to access or purchase a related product controlled by the merged firm post-merger, the merger can substantially lessen competition if the merged firm would gain or increase visibility into rivals’ competitively sensitive information. This situation could arise in many settings, including, for example, if the merged firm learns about rivals’ sales volumes or projections from supplying an input or a complementary product; if it learns about promotion plans and anticipated product improvements or innovations from its role as a distributor; or if it learns about entry plans from discussions with potential rivals about compatibility or interoperability with a complementary product it controls. A merger that gives the merged firm increased visibility into competitively sensitive information could undermine rivals’ ability or incentive to compete aggressively or could facilitate coordination.

Undermining Competition. The merged firm might use visibility into a rival’s competitively sensitive information to undermine competition from the rival. For example, the merged firm’s ability to preempt, appropriate, or otherwise undermine the rival’s procompetitive actions can discourage the rival from fully pursuing competitive opportunities. Relatedly, rivals might refrain from doing business with the merged firm rather than risk that the merged firm would use their competitively sensitive business information to undercut them. Those rivals might become less-effective competitors if they must rely on less-preferred trading partners or accept less favorable trading terms because their outside options have worsened or are more limited.

Facilitating Coordination. A merger that provides access to rivals’ competitively sensitive information might facilitate coordinated interaction among firms in the relevant market by allowing the merged firm to observe its rivals’ competitive strategies faster and more confidently. (See Guideline 3.) 2.5.C. Mergers that Threaten to Limit Rivals’ Access and Thereby Create Barriers to Entry and Competition When a merger gives a firm the ability and incentive to limit rivals’ access, or where it gives the merged firm increased visibility into its rivals’ competitively sensitive information, the merger may create entry barriers as described above. In addition, the merged firm’s rivals might change their behavior because of the risk that the merged firm could limit their access. That is, the risk that the merger will give a firm the ability and incentive to limit rivals’ access or will give the merged firm increased visibility into sensitive information can dissuade rivals from entering the market or expanding their operations.

Rivals or potential rivals that face the threat of foreclosure, or the risk of sharing sensitive information with rivals, may reduce investment or adjust their business strategies in ways that lessen competition. Firms may be reluctant to invest in a market if their success is dependent on continued supply from a rival, particularly because the merged firm may become more likely to foreclose its

Page 104

competitor as that competitor becomes more successful. Firms may use expensive strategies to try to reduce their dependence on the merged firm, weakening the competitiveness of their products and services. Even if the merged firm does not deliberately seek to weaken rivals, rivals or potential rivals may fear that their access will be limited if the merged firm decides to use its own products exclusively. These effects may occur irrespective of the merged firm’s incentive to limit access and are greater as the merged firm gains greater control over more important inputs that those rivals use to compete. 2.6. Guideline 6: Mergers Can Violate the Law When They Entrench or Extend a Dominant Position.

The Agencies consider whether a merger may entrench or extend an already dominant position. The effect of such mergers “may be substantially to lessen competition” or “may be . . . to tend to create a monopoly” in violation of Section 7 of the Clayton Act. Indeed, the Supreme Court has explained that a merger involving an “already dominant[] firm may substantially reduce the competitive structure of the industry by raising entry barriers.”32 The Agencies also evaluate whether the merger may extend that dominant position into new markets.33 Mergers that entrench or extend a dominant position can also violate Section 2 of the Sherman Act.34 At the same time, the Agencies distinguish anticompetitive entrenchment from growth or development as a consequence of increased competitive capabilities or incentives.35 The Agencies therefore seek to prevent those mergers that would entrench or extend a dominant position through exclusionary conduct, weakening competitive constraints, or otherwise harming the competitive process.

To undertake this analysis, the Agencies first assess whether one of the merging firms has a dominant position based on direct evidence or market shares showing durable market power. For example, the persistence of market power can indicate that entry barriers exist, that further entrenchment may tend to create a monopoly, and that there would be substantial benefits from the emergence of new competitive constraints or disruptions. The Agencies consider mergers involving dominant firms in the context of evidence about the sources of that dominance, focusing on the extent to which the merger relates to, reinforces, or supplements these sources.

Creating or preserving dominance and the profits it brings can be an important motivation for a firm to undertake an acquisition as well as a driver of the merged firm’s behavior after the acquisition. In particular, a firm may be willing to undertake costly short-term strategies in order to increase the chance that it can enjoy the longer-term benefits of dominance. A merger that creates or preserves dominance may also reduce the merged firm’s longer-term incentives to improve its products and services.

A merger can result in durable market power and long-term harm to competition even when it initially provides short-term benefits to some market participants. Thus, the Agencies will consider not just the impact of the merger holding fixed factors like product quality and the behavior of other industry participants, but they may also consider the (often longer term) impact of the merger on market

32 FTC v. Procter & Gamble Co., 386 U.S. 568, 577-578 (1967); see, e.g., Fruehauf, 603 F.2d at 353 (the “entrenchment of a large supplier or purchaser” can be an “essential” showing of a Section 7 violation). 33 Ford, 405 U.S. at 571 (condemning acquisition by dominant firm to obtain a foothold in another market when coupled with incentive to create and maintain barriers to entry into that market). 34 See, e.g., United States v. Grinnell Corp., 384 U.S. 563 (1966) (acquisitions are among the types of conduct that may violate the Sherman Act).

35 See, e.g., id. at 570-71.

Page 105

power and industry dynamics. Important dynamic competitive effects can arise through the entry, investment, innovation, and terms offered by the merged firm and other industry participants, even when the Agencies cannot predict specific reactions and responses with precision. If the ultimate result of the merger is to protect or preserve dominance by limiting opportunities for rivals, reducing competitive constraints, or preventing competitive disruption, then the Agencies will approach the merger with a heightened degree of scrutiny. The degree of scrutiny and concern will increase in proportion to the strength and durability of the dominant firm’s market power. 2.6.A. Entrenching a Dominant Position Raising Barriers to Entry or Competition. A merger may create or enhance barriers to entry or expansion by rivals that limit the capabilities or competitive incentives of other firms. Barriers to entry can entrench a dominant position even if the nature of future entry is uncertain, if the identities of future entrants are unknown, or if there is more than one mechanism through which the merged firm might create entry barriers. Some examples of ways in which a merger may raise barriers to entry or competition include:

 Increasing Switching Costs. The costs associated with changing suppliers (often referred to as switching costs) can be an important barrier to competition. A merger may increase switching costs if it makes it more difficult for customers to switch away from the dominant firm’s product or service, or when it gives the dominant firm control of something customers use to switch providers or of something that lowers the overall cost to customers of switching providers. For example, if a dominant firm merges with a complementary product that interoperates with the dominant firm’s competitors, it could reduce interoperability, harming competition for customers who value the complement.

 Interfering With the Use of Competitive Alternatives. A dominant position may be threatened by a service that customers use to work with multiple providers of similar or overlapping bundles of products and services. If a dominant firm acquires a service that supports the use of multiple providers, it could degrade its utility or availability or could modify the service to steer customers to its own products, entrenching its dominant position. For example, a closed messaging communication service might acquire a product that allowed users to send and receive messages over several competing services through a single user interface, which facilitates competition. The Agencies would examine whether the acquisition would entrench the messaging service’s market power by leading the merged firm to degrade the product or otherwise reduce its effectiveness as a cross-service tool, thus reducing competition.  Depriving Rivals of Scale Economies or Network Effects. Scale economies and network effects can serve as a barrier to entry and competition. Depriving rivals of access to scale economies and network effects can therefore entrench a dominant position. If a merger enables a dominant firm to reduce would-be rivals’ access to additional scale or customers by acquiring a product that affects access such as a customer acquisition channel, the merged firm can limit the ability of rivals to improve their own products and compete more effectively.36 Limiting access by rivals to customers in the short run can lead to long run entrenchment of a dominant position and tend to create monopoly power.

36 The Agencies’ focus here is on the artificial acquisition of network participants that occurs directly as a result of the merger, as opposed to future network growth that may occur through competition on the merits.

Page 106

For example, if two firms operate in a market in which network effects are significant but in which rivals voluntarily interconnect, their merger can create an entity with a large enough user base that it may have the incentive to end voluntary interconnection. Such a strategy can lessen competition and harm trading partners by creating or entrenching dominance in this market. This can be the case even if the merging firms did not appear to have a dominant position prior to the merger because their interoperability practices strengthened rivals. Eliminating a Nascent Competitive Threat. A merger may involve a dominant firm acquiring a nascent competitive threat—namely, a firm that could grow into a significant rival, facilitate other rivals’ growth, or otherwise lead to a reduction in its power.37 In some cases, the nascent threat may be a firm that provides a product or service similar to the acquiring firm that does not substantially constrain the acquiring firm at the time of the merger but has the potential to grow into a more significant rival in the future. In other cases, factors such as network effects, scale economies, or switching costs may make it extremely difficult for a new entrant to offer all of the product features or services at comparable quality and terms that an incumbent offers. The most likely successful threats in these situations can be firms that initially avoid directly entering the dominant firm’s market, instead specializing in (a) serving a narrow customer segment, (b) offering services that only partially overlap with those of the incumbent, or (c) serving an overlapping customer segment with distinct products or services. Firms with niche or only partially overlapping products or customers can grow into longer-term threats to a dominant firm. Once established in its niche, a nascent threat may be able to add features or serve additional customer segments, growing into greater overlap of customer segments or features over time, thereby intensifying competition with the dominant firm. A nascent threat may also facilitate customers aggregating additional products and services from multiple providers that serve as a partial alternative to the incumbent’s offering. Thus, the success and independence of the nascent threat may both provide for a direct threat of competition by the niche or nascent firm and may facilitate competition or encourage entry by other, potentially complementary providers that may provide a partial competitive constraint. In this way, the nascent threat supports what may be referred to as “ecosystem” competition. In this context, ecosystem competition refers to a situation where an incumbent firm that offers a wide array of products and services may be partially constrained by other combinations of products and services from one or more providers, even if the business model of those competing services is different.

Nascent threats may be particularly likely to emerge during technological transitions. Technological transitions can render existing entry barriers less relevant, temporarily making incumbents susceptible to competitive threats. For example, technological transitions can create temporary opportunities for entrants to differentiate or expand their offerings based on their alignment with new technologies, enabling them to capture network effects that otherwise insulate incumbents from competition. A merger in this context may lessen competition by preventing or delaying any such beneficial shift or by shaping it so that the incumbent retains its dominant position. For example, a dominant firm might seek to acquire firms to help it reinforce or recreate entry barriers so that its dominance endures past the technological transition. Or it might seek to acquire nascent threats that might otherwise gain sufficient customers to overcome entry barriers. In evaluating the potential for entrenching dominance, the Agencies take particular care to preserve opportunities for more competitive markets to emerge during such technological shifts.

37 The Agencies assess acquisitions of nascent competitive threats by non-dominant firms under the other Guidelines.

Page 107

Separate from and in addition to its Section 7 analysis, the Agencies will consider whether the merger violates Section 2 of the Sherman Act. For example, under Section 2 of the Sherman Act, a firm that may challenge a monopolist may be characterized as a “nascent threat” even if the impending threat is uncertain and may take several years to materialize.38 The Agencies assess whether the merger is reasonably capable of contributing significantly to the preservation of monopoly power in violation of Section 2, which turns on whether the acquired firm is a nascent competitive threat.39 2.6.B. Extending a Dominant Position into Another Market The Agencies also examine the risk that a merger could enable the merged firm to extend a dominant position from one market into a related market, thereby substantially lessening competition or tending to create a monopoly in the related market. For example, the merger might lead the merged firm to leverage its position by tying, bundling, conditioning, or otherwise linking sales of two products. A merger may also raise barriers to entry or competition in the related market, or eliminate a nascent competitive threat, as described above. For example, prior to a merger, a related market may be characterized by scale economies but still experience moderate levels of competition. If the merged firm takes actions to induce customers of the dominant firm’s product to also buy the related product from the merged firm, the merged firm may be able to gain dominance in the related market, which may be supported by increased barriers to entry or competition that result from the merger. These concerns can arise notwithstanding that the acquiring firm already enjoys the benefits associated with its dominant position. The prospect of market power in the related market may strongly affect the merged firm’s incentives in a way that does not align with the interests of its trading partners, both in terms of strategies that create dominance for the related product and in the form of reduced incentives to invest in its products or provide attractive terms for them after dominance is attained. In some cases, the merger may also further entrench the firm’s original dominant position, for example if future competition requires the provision of both products.

* * * If the merger raises concerns that its effect may be to entrench or extend a dominant position, then any claim that the merger also provides competitive benefits will be evaluated under the rebuttal framework in Section 3. For example, the framework of Section 3 would be used to evaluate claims that a merger would generate cost savings or quality improvements that would be passed through to make their products more competitive or would otherwise create incentives for the merged firm to offer better terms. The Agencies’ analysis will consider the fact that the incentives to pass through benefits to customers or offer attractive terms are affected by competition and the extent to which entry barriers insulate the merged firm from effective competition. It will also consider whether any claimed benefits are specific to the merger, or whether they could be instead achieved through contracting or other means.

38 United States v. Microsoft Corp., 253 F.3d 34 (D.C. Cir. 2001) (en banc) (per curiam). 39 See id. at 79 (“[I]t would be inimical to the purpose of the Sherman Act to allow monopolists free reign to squash nascent, albeit unproven, competitors at will. . . .”).

Page 108

2.7. Guideline 7: When an Industry Undergoes a Trend Toward Consolidation, the Agencies Consider Whether It Increases the Risk a Merger May Substantially Lessen Competition or Tend to Create a Monopoly.

The recent history and likely trajectory of an industry can be an important consideration when assessing whether a merger presents a threat to competition. The Supreme Court has explained that “a trend toward concentration in an industry, whatever its causes, is a highly relevant factor in deciding how substantial the anticompetitive effect of a merger may be.”40 It has also underscored that “Congress intended Section 7 to arrest anticompetitive tendencies in their incipiency.41 The Agencies therefore examine whether a trend toward consolidation in an industry would heighten the competition concerns identified in Guidelines 1-6.

The Agencies therefore closely examine industry consolidation trends in applying the frameworks above. For example:

Trend Toward Concentration. If an industry has gone from having many competitors to becoming concentrated, it may suggest greater risk of harm, for example, because new entry may be less likely to replace or offset the lessening of competition the merger may cause. Among other implications, in the context of a trend toward concentration, the Agencies identify a stronger presumption of harm from undue concentration (see Guideline 1), and a greater risk of substantially lessening competition when a merger eliminates competition between the merging parties (see Guideline 2) or increases the risk of coordination (see Guideline 3).

Trend Toward Vertical Integration. The Agencies will generally consider evidence about the degree of integration between firms in the relevant and related markets and whether there is a trend toward further vertical integration. If a merger occurs amidst or furthers a trend toward vertical integration, the Agencies consider the implications for the competitive dynamics of the industry moving forward. For example, a trend toward vertical integration could magnify the concerns discussed in Guideline 5 by making entry at a single level more difficult and thereby preventing the emergence of new competitive threats over time.

Arms Race for Bargaining Leverage. The Agencies sometimes encounter mergers through which the merging parties would, by consolidating, gain bargaining leverage over other firms that they transact with. This can encourage those other firms to consolidate to obtain countervailing leverage, encouraging a cascade of further consolidation. This can ultimately lead to an industry where a few powerful firms have leverage against one another and market power over would-be entrants or over trading partners in various parts of the value chain. For example, distributors might merge to gain leverage against suppliers, who then merge to gain leverage against distributors, spurring a wave of mergers that lessen competition by increasing the market power of both. This can exacerbate the problems discussed in Guidelines 1-6, including by increasing barriers to single-level entry, encouraging coordination, and discouraging disruptive innovation.

40 United States v. Pabst Brewing, 384 U.S. 546, 552-53 (1966). 41 Phila. Nat’l Bank, 374 U.S. at 362 (quoting Brown Shoe, 370 U.S. at 317).

Page 109

Multiple Mergers. The Agencies sometimes see multiple mergers at once or in succession by different players in the same industry. In such cases, the Agencies may examine multiple deals in light of the combined trend toward concentration.

2.8. Guideline 8: When a Merger is Part of a Series of Multiple Acquisitions, the Agencies May Examine the Whole Series.

A firm that engages in an anticompetitive pattern or strategy of multiple acquisitions in the same or related business lines may violate Section 7.42 In these situations, the Agencies may evaluate the series of acquisitions as part of an industry trend (see Guideline 7) or evaluate the overall pattern or strategy of serial acquisitions by the acquiring firm collectively under Guidelines 1-6. In expanding antitrust law beyond the Sherman Act through passage of the Clayton Act, Congress intended “to permit intervention in a cumulative process when the effect of an acquisition may be a significant reduction in the vigor of competition, even though this effect may not be so far-reaching as to amount to a combination in restraint of trade, create a monopoly, or constitute an attempt to monopolize.”43 As the Supreme Court has recognized, a cumulative series of mergers can “convert an industry from one of intense competition among many enterprises to one in which three or four large [companies] produce the entire supply.”44 Accordingly, the Agencies will consider individual acquisitions in light of the cumulative effect of related patterns or business strategies. The Agencies may examine a pattern or strategy of growth through acquisition by examining both the firm’s history and current or future strategic incentives. Historical evidence focuses on the strategic approach taken by the firm to acquisitions (consummated or not), both in the markets at issue and in other markets, to reveal any overall strategic approach to serial acquisitions. Evidence of the firm’s current incentives includes documents and testimony reflecting its plans and strategic incentives both for the individual acquisition and for its position in the industry more broadly. Where one or both of the merging parties has engaged in a pattern or strategy of pursuing consolidation through acquisition, the Agencies will examine the impact of the cumulative strategy under any of the other Guidelines to determine if that strategy may substantially lessen competition or tend to create a monopoly. 2.9. Guideline 9: When a Merger Involves a Multi-Sided Platform, the Agencies Examine Competition Between Platforms, on a Platform, or to Displace a Platform.

Platforms provide different products or services to two or more different groups or “sides” who may benefit from each other’s participation. Mergers involving platforms can threaten competition, even when a platform merges with a firm that is neither a direct competitor nor in a traditional vertical relationship with the platform. When evaluating a merger involving a platform, the Agencies apply Guidelines 1-6 while accounting for market realities associated with platform competition. Specifically,

42 Such strategies may also violate Section 2 of the Sherman Act and Section 5 of the FTC Act. Fed. Trade Comm’n, Policy Statement Regarding the Scope of Unfair Methods of Competition Under Section 5 of the Federal Trade Commission Act, at 12-14 & nn.73 & 82 (Nov. 10, 2022) (noting that “a series of . . . acquisitions . . . that tend to bring about the harms that the antitrust laws were designed to prevent” has been subject to liability under Section 5). 43 H.R. Rep. No. 81-1191, at 8 (1949).

44 See Brown Shoe, 370 U.S. at 334 (citing S. Rep. No. 81-1775, at 5 (1950); H.R. Rep. No. 81-1191, at 8 (1949)).

Page 110

the Agencies consider competition between platforms, competition on a platform, and competition to displace the platform.

Multi-sided platforms generally have several attributes in common, though they can also vary in important ways. Some of these attributes include:

 Platforms have multiple sides. On each side of a platform, platform participants provide or use distinct products and services.45 Participants can provide or use different types of products or services on each side.

 A platform operator provides the core services that enable the platform to connect participant groups across multiple sides. The platform operator controls other participants’ access to the platform and can influence how interactions among platform participants play out.  Each side of a platform includes platform participants. Their participation might be as simple as using the platform to find other participants, or as involved as building platform services that enable other participants to connect in new ways and allow new participants to join the platform.

 Network effects occur when platform participants contribute to the value of the platform for other participants and the operator. The value for groups of participants on one side may depend on the number of participants either on the same side (direct network effects) or on the other side(s) (indirect network effects).46 Network effects can create a tendency toward concentration in platform industries. Indirect network effects can be asymmetric and heterogeneous; for example, one side of the market or segment of participants may place relatively greater value on the other side(s).

 A conflict of interest can arise when a platform operator is also a platform participant. The Agencies refer to a “conflict of interest” as the divergence that can arise between the operator’s incentives to operate the platform as a forum for competition and its incentive to operate as a competitor on the platform itself. As discussed below, a conflict of interest sometimes exacerbates competitive concerns from mergers.

Consistent with the Clayton Act’s protection of competition “in any line of commerce,” the Agencies will seek to prohibit a merger that harms competition within a relevant market for any product or service offered on a platform to any group of participants—i.e., around one side of the platform (see Section 4.3).47

45 For example, on 1990s operating-system platforms for personal computer (PC) software, software developers were on one side, PC manufacturers on another, and software purchasers on another. 46 For example, 1990s PC manufacturers, software developers, and consumers all contributed to the value of the operating system platform for one another.

47 In the limited scenario of a “special type of two-sided platform known as a ‘transaction’ platform,” under Section 1 of the Sherman Act, a relevant market encompassing both sides of a two-sided platform may be warranted. Ohio v. American Express Co., 138 S. Ct. 2274, 2280 (2018). This approach to Section 1 of the Sherman Act is limited to platforms with the “key feature . . . that they cannot make a sale to one side of the platform without simultaneously making a sale to the other.” Id. Because “they cannot sell transaction services to [either user group] individually . . . transaction platforms are better understood as supplying only one product—transactions.” Id. at 2286. This characteristic is not present for many types of two-sided or multi-sided platforms; in addition, many platforms offer simultaneous transactions as well as other products and services, and further they may bundle these products with access to transact on the platform or offer quantity discounts.

Page 111

The Agencies protect competition between platforms by preventing the acquisition or exclusion of other platform operators that may substantially lessen competition or tend to create a monopoly. This scenario can arise from various types of mergers:

A. Mergers involving two platform operators eliminate the competition between them. In a market with a platform, entry or growth by smaller competing platforms can be particularly challenging because of network effects. A common strategy for smaller platforms is to specialize, providing distinctive features. Thus, dominant platforms can lessen competition and entrench their position by systematically acquiring firms competing with one or more sides of a multi-sided platform while they are in their infancy. The Agencies seek to stop these trends in their incipiency.

B. A platform operator may acquire a platform participant, which can entrench the operator’s position by depriving rivals of participants and, in turn, depriving them of network effects. For example, acquiring a major seller on a platform may make it harder for rival platforms to recruit buyers. The long-run benefits to a platform operator of denying network effects to rival platforms create a powerful incentive to withhold or degrade those rivals’ access to platform participants that the operator acquires. The more powerful the platform operator, the greater the threat to competition presented by mergers that may weaken rival operators or increase barriers to entry and expansion.

C. Acquisitions of firms that provide services that facilitate participation on multiple platforms can deprive rivals of platform participants. Many services can facilitate such participation, such as tools that help shoppers compare prices across platforms, applications that help sellers manage listings on multiple platforms, or software that helps users switch among platforms.

D. Mergers that involve firms that provide other important inputs to platform services can enable the platform operator to deny rivals the benefits of those inputs. For example, acquiring data that helps facilitate matching, sorting, or prediction services may enable the platform to weaken rival platforms by denying them that data. The Agencies protect competition on a platform in any markets that interact with the platform. When a merger involves a platform operator and platform participants, the Agencies carefully examine whether the merger would create conflicts of interest that would harm competition. A platform operator that is also a platform participant may have a conflict of interest whereby it has an incentive to give its own products and services an advantage over other participants competing on the platform. Platform operators must often choose between making it easy for users to access their preferred products and directing those users to products that instead provide greater benefit to the platform operator. Merging with a firm that makes a product offered on the platform may change how the platform operator balances these competing interests. For example, the platform operator may find it is more profitable to give its own product greater prominence even if that product is inferior or is offered on worse terms after the merger—and even if some participants leave the platform as a result.48 This can harm competition in

48 However, few participants will leave if, for example, the switching costs are relatively high or if the advantaged product is a small component of the overall set of services those participants access on the platform. Moreover, in the long run few participants will leave if scale economies, network effects, or entry barriers enable the advantaged product to eventually gain market power of its own, with rivals of the advantaged product exiting or becoming less attractive. After these dynamics play

Page 112

the product market for the advantaged product, where the harm to competition may be experienced both on the platform and in other channels.

The Agencies protect competition to displace the platform or any of its services. For example, new technologies or services may create an important opportunity for firms to replace one or more services the incumbent platform operator provides, shifting some participants to partially or fully meet their needs in different ways or through different channels. Similarly, a non-platform service can lessen dependence on the platform by providing an alternative to one or more functions provided by the platform operators. When platform owners are dominant, the Agencies seek to prevent even relatively small accretions of power from inhibiting the prospects for displacing the platform or for decreasing dependency on the platform.

In addition, a platform operator that advantages its own products that compete on the platform can lessen competition between platforms and to displace the platform, as the operator may both advantage its own product or service, and also deprive rival platforms of access to it, limiting those rivals’ network effects.

2.10. Guideline 10: When a Merger Involves Competing Buyers, the Agencies Examine Whether It May Substantially Lessen Competition for Workers, Creators, Suppliers, or Other Providers.

A merger between competing buyers may harm sellers just as a merger between competing sellers may harm buyers.49 The same—or analogous—tools used to assess the effects of a merger of sellers can be used to analyze the effects of a merger of buyers, including employers as buyers of labor. Firms can compete to attract contributions from a wide variety of workers, creators, suppliers, and service providers. The Agencies protect this competition in all its forms. A merger of competing buyers can substantially lessen competition by eliminating the competition between the merging buyers or by increasing coordination among the remaining buyers. It can likewise lead to undue concentration among buyers or entrench or extend the position of a dominant buyer. Competition among buyers can have a variety of beneficial effects analogous to competition among sellers. For example, buyers may compete by raising the payments offered to suppliers, by expanding supply networks, through transparent and predictable contracting, procurement, and payment practices, or by investing in technology that reduces frictions for suppliers. In contrast, a reduction in competition among buyers can lead to artificially suppressed input prices or purchase volume, which in turn reduces incentives for suppliers to invest in capacity or innovation. Labor markets are important buyer markets. The same general concerns as in other markets apply to labor markets where employers are the buyers of labor and workers are the sellers. The Agencies will consider whether workers face a risk that the merger may substantially lessen competition for their labor.50 Where a merger between

out, the platform operator could advantage its own products without losing as many participants, as there would be fewer alternative products available through other channels.

49 See, e.g., Mandeville Island Farms, Inc. v. Am. Crystal Sugar Co., 334 U.S. 219, 235-36 (1948) (“The [Sherman Act] does not confine its protection to consumers, or to purchasers, or to competitors, or to sellers. . . . The Act is comprehensive in its terms and coverage, protecting all who are made victims of the forbidden practices by whomever they may be perpetrated.”). 50 See, e.g., Alston, 141 S. Ct. 2141 (applying the Sherman Act to protect workers from an employer-side agreement to limit compensation).

Page 113

employers may substantially lessen competition for workers, that reduction in labor market competition may lower wages or slow wage growth, worsen benefits or working conditions, or result in other degradations of workplace quality.51 When assessing the degree to which the merging firms compete for labor, evidence that a merger may have any one or more of these effects can demonstrate that substantial competition exists between the merging firms.

Labor markets frequently have characteristics that can exacerbate the competitive effects of a merger between competing employers. For example, labor markets often exhibit high switching costs and search frictions due to the process of finding, applying, interviewing for, and acclimating to a new job. Switching costs can also arise from investments specific to a type of job or a particular geographic location. Moreover, the individual needs of workers may limit the geographical and work scope of the jobs that are competitive substitutes.

In addition, finding a job requires the worker and the employer to agree to the match. Even within a given salary and skill range, employers often have specific demands for the experience, skills, availability, and other attributes they desire in their employees. At the same time, workers may seek not only a paycheck but also work that they value in a workplace that matches their own preferences, as different workers may value the same aspects of a job differently. This matching process often narrows the range of rivals competing for any given employee. The level of concentration at which competition concerns arise may be lower in labor markets than in product markets, given the unique features of certain labor markets. In light of their characteristics, labor markets can be relatively narrow. The features of labor markets may in some cases put firms in dominant positions. To assess this dominance in labor markets (see Guideline 6), the Agencies often examine the merging firms’ power to cut or freeze wages, slow wage growth, exercise increased leverage in negotiations with workers, or generally degrade benefits and working conditions without prompting workers to quit. If the merger may substantially lessen competition or tend to create a monopoly in upstream markets, that loss of competition is not offset by purported benefits in a separate downstream product market. Because the Clayton Act prohibits mergers that may substantially lessen competition or tend to create a monopoly in any line of commerce and in any section of the country, a merger’s harm to competition among buyers is not saved by benefits to competition among sellers. That is, a merger can substantially lessen competition in one or more buyer markets, seller markets, or both, and the Clayton Act protects competition in any one of them.52 If the parties claim any benefits to competition in a relevant buyer market, the Agencies will assess those claims using the frameworks in Section 3. Just as they do when analyzing competition in the markets for products and services, the Agencies will analyze labor market competition on a case-by-case basis.

51 A decrease in wages is understood as relative to what would have occurred in the absence of the transaction; in many cases, a transaction will not reduce wage levels, but rather slow wage growth. Wages encompass all aspects of pecuniary compensation, including benefits. Job quality encompasses non-pecuniary aspects that workers value, such as working conditions and terms of employment.

52 Often, mergers that harm competition among buyers also harm competition among sellers as a result. For example, when a monopsonist lowers purchase prices by decreasing input purchases, they will generally decrease sales in downstream markets as well. (See Section 4.2.D)

Page 114

2.11. Guideline 11: When an Acquisition Involves Partial Ownership or Minority Interests, the Agencies Examine Its Impact on Competition. In many acquisitions, two companies come under common control. In some situations, however, the acquisition of less-than-full control may still influence decision-making at the target firm or another firm in ways that may substantially lessen competition. Acquisitions of partial ownership or other minority interests may give the investor rights in the target firm, such as rights to appoint board members, observe board meetings, influence the firm’s ability to raise capital, impact operational decisions, or access competitively sensitive information. The Agencies have concerns with both crossownership, which refers to holding a non-controlling interest in a competitor, as well as common ownership, which occurs when individual investors hold non-controlling interests in firms that have a competitive relationship that could be affected by those joint holdings. Partial acquisitions that do not result in control may nevertheless present significant competitive concerns. The acquisition of a minority position may permit influence of the target firm, implicate strategic decisions of the acquirer with respect to its investment in other firms, or change incentives so as to otherwise dampen competition. The post-acquisition relationship between the parties and the independent incentives of the parties outside the acquisition may be important in determining whether the partial acquisition may substantially lessen competition. Such partial acquisitions are subject to the same legal standard as any other acquisition.53 The Agencies recognize that cross-ownership and common ownership can reduce competition by softening firms’ incentives to compete, even absent any specific anticompetitive act or intent. While the Agencies will consider any way in which a partial acquisition may affect competition, they generally focus on three principal effects:

First, a partial acquisition can lessen competition by giving the partial owner the ability to influence the competitive conduct of the target firm.54 For example, a voting interest in the target firm or specific governance rights, such as the right to appoint members to the board of directors, influence capital budgets, determine investment return thresholds, or select particular managers, can create such influence. Additionally, a nonvoting interest may, in some instances, provide opportunities to prevent, delay, or discourage important competitive initiatives, or otherwise impact competitive decision making. Such influence can lessen competition because the partial owner could use its influence to induce the target firm to compete less aggressively or to coordinate its conduct with that of the acquiring firm. Second, a partial acquisition can lessen competition by reducing the incentive of the acquiring firm to compete.55 Acquiring a minority position in a rival might blunt the incentive of the partial owner to compete aggressively because it may profit through dividend or other revenue share even when it loses business to the rival. For example, the partial owner may decide not to develop a new product feature to win market share from the firm in which it has acquired an interest, because doing so will

53 See United States v. E. I. du Pont de Nemours & Co., 353 U.S. 586, 592 (1957) (“[A]ny acquisition by one corporation of all or any part of the stock of another corporation, competitor or not, is within the reach of [Section 7 of the Clayton Act] whenever the reasonable likelihood appears that the acquisition will result in a restraint of commerce or in the creation of a monopoly of any line of commerce.”).

54 See United States v. Dairy Farmers of Am., Inc., 426 F.3d 850, 860-61 (6th Cir. 2005). 55 See Denver & Rio Grande v. United States, 387 U.S. 485, 504 (1967) (identifying Section 7 concerns with a 20% investment).

Page 115

reduce the value of its investment in its rival. This reduction in the incentive of the acquiring firm to compete arises even when it cannot directly influence the conduct or decision making of the target firm. Third, a partial acquisition can lessen competition by giving the acquiring firm access to nonpublic, competitively sensitive information from the target firm. Even absent any ability to influence the conduct of the target firm, access to competitively sensitive information can substantially lessen competition through other mechanisms. For example, it can enhance the ability of the target and the partial owner to coordinate their behavior and make other accommodating responses faster and more targeted. The risk of coordinated effects is greater if the transaction also facilitates the flow of competitively sensitive information from the investor to the target firm. Even if coordination does not occur, the partial owner may use that information to preempt or appropriate a rival’s competitive business strategies for its own benefit. If rivals know their efforts to win trading partners can be immediately appropriated, they may see less value in taking competitive actions in the first place, resulting in a lessening of competition.

* * * The analyses above address common scenarios that the Agencies use to assess the risk that a merger may substantially lessen competition or tend to create a monopoly. However, they are not exhaustive. The Agencies have in the past encountered mergers that lessen competition through mechanisms not covered above. For example:

A. A merger that would enable firms to avoid a regulatory constraint because that constraint was applicable to only one of the merging firms;

B. A merger that would enable firms to exploit a unique procurement process that favors the bids of a particular competitor who would be acquired in the merger; or C. In a concentrated market, a merger that would dampen the acquired firm’s incentive or ability to compete due to the structure of the acquisition or the acquirer. As these scenarios and these Guidelines indicate, a wide range of evidence can show that a merger may lessen competition or tend to create a monopoly. Whatever the sources of evidence, the Agencies look to the facts and the law in each case.

Whatever frameworks the Agencies use to identify that a merger may substantially lessen competition or tend to create a monopoly, they also examine rebuttal evidence under the framework in Section 3.

Page 116

3. Rebuttal Evidence Showing that No Substantial Lessening of Competition is Threatened by the Merger The Agencies may assess whether a merger may substantially lessen competition or tend to create a monopoly based on a fact-specific analysis under any one or more of the Guidelines discussed above.56 The Supreme Court has determined that analysis should consider “other pertinent factors” that may “mandate[] a conclusion that no substantial lessening of competition [is] threatened by the acquisition.”57 The factors pertinent to rebuttal depend on the nature of the threat to competition or tendency to create a monopoly resulting from the merger. Several common types of rebuttal and defense evidence are subject to legal tests established by the courts. The Agencies apply those tests consistent with prevailing law, as described below. 3.1. Failing Firms When merging parties suggest the weak or weakening financial position of one of the merging parties will prevent a lessening of competition, the Agencies examine that evidence under the “failing firm” defense established by the Supreme Court. This defense applies when the assets to be acquired would imminently cease playing a competitive role in the market even absent the merger. As set forth by the Supreme Court, the failing firm defense has three requirements: A. “[T]he evidence show[s] that the [failing firm] face[s] the grave probability of a business failure.”58 The Agencies typically look for evidence in support of this element that the allegedly failing firm would be unable to meet its financial obligations in the near future. Declining sales and/or net losses, standing alone, are insufficient to show this requirement. B. “The prospects of reorganization of [the failing firm are] dim or nonexistent.”59 The Agencies typically look for evidence suggesting that the failing firm would be unable to reorganize successfully under Chapter 11 of the Bankruptcy Act, taking into account that “companies reorganized through receivership, or through [the Bankruptcy Act] often emerge[] as strong competitive companies.”60 Evidence of the firm’s actual attempts to resolve its debt with creditors is important.

C. “[T]he company that acquires the failing [firm] or brings it under dominion is the only available purchaser.”61 The Agencies typically look for evidence that a company has made unsuccessful good-faith efforts to elicit reasonable alternative offers that pose a less severe danger to competition than does the proposed merger.62

56 See United States v. AT&T, Inc., 916 F.3d at 1032.

57 See United States v. Gen. Dynamics Corp., 415 U.S. 486, 498 (1974); Baker Hughes, 908 F.2d at 990 (quoting General Dynamics and describing its holding as permitting rebuttal based on a “finding that ‘no substantial lessening of competition occurred or was threatened by the acquisition’”).

58 Citizen Publ’g Co. v. United States, 394 U.S. 131, 138 (1969). 59 Id.

60 Id.

61 Id. at 136-39 (quoting Int’l Shoe Co. v. FTC, 280 U.S. 291, 302 (1930)). 62 Any offer to purchase the assets of the failing firm for a price above the liquidation value of those assets will be regarded as a reasonable alternative offer. Parties must solicit reasonable alternative offers before claiming that the business is failing.

Page 117

Although merging parties sometimes argue that a poor or weakening position should serve as a defense even when it does not meet these elements, the Supreme Court has “confine[d] the failing company doctrine to its present narrow scope.”63 The Agencies evaluate evidence of a failing firm consistent with this prevailing law.64 3.2. Entry and Repositioning Merging parties sometimes raise a rebuttal argument that a reduction in competition resulting from the merger would induce entry or repositioning65 into the relevant market, preventing the merger from substantially lessening competition or tending to create a monopoly in the first place. This argument posits that a merger may, by substantially lessening competition, make the market more profitable for the merged firm and any remaining competitors, and that this increased profitability may induce new entry. To evaluate this rebuttal evidence, the Agencies assess whether entry induced by the merger would be “timely, likely, and sufficient in its magnitude, character, and scope to deter or counteract the competitive effects of concern.”66 Timeliness. To show that no substantial lessening of competition is threatened by a merger, entry must be rapid enough to replace lost competition before any effect from the loss of competition due to the merger may occur. Entry in most industries takes a significant amount of time and is therefore insufficient to counteract any substantial lessening of competition that is threatened by a merger. Moreover, the entry must be durable: an entrant that does not plan to sustain its investment or that may exit the market would not ensure long-term preservation of competition. Likelihood. Entry induced by lost competition must be so likely that no substantial lessening of competition is threatened by the merger. Firms make entry decisions based on the market conditions they expect once they participate in the market. If the new entry is sufficient to counteract the merger’s effect on competition, the Agencies analyze why the merger would induce entry that was not planned in pre-merger competitive conditions.

The Agencies also assess whether the merger may increase entry barriers. For example, the merging firms may have a greater ability to discourage or block new entry when combined than they would have as separate firms. Mergers may enable or incentivize unilateral or coordinated exclusionary

Liquidation value is the highest value the assets could command outside the market. If a reasonable alternative offer was rejected, the parties cannot claim that the business is failing. 63 Citizen Publ’g, 394 U.S. at 139.

64 The Agencies do not normally credit claims that the assets of a division would exit the relevant market in the near future unless: (1) applying cost allocation rules that reflect true economic costs, the division has a persistently negative cash flow on an operating basis, and such negative cash flow is not economically justified for the firm by benefits such as added sales in complementary markets or enhanced customer goodwill; and (2) the owner of the failing division has made unsuccessful good-faith efforts to elicit reasonable alternative offers that would keep its assets in the relevant market and pose a less severe danger to competition than does the proposed acquisition. Because firms can allocate costs, revenues, and intra-company transactions among their subsidiaries and divisions, the Agencies require evidence that is not solely based on management plans that could have been prepared for the purpose of demonstrating negative cash flow or the prospect of exit from the relevant market.

65 Repositioning is a supply-side response that is evaluated like entry. If repositioning requires movement of assets from other markets, the Agencies will consider the costs and competitive effects of doing so. Repositioning that would reduce competition in the markets from which products or services are moved is not a cognizable rebuttal for a lessening of competition in the relevant market.

66 FTC v. Sanford Health, 926 F.3d 959, 965 (8th Cir. 2019).

Page 118

strategies that make entry more difficult. Entry can be particularly challenging when a firm must enter at multiple levels of the market at sufficient scale to compete effectively. Sufficiency. Even where timely and likely, the prospect of entry may not effectively prevent a merger from threatening a substantial lessening of competition. Entry may be insufficient due to a wide variety of constraints that limit an entrant’s effectiveness as a competitor. Entry must at least replicate the scale, strength, and durability of one of the merging parties to be considered sufficient. The Agencies typically do not credit entry that depends on lessening competition in other markets. As part of their analysis, the Agencies will consider the economic realities at play. For example, lack of successful entry in the past will likely suggest that entry may be slow or difficult. Recent examples of entry, whether successful or unsuccessful, provide the starting point for identifying the elements of practical entry barriers and the features of the industry that facilitate or interfere with entry. The Agencies will also consider whether the parties’ entry arguments are consistent with the rationale for the merger or imply that the merger itself would be unprofitable. 3.3. Procompetitive Efficiencies The Supreme Court has held that “possible economies [from a merger] cannot be used as a defense to illegality.”67 Competition usually spurs firms to achieve efficiencies internally, and firms also often work together using contracts short of a merger to combine complementary assets without the full anticompetitive consequences of a merger.

Merging parties sometimes raise a rebuttal argument that, notwithstanding other evidence that competition may be lessened, evidence of procompetitive efficiencies shows that no substantial lessening of competition is in fact threatened by the merger. This argument asserts that the merger would not substantially lessen competition in any relevant market in the first place.68 When assessing this argument, the Agencies will not credit vague or speculative claims, nor will they credit benefits outside the relevant market that would not prevent a lessening of competition in the relevant market. Rather, the Agencies examine whether the evidence69 presented by the merging parties shows each of the following:

Merger Specificity. The merger will produce substantial competitive benefits that could not be achieved without the merger under review.70 Alternative ways of achieving the claimed benefits are considered in making this determination. Alternative arrangements could include organic growth of one of the merging firms, contracts between them, mergers with others, or a partial merger involving only those assets that give rise to the procompetitive efficiencies.

67 Phila. Nat’l Bank, 374 U.S. at 371; Procter & Gamble Co., 386 U.S. at 580 (“Congress was aware that some mergers which lessen competition may also result in economies but it struck the balance in favor of protecting competition.”). 68 United States v. Anthem, 855 F.3d 345, 353-55 (D.C. Cir. 2017) (although efficiencies not a “defense” to antitrust liability, evidence sometimes used “to rebut a prima facie case”); Saint Alphonsus Medical Center-Nampa, 778 F.3d at 791 (“The Clayton Act focuses on competition, and the claimed efficiencies therefore must show that the prediction of anticompetitive effects from the prima facie case is inaccurate.”).

69 In general, evidence related to efficiencies developed prior to the merger challenge is much more probative than evidence developed during the Agencies’ investigation or litigation.

70 If inter-firm collaborations are achievable by contract, they are not merger specific. The Agencies will credit the merger specificity of efficiencies only in the presence of evidence that a contract to achieve the asserted efficiencies would not be practical. See Anthem, 855 F.3d at 357.

Page 119

Verifiability. These benefits are verifiable, and have been verified, using reliable methodology and evidence not dependent on the subjective predictions of the merging parties or their agents. Procompetitive efficiencies are often speculative and difficult to verify and quantify, and efficiencies projected by the merging firms often are not realized. If reliable methodology for verifying efficiencies does not exist or is otherwise not presented by the merging parties, the Agencies are unable to credit those efficiencies.

Prevents a Reduction in Competition. To the extent efficiencies merely benefit the merging firms, they are not cognizable. The merging parties must demonstrate through credible evidence that, within a short period of time, the benefits will prevent the risk of a substantial lessening of competition in the relevant market.

Not Anticompetitive. Any benefits claimed by the merging parties are cognizable only if they do not result from the anticompetitive worsening of terms for the merged firm’s trading partners.71 Procompetitive efficiencies that satisfy each of these criteria are called cognizable efficiencies. To successfully rebut evidence that a merger may substantially lessen competition, cognizable efficiencies must be of a nature, magnitude, and likelihood that no substantial lessening of competition is threatened by the merger in any relevant market. Cognizable efficiencies that would not prevent the creation of a monopoly cannot justify a merger that may tend to create a monopoly.

71 The Agencies will not credit efficiencies if they reflect or require a decrease in competition in a separate market. For example, if input costs are expected to decrease, the cost savings will not be treated as an efficiency if they reflect an increase in monopsony power.

Page 120

4. Analytical, Economic, and Evidentiary Tools The analytical, economic, and evidentiary tools that follow can be applicable to many parts of the Agencies’ evaluation of a merger as they apply the factors and frameworks discussed in Sections 2 and 3.

4.1. Sources of Evidence This subsection describes the most common sources of evidence the Agencies draw on in a merger investigation. The evidence the Agencies rely upon to evaluate whether a merger may substantially lessen competition or tend to create a monopoly is weighed based on its probative value. In assessing the available evidence, the Agencies consider documents, testimony, available data, and analysis of those data, including credible econometric analysis and economic modeling. Merging Parties. The Agencies often obtain substantial information from the merging parties, including documents, testimony, and data. Across all of these categories, evidence created in the normal course of business is more probative than evidence created after the company began anticipating a merger review. Similarly, the Agencies give less weight to predictions by the parties or their employees, whether in the ordinary course of business or in anticipation of litigation, offered to allay competition concerns. Where the testimony of outcome-interested merging party employees contradicts ordinary course business records, the Agencies typically give greater weight to the business records. Evidence that the merging parties intend or expect the merger to lessen competition, such as plans to coordinate with other firms, raise prices, reduce output or capacity, reduce product quality or variety, lower wages, cut benefits, exit a market, cancel plans to enter a market without a merger, withdraw products or delay their introduction, or curtail research and development efforts after the merger, can be highly informative in evaluating the effects of a merger on competition. The Agencies give little weight, however, to the lack of such evidence or the expressed contrary intent of the merging parties.

Customers, Workers, Industry Participants, and Observers. Customers can provide a variety of information to the Agencies, ranging from information about their own purchasing behavior and choices to their views about the effects of the merger itself. The Agencies consider the relationship between customers and the merging parties in weighing customer evidence. The ongoing business relationship between a customer and a merging party may discourage the customer from providing evidence inconsistent with the interests of the merging parties.

Workers and representatives from labor organizations can provide information regarding, among other things, wages, non-wage compensation, working conditions, the individualized needs of workers in the market in question, the frictions involved in changing jobs, and the industry in which they work. Similarly, other suppliers, indirect customers, distributors, consultants, and industry analysts can also provide information helpful to a merger inquiry. As with other interested parties, the Agencies give less weight to evidence created in anticipation of a merger investigation and more weight to evidence developed in the ordinary course of business.

Market Effects in Consummated Mergers. Evidence of observed post-merger price increases or worsened terms is given substantial weight. A consummated merger, however, may substantially lessen competition even if such effects have not yet been observed, perhaps because the merged firm may be aware of the possibility of post-merger antitrust review and is therefore moderating its conduct.

Page 121

Consequently, in evaluating consummated mergers, the Agencies also consider the same types of evidence when evaluating proposed mergers.

Econometric Analysis and Economic Modeling. Econometric analysis of data and other types of economic modeling can be informative in evaluating the potential effects of a merger on competition. The Agencies give more weight to analysis using high quality data and adhering to rigorous standards. But the Agencies also take into account that in some cases, the availability or quality of data or reliable modeling techniques might limit the availability and relevance of econometric modeling. When data is available, the Agencies recognize that the goal of economic modeling is not to create a perfect representation of reality, but rather to inform an assessment of the likely change in firm incentives resulting from a merger.

Transaction Terms. The financial terms of the transaction may also be informative regarding a merger’s impact on competition. For example, a purchase price that exceeds the acquired firm’s standalone market value can sometimes indicate that the acquiring firm is paying a premium because it expects to be able to benefit from reduced competition.

4.2. Evaluating Competition Among Firms This subsection discusses evidence and tools the Agencies look to when assessing competition among firms. The evidence and tools in this section can be relevant to a variety of settings, for example: to assess competition between rival firms (Guideline 2); the ability and incentive to limit access to a product rivals use to compete (Guideline 5); or for market definition (Section 4.3), for example when carrying out the Hypothetical Monopolist Test (Section 4.3.A). For clarity, the discussion in this subsection often focuses on competition between two suppliers of substitute products that set prices. Analogous analytic tools may also be relevant in more general settings, for example when considering: competition among more than two suppliers; competition among buyers or employers to procure inputs and labor; competition that derives from customer willingness to buy in different locations; and competition that takes place in dimensions other than price or when terms are determined through, for example, negotiations or auctions. Guideline 2 describes how different types of evidence can be used in assessing the potential harm to competition from a merger; some portions of Guideline 2 that are relevant in other settings are repeated below.

4.2.A. Generally Applicable Considerations The Agencies may consider one or more of the following types of evidence, tools, and metrics when assessing the degree of competition among firms:

Strategic Deliberations or Decisions. The Agencies may analyze the extent of competition among firms, for example between the merging firms, by examining evidence of their strategic deliberations or decisions in the regular course of business. For example, in some markets, the firms may monitor each other’s pricing, marketing campaigns, facility locations, improvements, products, capacity, output, input costs, and/or innovation plans. This can provide evidence of competition between the merging firms, especially when they react by taking steps to preserve or enhance the competitiveness or profitability of their own products or services.

Page 122

Prior Merger, Entry, and Exit Events. The Agencies may look to historical events to assess the presence and substantiality of direct competition between the merging firms. For example, the Agencies may examine the impact of recent relevant mergers, entry, expansion, or exit events on the merging parties or their competitive behavior.

Customer Substitution. Customers’ willingness to switch between different firms’ products is an important part of the competitive process. Firms are closer competitors the more that customers are willing to switch between their products, for example because they are more similar in quality, price, or other characteristics.

Evidence commonly analyzed to show the extent of substitution among firms’ products includes: how customers have shifted purchases in the past in response to relative changes in price or other terms and conditions; documentary and testimonial evidence such as win/loss reports, evidence from discount approval processes, switching data, customer surveys, as well as information from suppliers of complementary products and distributors; objective information about product characteristics; and market realities affecting the ability of customers to switch. Impact of Competitive Actions on Rivals. When one firm takes competitive actions to attract customers, this can benefit the firm at the expense of its rivals. The Agencies may gauge the extent of competition among firms by considering the impact that competitive actions by one firm have on the others. The impact of a firm’s competitive actions on a rival generally depends on how many sales a rival would lose as a result of the competitive actions, as well as the profitability of those lost sales. The Agencies may use margins to measure the profitability of the sale a rival would have made.72 Impact of Eliminating Competition Between the Firms. In some instances, evidence may be available to assess the impact of competition from one or more firms on the other firms’ actions, such as firm choices about price, quality, wages, or another dimension of competition. This can be gauged by comparing the two firms’ actions when they compete and make strategic choices independently against the actions the firms might choose if they acted jointly. Actual or predicted changes in these results of competition, when available, can indicate the degree of competition between the firms. To make this type of comparison, the Agencies sometimes rely on economic models. Often, such models consider the firms’ incentives to change their actions in one or more selected dimensions, such as price, in a somewhat simplified scenario. For example, a model might focus on the firms’ short-run incentives to change price, while abstracting from a variety of additional competitive forces and dimensions of competition, such as the potential for firms to reposition their products or for the merging firms to coordinate with other firms. Such a model may incorporate data and evidence in order to produce quantitative estimates of the impact of the merger on firm incentives and corresponding choices. This type of exercise is sometimes referred to by economists as “merger simulation” despite the fact that the hypothetical setting considers only selected aspects of the loss of competition from a merger. The Agencies use such models to give an indication of the scale and importance of competition, not to precisely predict outcomes.

72 The margin on incremental units is the difference between incremental revenue (often equal to price) and incremental cost on those units. The Agencies may use accounting data to measure incremental costs, but they do not necessarily rely on accounting margins recorded by firms in the ordinary course of business because such margins often do not align with the concept of incremental cost that is relevant in economic analysis of a merger.

Page 123

4.2.B. Considerations When Terms Are Set by Firms The Agencies may use various types of evidence and metrics to assess the strength of competition among firms that set terms to their customers. Firms might offer the same terms to different customers or different terms to different groups of customers. Competition in this setting can lead firms to set lower prices or offer more attractive terms when they act independently than they would in a setting where that competition was eliminated by a merger. When considering the impact of competition on the incentives to set price, to the extent price increases on one firm’s products would lead customers to switch to products from another firm, their merger will enable the merged firm to profit by unilaterally raising the price of one or both products above the premerger level. Some of the sales lost because of the price increase will be diverted to the products of the other firm, and capturing the value of these diverted sales can make the price increase profitable even though it would not have been profitable prior to the merger.

A measure of customer substitution between firms in this setting is the diversion ratio. The diversion ratio from one product to another is a metric of how customers likely would substitute between them. The diversion ratio is the fraction of unit sales lost by the first product due to a change in terms, such as an increase in its price, that would be diverted to the second product. The higher the diversion ratio between two products made by different firms, the stronger the competition between them. A high diversion ratio between the products owned by two firms can indicate strong competition between them even if the diversion ratio to another firm is higher. The diversion ratio from one of the products of one firm to a group of products made by other firms, defined analogously, is sometimes referred to as the aggregate diversion ratio or the recapture rate. A measure of the impact on rivals of competitive actions is the value of diverted sales from a price increase. The value of sales diverted from one firm to a second firm, when the first firm raises its price on one of its products, is equal to the number of units that would be diverted from the first firm to the second, multiplied by the difference between the second firm’s price and the incremental cost of the diverted sales. To interpret the magnitude of the value of diverted sales, the Agencies may use as a basis of comparison either the incremental cost to the second firm of making the diverted sales, or the revenues lost by the first firm as a result of the price increase. The ratio of the value of diverted sales to the revenues lost by the first firm can be an indicator of the upward pricing pressure that would result from the loss of competition between the two firms. Analogous concepts can be applied to analyze the impact on rivals of worsening terms other than price.

4.2.C. Considerations When Terms Are Set Through Bargaining or Auctions In some industries, buyers and sellers negotiate prices and other terms of trade. In bargaining, buyers commonly negotiate with more than one seller and may play competing sellers off against one another. In other industries, sellers might sell their products, or buyers might procure inputs, using an auction. Negotiations may involve aspects of an auction as well as aspects of one-on-one negotiation. Competition among sellers can significantly enhance the ability of a buyer to obtain a result more favorable to it, and less favorable to the sellers, compared to a situation where the elimination of competition through a merger prevents buyers from playing those sellers off against each other in negotiations.

Sellers may compete even when a customer does not directly play their offers against each other. The attractiveness of alternative options influences the importance of reaching an agreement to the

Page 124

negotiating parties and thus the terms of the agreement. A party that has many attractive alternative trading partners places less importance on reaching an agreement with any one particular trading partner than a party with few attractive alternatives. As alternatives for one party are eliminated (such as through a merger), the trading partner gains additional bargaining leverage reflecting that loss of competition. A merger between sellers may lessen competition even if the merged firm handles negotiations for the merging firms’ products separately.

Thus, qualitative or quantitative evidence about the leverage provided to buyers by competing suppliers may be used to assess the extent of competition among firms in this setting. Analogous evidence may be used when analyzing a setting where terms are set using auctions, for example, procurement auctions where suppliers bid to serve a buyer. If, for some categories of procurements, certain suppliers are often among the most attractive to the buyer, competition among that group of suppliers is likely to be strong.

Firms sometimes keep records of the progress and outcome of individual sales efforts, and the Agencies may use these data to generate measures of the extent to which customers would likely substitute between the two firms. Examples of such measures might include a diversion ratio based on the rate at which customers would buy from one firm if the other one was not available, or the frequency with which the two firms bid on contracts with the same customer. 4.2.D. Considerations When Firms Determine Capacity and Output In some markets, the choice of how much to produce (output decisions) or how much productive capacity to maintain (capacity decisions) are key strategic variables. When a firm decreases output, it may lose sales to rivals, but also drive up prices. Because a merged firm will account for the impact of higher prices across all of the merged firms’ sales, it may have an incentive to decrease output as a result of the merger. The loss of competition through a merger of two firms may lead the merged firm to leave capacity idle, refrain from building or obtaining capacity that would have been obtained absent the merger, lay off or stop hiring workers, or eliminate pre-existing production capabilities. A firm may also divert the use of capacity away from one relevant market and into another market so as to raise the price in the former market. The analysis of the extent to which firms compete may differ depending on how a merger between them might create incentives to suppress output. Competition between merging firms is greater when (1) the merging firms’ market shares are relatively high; (2) the merging firms’ products are relatively undifferentiated from each other; (3) the market elasticity of demand is relatively low; (4) the margin on the suppressed output is relatively low; and (5) the supply responses of non-merging rivals are relatively small. Qualitative or quantitative evidence may be used to evaluate and weigh each of these factors. In some cases, competition between firms—including one firm with a substantial share of the sales in the market and another with significant excess capacity to serve that market—can prevent an output suppression strategy from being profitable. This can occur even if the firm with the excess capacity has a relatively small share of sales, as long as that firm’s ability to expand, and thus keep prices from rising, makes an output suppression strategy unprofitable for the firm with the larger market share.

Output or capacity reductions also may affect the market’s resilience in the face of future shocks to supply or demand, and the Agencies will consider this loss of resilience in assessing whether the merger may substantially lessen competition or tend to create a monopoly.

Page 125

4.2.E. Considerations for Innovation and Product Variety Competition Firms can compete for customers by offering varied and innovative products and features, which could range from minor improvements to the introduction of a new product category. Features can include new or different product attributes, services offered along with a product, or higher-quality services standing alone. Customers value the variety of products or services that competition generates, including having a variety of locations at which they can shop. Offering the best mix of products and features is an important dimension of competition that may be harmed as a result of the elimination of competition between the merging parties. When a firm introduces a new product or improves a product’s features, some of the sales it gains may be at the expense of its rivals, including rivals that are competing to develop similar products and features. As a result, competition between firms may lead them to make greater efforts to offer a variety of products and features than would be the case if the firms were jointly owned, for example, if they merged. The merged firm may have a reduced incentive to continue or initiate development of new products that would have competed with the other merging party, but post-merger would “cannibalize” what would be its own sales.73 A service provider may have a reduced incentive to continue valuable upgrades offered by the acquired firm. The merged firm may have a reduced incentive to engage in disruptive innovation that would threaten the business of one of the merging firms. Or it may have the incentive to change its product mix, such as by ceasing to offer one of the merging firms’ products, leaving worse off the customers who previously chose the product that was eliminated. For example, competition may be harmed when customers with a preference for a low-price option lose access to it, even if remaining products have higher quality.

The incentives to compete aggressively on innovation and product variety depend on the capabilities of the firms and on customer reactions to the new offerings. Development of new features depends on having the appropriate expertise and resources. Where firms are two of a small number of companies with specialized employees, development facilities, intellectual property, or research projects in a particular area, competition between them will have a greater impact on their incentives to innovate. Innovation may be directed at outcomes beyond product features; for example, innovation may be directed at reducing costs or adopting new technology for the distribution of products. 4.3. Market Definition The Clayton Act protects competition “in any line of commerce in any section of the country.”74 The Agencies engage in a market definition inquiry in order to identify whether there is any line of commerce or section of the country in which the merger may substantially lessen competition or tend to create a monopoly. The Agencies identify the “area of effective competition” in which competition may be lessened “with reference to a product market (the ‘line of commerce’) and a geographic market (the ‘section of the country.’).”75 The Agencies refer to the process of identifying market(s) protected by the Clayton Act as a “market definition” exercise and the markets so defined as “relevant antitrust markets,”

73 Sales “cannibalization” refers to a situation where customers of a firm substitute away from one of the firm’s products to another product offered by the same firm.

74 15 U.S.C. § 18.

75 Brown Shoe, 370 U.S. at 324.

Page 126

or simply “relevant markets.” Market definition can also allow the Agencies to identify market participants and measure market shares and market concentration. A relevant antitrust market is an area of effective competition, comprising both product (or service) and geographic elements. The outer boundaries of a relevant product market are determined by the “reasonable interchangeability of use or the cross-elasticity of demand between the product itself and substitutes for it.”76 Within a broad relevant market, however, effective competition often occurs in numerous narrower relevant markets.77 Market definition ensures that relevant antitrust markets are sufficiently broad, but it does not always lead to a single relevant market. Section 7 of the Clayton Act prohibits any merger that may substantially lessen competition “in any line of commerce” and in “any section of the country,” and the Agencies protect competition by challenging a merger that may lessen competition in any one or more relevant markets.

Market participants often encounter a range of possible substitutes for the products of the merging firms. However, a relevant market cannot meaningfully encompass that infinite range of substitutes.78 There may be effective competition among a narrow group of products, and the loss of that competition may be harmful, making the narrow group a relevant market, even if competitive constraints from significant substitutes are outside the group. The loss of both the competition between the narrow group of products and the significant substitutes outside that group may be even more harmful, but that does not prevent the narrow group from being a market in its own right. Relevant markets need not have precise metes and bounds. Some substitutes may be closer, and others more distant, and defining a market necessarily requires including some substitutes and excluding others. Defining a relevant market sometimes requires a line-drawing exercise around product features, such as size, quality, distances, customer segment, or prices. There can be many places to draw that line and properly define a relevant market. The Agencies recognize that such scenarios are common, and indeed “fuzziness would seem inherent in any attempt to delineate the relevant . . . market.”79 Market participants may use the term “market” colloquially to refer to a broader or different set of products than those that would be needed to constitute a valid relevant antitrust market. The Agencies rely on several tools to demonstrate that a market is a relevant antitrust market. For example, the Agencies may rely on any one or more of the following to identify a relevant antitrust market.

A. Direct evidence of substantial competition between the merging parties can demonstrate that a relevant market exists in which the merger may substantially lessen competition and can be sufficient to identify the line of commerce and section of the country affected by a merger, even if the metes and bounds of the market are only broadly characterized.

76 Id. at 325.

77 Id. (“[W]ithin [a] broad market, well-defined submarkets may exist which, in themselves, constitute product markets for antitrust purposes.”). Multiple overlapping markets can be appropriately defined relevant markets. For example, a merger to monopoly for food worldwide would lessen competition in well-defined relevant markets for, among others, food, baked goods, cookies, low-fat cookies, and premium low-fat chocolate chip cookies. Illegality in any of these in any city or town comprising a relevant geographic market would suffice to prohibit the merger, and the fact that one area comprises a relevant market does not mean a larger, smaller, or overlapping area could not as well. 78 United States v. Cont’l Can Co., 378 U.S. 441, 449 (1964); see also FTC v. Advoc. Health Care Network, 841 F.3d 460, 469 (7th Cir. 2016) (“A geographic market does not need to include all of the firm’s competitors; it needs to include the competitors that would substantially constrain the firm’s price-increasing ability.” (cleaned up)). 79 Phila. Nat’l Bank, 374 U.S. at 360 n.37.

Page 127

B. Direct evidence of the exercise of market power can demonstrate the existence of a relevant market in which that power exists. This evidence can be valuable when assessing the risk that a dominant position may be entrenched, maintained, or extended, since the same evidence identifies market power and can be sufficient to identify the line of commerce and section of the country affected by a merger, even if the metes and bounds of the market are only broadly characterized.

C. A relevant market can be identified from evidence on observed market characteristics (“practical indicia”), such as industry or public recognition of the submarket as a separate economic entity, the product’s peculiar characteristics and uses, unique production facilities, distinct customers, distinct prices, sensitivity to price changes, and specialized vendors.80 Various practical indicia may identify a relevant market in different settings. D. Another common method employed by courts and the Agencies is the hypothetical monopolist test.81 This test examines whether a proposed market is too narrow by asking whether a hypothetical monopolist over this market could profitably worsen terms significantly, for example, by raising price. An analogous hypothetical monopsonist test applies when considering the impact of a merger on competition among buyers. The Agencies use these tools to define relevant markets because they each leverage market realities to identify an area of effective competition.

Section 4.3.A below describes the Hypothetical Monopolist Test in greater detail. Section 4.3.B addresses issues that may arise when defining relevant markets in several specific scenarios. 4.3.A. The Hypothetical Monopolist Test This Section describes the Hypothetical Monopolist Test, which is a method by which the Agencies often define relevant antitrust markets. As outlined above, a relevant antitrust market is an area of effective competition. The Hypothetical Monopolist/Monopsonist Test (“HMT”) evaluates whether a group of products is sufficiently broad to constitute a relevant antitrust market. To do so, the HMT asks whether eliminating the competition among the group of products by combining them under the control of a hypothetical monopolist likely would lead to a worsening of terms for customers. The Agencies generally focus their assessment on the constraints from competition, rather than on constraints from regulation, entry, or other market changes. The Agencies are concerned with the impact on economic incentives and assume the hypothetical monopolist would seek to maximize profits. When evaluating a merger of sellers, the HMT asks whether a hypothetical profit-maximizing firm, not prevented by regulation from worsening terms, that was the only present and future seller of a group of products (“hypothetical monopolist”) likely would undertake at least a small but significant and non-transitory increase in price (“SSNIP”) or other worsening of terms (“SSNIPT”) for at least one

80 Brown Shoe, 370 U.S. at 325, quoted in United States v. U.S. Sugar Corp., 73 F.4th 197, 204-07 (3d Cir. 2023) (affirming district court’s application of Brown Shoe practical indicia to evaluate relevant product market that included, based on the unique facts of the industry, those distributors who “could counteract monopolistic restrictions by releasing their own supplies”).

81 See FTC v. Penn State Hershey Med. Center, 838 F.3d 327, 338 (3d Cir. 2016). While these guidelines focus on applying the hypothetical monopolist test in analyzing mergers, the test can be adapted for similar purposes in cases involving alleged monopolization or other conduct. See, e.g., McWane, Inc. v. FTC, 783 F.3d 814, 829-30 (11th Cir. 2015).

Page 128

product in the group.82 For the purpose of analyzing this issue, the terms of sale of products outside the candidate market are held constant. Analogously, when considering a merger of buyers, the Agencies ask the equivalent question for a hypothetical monopsonist. This Section often focuses on merging sellers to simplify exposition.

4.3.B. Implementing the Hypothetical Monopolist Test The SSNIPT. A SSNIPT may entail worsening terms along any dimension of competition, including price (SSNIP), but also other terms (broadly defined) such as quality, service, capacity investment, choice of product variety or features, or innovative effort. Input and Labor Markets. When the competition at issue involves firms buying inputs or employing labor, the HMT considers whether the hypothetical monopsonist would undertake at least a SSNIPT, such as a decrease in the offered price or a worsening of the terms of trade offered to suppliers, or a decrease in the wage offered to workers or a worsening of their working conditions or benefits. The Geographic Dimension of the Market. The hypothetical monopolist test is generally applied to a group of products together with a geographic region to determine a relevant market, though for ease of exposition the two dimensions are discussed separately, with geographic market definition discussed in Section 4.3.D.2.

Negotiations or Auctions. The HMT is stated in terms of a hypothetical monopolist undertaking a SSNIPT. This covers settings where the hypothetical monopolist sets terms and makes them worse. It also covers settings where firms bargain, and the hypothetical monopolist would have a stronger bargaining position that would likely lead it to extract a SSNIPT during negotiations, or where firms sell their products in an auction, and the bids submitted by the hypothetical monopolist would result in the purchasers of its products experiencing a SSNIPT.

Benchmark for the SSNIPT. The HMT asks whether the hypothetical monopolist likely would worsen terms relative to those that likely would prevail absent the proposed merger. In some cases, the Agencies will use as a benchmark different outcomes than those prevailing prior to the merger. For example, if outcomes are likely to change absent the merger, e.g., because of innovation, entry, exit, or exogenous trends, the Agencies may use anticipated future outcomes as the benchmark. Or, if suppliers in the market are coordinating prior to the merger, the Agencies may use a benchmark that reflects conditions that would arise if coordination were to break down. When evaluating whether a merging firm is dominant (Guideline 6), the Agencies may use terms that likely would prevail in a more competitive market as a benchmark.83

82 If the pricing incentives of the firms supplying the products in the group differ substantially from those of the hypothetical monopolist, for reasons other than the latter’s control over a larger group of substitutes, the Agencies may instead employ the concept of a hypothetical profit-maximizing cartel comprised of the firms (with all their products) that sell the products in the candidate market. This approach is most likely to be appropriate if the merging firms sell products outside the candidate market that significantly affect their pricing incentives for products in the candidate market. This could occur, for example, if the candidate market is one for durable equipment and the firms selling that equipment derive substantial net revenues from selling spare parts and service for that equipment. Analogous considerations apply when considering a SSNIPT for terms other than price.

83 In the entrenchment context, if the inquiry is being conducted after market or monopoly power has already been exercised, using prevailing prices can lead to defining markets too broadly and thus inferring that dominance does not exist when, in

Page 129

Magnitude of the SSNIPT. What constitutes a “small but significant” worsening of terms depends upon the nature of the industry and the merging firms’ positions in it, the ways that firms compete, and the dimension of competition at issue. When considering price, the Agencies will often use a SSNIP of five percent of the price charged by firms for the products or services to which the merging firms contribute value. The Agencies, however, may consider a different term or a price increase that is larger or smaller than five percent.84 The Agencies may base a SSNIP on explicit or implicit prices for the firms’ specific contribution to the value of the product sold, or an upper bound on the firms’ specific contribution, where these can be identified with reasonable clarity. For example, the Agencies may derive an implicit price for the service of transporting oil over a pipeline as the difference between the price the pipeline firm paid for oil at one end and the price it sold the oil for at the other and base the SSNIP on this implicit price. 4.3.C. Evidence and Tools for Carrying Out the Hypothetical Monopolist Test Section 4.2 describes some of the qualitative and quantitative evidence and tools the Agencies can use to assess the extent of competition among firms. The Agencies can use similar evidence and analogous tools to apply the HMT, in particular to assess whether competition among a set of firms likely leads to better terms than a hypothetical monopolist would undertake. To assess whether the hypothetical monopolist likely would undertake at least a SSNIP on one or more products in the candidate market, the Agencies sometimes interpret the qualitative and quantitative evidence using an economic model of the profitability to the hypothetical monopolist of undertaking price increases; the Agencies may adapt these tools to apply to other forms of SSNIPTs. One approach utilizes the concept of a “recapture rate” (the percentage of sales lost by one product in the candidate market, when its price alone rises, that is recaptured by other products in the candidate market). A price increase is profitable when the recapture rate is high enough that the incremental profits from the increased price plus the incremental profits from the recaptured sales going to other products in the candidate market exceed the profits lost when sales are diverted outside the candidate market. It is possible that a price increase is profitable even if a majority of sales are diverted outside the candidate market, for example if the profits on the lost sales are relatively low or the profits on the recaptured sales are relatively high.

Sometimes evidence is presented in the form of “critical loss analysis,” which can be used to assess whether undertaking at least a SSNIPT on one or more products in a candidate market would raise or lower the hypothetical monopolist’s profits. Critical loss analysis compares the magnitude of the two offsetting effects resulting from the worsening of terms. The “critical loss” is defined as the number of lost unit sales that would leave profits unchanged. The “predicted loss” is defined as the number of unit sales that the hypothetical monopolist is predicted to lose due to the worsening of terms. The worsening of terms raises the hypothetical monopolist’s profits if the predicted loss is less than the

fact, it does. The problem with using prevailing prices to define the market when a firm is already dominant is known as the “Cellophane Fallacy.”

84 The five percent price increase is not a threshold of competitive harm from the merger. Because the five percent SSNIP is a minimum expected effect of a hypothetical monopolist of an entire market, the actual predicted effect of a merger within that market may be significantly lower than five percent. A merger within a well-defined market that causes undue concentration can be illegal even if the predicted price increase is well below the SSNIP of five percent.

Page 130

critical loss. While this “breakeven” analysis differs somewhat from the profit-maximizing analysis called for by the HMT, it can sometimes be informative.

The Agencies require that estimates of the predicted loss be consistent with other evidence, including the pre-merger margins of products in the candidate market used to calculate the critical loss. Unless the firms are engaging in coordinated interaction, high pre-merger margins normally indicate that each firm’s product individually faces demand that is not highly sensitive to price. Higher pre-merger margins thus indicate a smaller predicted loss as well as a smaller critical loss. The higher the premerger margin, the smaller the recapture rate85 necessary for the candidate market to satisfy the hypothetical monopolist test. Similar considerations inform other analyses of the profitability of a price increase.

4.3.D. Market Definition in Certain Specific Settings This Section provides details on market definition in several specific common settings. In much of this section, concepts are presented for the scenario where the merger involves sellers. In some cases, clarifications are provided as to how the concepts apply to merging buyers; in general, the concepts apply in an analogous way.

4.3.D.1.

Targeted Trading Partners If the merged firm could profitably target a subset of customers for changes in prices or other terms, the Agencies may identify relevant markets defined around those targeted customers. The Agencies may do so even if firms are not currently targeting specific customer groups but could do so after the merger.

For targeting to be feasible, two conditions typically must be met. First, the suppliers engaging in targeting must be able to set different terms for targeted customers than other customers. This may involve identification of individual customers to which different terms are offered or offering different terms to different types of customers based on observable characteristics.86 Markets for targeted customers need not have precise metes and bounds. In particular, defining a relevant market for targeted customers sometimes requires a line-drawing exercise on observable characteristics. There can be many places to draw that line and properly define a relevant market. Second, the targeted customers must not be likely to defeat a targeted worsening of terms by arbitrage (e.g., by purchasing indirectly from or through other customers). Arbitrage may be difficult if it would void warranties or make service more difficult or costly for customers, and it is inherently impossible for many services. Arbitrage on a modest scale may be possible but sufficiently costly or limited, for example due to transaction costs or search costs, that it would not deter or defeat a discriminatory pricing strategy. If prices are negotiated or otherwise set individually, for example through a procurement auction, there may be relevant markets that are as narrow as an individual customer. Nonetheless, for analytic convenience, the Agencies may define cluster markets for groups of targeted customers for whom the

85 The recapture rate is sometimes referred to as the aggregate diversion ratio, defined in Section 4.2.B. 86 In some cases, firms offer one or more versions of products or services defined by their characteristics (where brand might be a characteristic). When customers can select among these products and terms do not vary by customer, the Agencies will typically define markets based on products rather than the targeted customers. In such cases, relevant antitrust markets may include only some of the differentiated products, for example products with only “basic” features, or products with “premium features.” The tools described in Section 4.2 can be used to assess competition among differentiated products.

Page 131

conditions of competition are reasonably similar. (See Section 4.3.D.4 for further discussion of cluster markets.) Analogous considerations arise for a merger involving one or more buyers or employers. In this case, the analysis considers whether buyers target suppliers, for example by paying targeted suppliers or workers less, or by degrading the terms of supply contracts for targeted suppliers. Arbitrage would involve a targeted supplier selling to the buyer indirectly, through a different supplier who could obtain more favorable terms from the buyer.

If the HMT is applied in a setting where targeting of customers is feasible, it requires that a hypothetical profit-maximizing firm that was the only present or future seller of the relevant product(s) to customers in the targeted group would undertake at least a SSNIPT on some, though not necessarily all, customers in that group. The products sold to those customers form a relevant market if the hypothetical monopolist likely would undertake at least a SSNIPT despite the potential for customers to substitute away from the product or to take advantage of arbitrage. In this exercise, the terms of sale for products sold to all customers outside the region are held constant. 4.3.D.2.

Geographic Markets A relevant antitrust market is an area of effective competition, comprising both product (or service) and geographic elements. A market’s geography depends on the limits that distance puts on some customers’ willingness or ability to substitute to some products, or some suppliers’ willingness or ability to serve some customers. Factors that may limit the geographic scope of the market include transportation costs, language, regulation, tariff and non-tariff trade barriers, custom and familiarity, reputation, and local service availability.

4.3.D.2.a. Geographic Markets Based on the Locations of Suppliers The Agencies sometimes define geographic markets as regions encompassing a group of supplier locations. When they do, the geographic market’s scope is determined by customers’ willingness to switch between suppliers. Geographic markets of this type often apply when customers receive goods or services at suppliers’ facilities, for example when customers buy in-person from retail stores. A single firm may offer the same product in a number of locations, both within a single geographic market or across geographic markets; customers’ willingness to substitute between products may depend on the location of the supplier. When calculating market shares, sales made from supplier locations in the geographic market are included, regardless of whether the customer making the purchase travelled from outside the boundaries of the geographic market (see Section 4.4 for more detail about calculating market shares).

If the HMT is used to evaluate the geographic scope of the market, it requires that a hypothetical profit-maximizing firm that was the only present or future supplier of the relevant product(s) at supplier locations in the region likely would undertake at least a SSNIPT in at least one location. In this exercise, the terms of sale for products sold to all customers at facilities outside the region are typically held constant.87

87 In some circumstances, as when the merging parties operate in multiple geographies, if applying the HMT, the Agencies may apply a “Hypothetical Cartel” framework for market definition, following the approach outlined in Section 4.3.A, n.81.

Page 132

4.3.D.2.b. Geographic Markets Based on Targeting of Customers by Location When targeting based on customer location is feasible (see Section 4.3.D.1), the Agencies may define geographic markets as a region encompassing a group of customers.88 For example, geographic markets may sometimes be defined this way when suppliers deliver their products or services to customers’ locations, or tailor terms of trade based on customers’ locations. Competitors in the market are firms that sell to customers that are located in the specified region. Some suppliers may be located outside the boundaries of the geographic market, but their sales to customers located within the market are included when calculating market shares (see Section 4.4 for more detail about calculating market shares).

If prices are negotiated individually with customers that may be targeted, geographic markets may be as narrow as individual customers. Nonetheless, the Agencies often define a market for a cluster of customers located within a region if the conditions of competition are reasonably similar for these customers. (See Section 4.3.D.4 for further discussion of cluster markets.) A firm’s attempt to target customers in a particular area with worsened terms can sometimes be undermined if some customers in the region substitute by travelling outside it to purchase the product. Arbitrage by customers on a modest scale may be possible but sufficiently costly or limited that it would not deter or defeat a targeting strategy.89 If the HMT is used to evaluate market definition when customers may be targeted by location, it requires that a hypothetical profit-maximizing firm that was the only present or future seller of the relevant product(s) to customers in the region likely would undertake at least a SSNIPT on some, though not necessarily all, customers in that region. The products sold in that region form a relevant market if the hypothetical monopolist would undertake at least a SSNIPT despite the potential for customers to substitute away from the product or to locations outside the region. In this exercise, the terms of sale for products sold to all customers outside the region are held constant.90 4.3.D.3.

Supplier Responses Market definition focuses solely on demand substitution factors, that is, on customers’ ability and willingness to substitute away from one product or location to another in response to a price increase or other worsening of terms. Supplier responses may be considered in the analysis of competition between firms (Guideline 2 and Section 4.2), entry and repositioning (Section 3.2), and in calculating market shares and concentration (Section 4.4).

4.3.D.4.

Cluster Markets A relevant antitrust market is generally a group of products that are substitutes for each other. However, when the competitive conditions for multiple relevant markets are reasonably similar, it may be appropriate to aggregate the products in these markets into a “cluster market” for analytic convenience, even though not all products in the cluster are substitutes for each other. For example, competing hospitals may each provide a wide range of acute health care services. Acute care for one health issue is not a substitute for acute care for a different health issue. Nevertheless, the Agencies may

88 For customers operating in multiple locations, only those customer locations within the targeted region are included in the market.

89 Arbitrage by suppliers is a type of supplier response and is thus not considered in market definition. (See Section 4.3.D.3) 90 In some circumstances, as when the merging parties operate in multiple geographies, the Agencies may apply a “Hypothetical Cartel” framework for market definition, as described in Section 4.3.A, n.81.

Page 133

aggregate them into a cluster market for acute care services if the conditions of competition are reasonably similar across the services in the cluster.

The Agencies need not separately analyze market definition for each product included in the cluster market, and market shares will typically be calculated for the cluster market as a whole. Analogously, the Agencies sometimes define a market as a cluster of targeted customers (see Section 4.3.D.1) or a cluster of customers located in a region (see Section 4.3.D.2.b). 4.3.D.5.

Bundled Product Markets Firms may sell a combination of products as a bundle or a “package deal,” rather than offering products “a la carte,” that is, separately as standalone products. Different bundles offered by the same or different firms might package together different combinations of component products and therefore be differentiated according to the composition of the bundle. If the components of a bundled product are also available separately, the bundle may be offered at a price that represents a discount relative to the sum of the a la carte product prices.

The Agencies take a flexible approach based on the specific circumstances to determine whether a candidate market that includes one or more bundled products, standalone products, or both is a relevant antitrust market. In some cases, a relevant market may consist of only bundled products. A market composed of only bundled products might be a relevant antitrust market even if there is significant competition from the unbundled products. In other cases, a relevant market may include both bundled products and some unbundled component products.

Even in cases where firms commonly sell combinations of products or services as a bundle or a “package deal,” relevant antitrust markets do not necessarily include product bundles. In some cases, a relevant market may be analyzed as a cluster market, as discussed in Section 4.3.D.4. 4.3.D.6.

One-Stop Shop Markets In some settings, the Agencies may consider a candidate market that includes one or more “onestop shops,” where customers can select a combination of products to purchase from a single seller, either in a single purchase instance or in a sequence of purchases. Products are commonly sold at a onestop shop when customers value the convenience, which might arise because of transaction costs or search costs, savings of time, transportation costs, or familiarity with the store or web site. A multi-product retailer such as a grocery store or online retailer is an example of a one-stop shop. Customers can select a particular basket of groceries from a range of available goods and different customers may select different baskets. Some customers may make multiple stops at specialty shops (e.g., butcher, baker, greengrocer), or they may do the bulk of their shopping at a one-stop shop (the grocery store) but also shop at specialty shops for particular product categories. There are several ways in which markets may be defined in one-stop shop settings, depending on market realities, and the Agencies may further define more than one relevant antitrust market for a particular merger. For example, a relevant market may consist of only one-stop shops, even if there is significant competition from specialty shops; or it may include both one-stop shops and specialty shops. When a product category is sold by both one-stop shops and specialty suppliers (such as a type of produce sold in grocery stores and produce stands), the Agencies may define relevant antitrust markets for the product category sold by a particular type of supplier, or it may include multiple types of suppliers.

Page 134

4.3.D.7.

Market Definition When There is Harm to Innovation When considering harm to competition in innovation, market definition may follow the same approaches that are used to analyze other dimensions of competition. In the case where a merger may substantially lessen competition by decreasing incentives to innovate, the Agencies may define relevant antitrust markets around the products that would result from that innovation if successful, even if those products do not yet exist.91 In some cases, the Agencies may analyze different relevant markets when considering innovation than when considering other dimensions of competition. 4.3.D.8.

Market Definition for Input Markets and Labor Markets The same market definition tools and principles discussed above can be used for input markets and labor markets, where labor is a particular type of input. In input markets, firms compete with each other to attract suppliers, including workers. Therefore, input suppliers are analogous to customers in the discussions above about market definition. In defining relevant markets, the Agencies focus on the alternatives available to input suppliers. An antitrust input market consists of a group of products and a geographic area defined by the location of the buyers or input suppliers. Just as buyers of a product may consider products to be differentiated according to the brand or the identity of the seller, suppliers of a product or service may consider different buyers to be differentiated. For example, if the suppliers are contractors, they may have distinct preferences about who they provide services to, due to different working conditions, location, reliability of buyers in terms of paying invoices on time, or the propensity of the buyer to make unexpected changes to specifications.

The HMT considers whether a hypothetical monopsonist likely would undertake a SSNIPT, such as a reduction in price paid for inputs, or imposing less favorable terms on suppliers. (See Section 4.2.C for more discussion about competition in settings where terms are set through auctions and negotiations, as is common for input markets.) When defining a market for labor the Agencies will consider the job opportunities available to workers who supply a relevant type of labor service, where worker choice among jobs or between geographic areas is the analog of consumer choices among products and regions when defining a product market. The Agencies may consider workers’ willingness to switch in response to changes to wages or other aspects of working conditions, such as changes to benefits or other non-wage compensation, or adoption of less flexible scheduling. Depending on the occupation, alternative job opportunities might include the same occupation with alternative employers, or alternative occupations. Geographic market definition may involve considering workers’ willingness or ability to commute, including the availability of public transportation. The product and geographic market definition may involve assessing whether workers may be targeted for less favorable wages or other terms of employment according to factors such as education, experience, certifications, or work locations. The Agencies may define cluster markets for different jobs when firms employ workers in a variety of jobs characterized by similar competitive conditions (see Section 4.3.D.4). 4.4. Calculating Market Shares and Concentration This subsection further describes how the Agencies calculate market shares and concentration metrics.

91 See Illumina, slip op. at 12 (affirming a relevant market defined around “what . . . developers reasonably sought to achieve, not what they currently had to offer”).

Page 135

As discussed above, the Agencies may use evidence about market shares and market concentration as part of their analysis. These structural measures can provide insight into the market power of firms as well as into the extent to which they compete. Although any market that is properly identified using the methods in Section 4.3 is valid, the extent to which structural measures calculated in that market are probative in any given context depends on a number of considerations. The following market considerations affect the extent to which structural measures are probative in any given context.92 First, structural measures may be probative if the market used to estimate them includes the products that are the focus of the competitive concern that the structural inquiry intends to address. For example, the concentration measures discussed in Guideline 1 will be most probative about whether the merger eliminates substantial competition between the merging parties when calculated on a market that includes at least one competing product from each merging firm. Second, the market used to estimate shares should be broad enough that it contains sufficient additional products so that a loss of competition among all the suppliers of the products in the market would lead to significantly worse terms for at least some customers of at least one product. Markets identified using the various tools in Section 4.3 can satisfy this condition—for example, all markets that satisfy the HMT do so.

Third, the competitive significance of the parties may be understated by their share when calculated on a market that is broader than needed to satisfy the considerations above, particularly when the market includes products that are more distant substitutes, either in the product or geographic dimension, for those produced by the parties.

4.4.A. Market Participants All firms that currently supply products (or consume products, when buyers merge) in a relevant market are considered participants in that market. Vertically integrated firms are also included to the extent that their inclusion accurately reflects their competitive significance. Firms not currently supplying products in the relevant market, but that have committed to entering the market in the near future, are also considered market participants.

Firms that are not currently active in a relevant market, but that very likely would rapidly enter with direct competitive impact in the event of a small but significant change in competitive conditions, without incurring significant sunk costs, are also considered market participants. These firms are termed “rapid entrants.” Sunk costs are entry or exit costs that cannot be recovered outside a relevant market. Entry that would take place more slowly in response to a change in competitive conditions, or that requires firms to incur significant sunk costs, is considered in Section 3.2. Firms that are active in the relevant product market but not in the relevant geographic market may be rapid entrants. Other things equal, such firms are most likely to be rapid entrants if they are already active in geographies that are close to the geographic market. Factors such as transportation

92 For simplicity, the discussion in the text focuses on the case where concerns arise that involve competition among the suppliers of products; analogous considerations may also arise for suppliers of services, or when concerns arise about competition among buyers of a product or service, or when analyzing market shares in certain specific settings (see Section 4.3.D).

Page 136

costs are important; or for services or digital goods, other factors may be important, such as language or regulation.

In markets for relatively homogeneous goods where a supplier’s ability to compete depends predominantly on its costs and its capacity, and not on other factors such as experience or reputation in the relevant market, a supplier with efficient idle capacity, or readily available “swing” capacity currently used in adjacent markets that can easily and profitably be shifted to serve the relevant market, may be a rapid entrant. However, idle capacity may be inefficient, and capacity used in adjacent markets may not be available, so a firm’s possession of idle or swing capacity alone does not make that firm a rapid entrant.

4.4.B. Market Shares The Agencies normally calculate product market shares for all firms that currently supply products (or consume products, when buyers merge) in a relevant market, subject to the availability of data. The Agencies measure each firm’s market share using metrics that are informative about the market realities of competition in the particular market and firms’ future competitive significance. When interpreting shares based on historical data, the Agencies may consider whether significant recent or reasonably foreseeable changes to market conditions suggest that a firm’s shares overstate or understate its future competitive significance.

How market shares are calculated may further depend on the characteristics of a particular market, and on the availability of data. Moreover, multiple metrics may be informative in any particular case. For example:

 Revenues in a relevant market often provide a readily available basis on which to compute shares and are often a good measure of attractiveness to customers.  Unit sales may provide a useful measure of competitive significance in cases where one unit of a low-priced product can serve as a close substitute for one unit of a higher-priced product. For example, a new, much less expensive product may have great competitive significance if it substantially erodes the revenues earned by older, higher-priced products, even if it earns relatively low revenues.

 Revenues earned from recently acquired customers (or paid to recently acquired buyers, in the case of merging buyers) may provide a useful measure of competitive significance of firms in cases where trading partners sign long-term contracts, face switching costs, or tend to re-evaluate their relationships only occasionally.

 Measures based on capacities or reserves may be used to calculate market shares in markets for homogeneous products where a firm’s competitive significance may derive principally from its ability and incentive to rapidly expand production in a relevant market in response to a price increase or output reduction by others in that market (or to rapidly expand its purchasing in the case of merging buyers).

 Non-price indicators, such as number of users or frequency of use, may be useful indicators in markets where price forms a relatively small or no part of the exchange of value.

Page 137

Federal Trade Commission Statement Concerning Brand Drug Manufacturers’ Improper Listing of Patents in the Orange Book I.

Introduction Brand drug manufacturers may be harming generic competition through the improper listing of patents in the Food and Drug Administration’s (“FDA”) Approved Drug Products with Therapeutic Equivalence Evaluations, known as the “Orange Book.”1 Generic competition for brand-name drugs results in lower prices, increased access, and significant cost savings for consumers and the healthcare system. The Hatch-Waxman Act and FDA regulations set forth the criteria for listing patents in the Orange Book.2 The Orange Book puts generic companies on notice of certain types of patents that a brand company claims cover its product. Patents listed in the Orange Book must claim the reference listed drug or a method of using it. By listing patents, brand drug manufacturers may benefit from a 30-month stay of FDA approval of generic drug applications, regardless of whether a court ultimately finds the patent at issue is valid or infringed by the competing product.

Brand drug manufacturers are responsible for ensuring their patents are properly listed. Yet certain manufacturers have submitted patents for listing in the Orange Book that claim neither the reference listed drug nor a method of using it. When brand drug manufacturers abuse the regulatory processes set up by Congress to promote generic drug competition, the result may be to increase the cost of and reduce access to prescription drugs. The goal of this policy statement3 is to put market participants on notice that the FTC intends to scrutinize improper Orange Book listings to determine whether these constitute unfair methods of competition in violation of Section 5 of the Federal Trade Commission Act.4 1 The Orange Book is the FDA’s official source for listing prescription (and nonprescription) drug products approved in an application under Section 505 of the Federal Food, Drug, and Cosmetic Act (“FDCA”), codified at 21 U.S.C. §301, et seq., related patent and exclusivity information, and other important information including therapeutic equivalence.

2 21 U.S.C. §§ 355(b)(1)(A)(viii), 355(c)(2); 21 C.F.R. § 314.53(b)(1). 3 This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates one or more existing statutory or regulatory requirements. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action under the FTC Act or other statutes. Pursuant to the Congressional Review Act (5 U.S.C. § 801 et seq.), the Office of Information and Regulatory Affairs designated this Policy Statement as not a “major rule,” as defined by 5 U.S.C. § 804(2).

4 Although this statement focuses on unfair methods of competition, the Commission may also investigate such conduct under the Commission’s authority to prevent unfair or deceptive acts or practices. See 15 U.S.C. §§ 45(a), (n).

Page 138

II.

Statutory and regulatory background In 1984, Congress passed the Hatch-Waxman Act5 to encourage generic drug competition, establishing an abbreviated regulatory pathway for speedy approval of generic equivalent drugs through the filing of an abbreviated new drug application (“ANDA”).6 Alternately, a company seeking to market a modified (“follow-on”) version of an existing brand drug—such as with a “new indication or new dosage form”—can file an application pursuant to Section 505(b)(2).7 As part of the Hatch-Waxman framework, brand drug manufacturers are required to submit information to the FDA about certain types of patents covering the products described in their new drug application (“NDA”). “The purpose of listing a patent in the Orange Book is to put potential generic manufacturers on notice that the brand considers the patent to cover its drug.”8 The Orange Book patent list is the statutory mechanism for identifying and potentially resolving certain patent disputes while 505(b)(2) applications9 and ANDAs are still under review by the FDA.

Under 21 U.S.C. § 355, as amended by the Orange Book Transparency Act of 2020,10 the brand manufacturers must submit for listing a patent that: (I) claims the drug for which the applicant submitted the application and is a drug substance (active ingredient) patent or a drug product (formulation or composition) patent; or (II) claims a method of using such drug for which approval is sought or has been granted in the application.11 “Patent information that is not the type of patent information required by subsection (b)(1)(A)(viii) shall not be submitted. . . .”12 A drug company that seeks to market a generic or follow-on version of a brand drug for which there are patents listed in the Orange Book must provide a “certification” with respect to each listed patent “which claims the listed drug . . . or which claims a use for such listed drug for 5 Pub. L. No. 98-417, 98 Stat. 1585 (1984). See also H.R. REP. NO. 98-857, at 14–15 (1984), reprinted in 1984 U.S.C.C.A.N. 2647, 2647–48.

6 See 21 U.S.C. § 355(j)(2)(A)(iv).

7 Fed. Trade Comm’n v. AbbVie Inc., 976 F.3d 327, 339 (3d Cir. 2020) (discussing 21 U.S.C. § 355(b)(2)). Like an ANDA applicant, a 505(b)(2) applicant can rely on the FDA’s finding of safety and effectiveness for the brand drug product and need only “produce some data, including whatever ‘information [is] needed to support the modification(s).”’ Id. (quoting 21 C.F.R. § 314.54(a)).

8 In re Restasis (Cyclosporine Ophthalmic Emulsion) Antitrust Litig., 333 F. Supp. 3d 135, 149 (E.D.N.Y. 2018). 9 As used herein, “505(b)(2)” refers to Section 505(b)(2) of the FDCA, codified at 21 U.S.C. § 355(b)(2). 10 Pub. L. No. 116-290, 134 Stat. 4889 (2021).

11 21 U.S.C. § 355(b)(1)(A)(viii). See also 21 U.S.C. §§ 355(c)(2), 21 C.F.R. § 314.53 (submission of patent information). Only the patent information submitted under section §355(c)(2) is listed in the Orange Book. A patent that is identified as claiming a method of using such drug shall be filed pursuant to section §355(c)(2) for listing in the Orange Book only if the patent claims a method of use approved in the application. 12 21 U.S.C. § 355(c)(2).

Page 139

which the applicant is seeking approval.”13 If the Orange Book listed patents are not expired, the generic company can file a “paragraph IV” certification stating the generics’ view that the brand company’s patent is “invalid or will not be infringed by the manufacture, use, or sale of the new drug for which the application is submitted.”14 A paragraph IV certification generally triggers an immediate right for the brand company to sue for infringement,15 which if done timely, generally results in an automatic, 30-month stay of any approval of the generic company’s ANDA or 505(b)(2) application by the FDA.16 NDA holders17 are responsible for ensuring that Orange Book patent information is consistent with the listing requirements in 21 C.F.R. § 314.53, and subsection (c)(2)(ii)(R) requires the person who submits the patent information to attest under penalty of perjury that the submission complies with this regulation.18 III.

Improper listing of patents in the Orange Book may harm competitive conditions in pharmaceutical markets Brand manufacturers’ listing in the Orange Book patents that do not meet the statutory listing criteria undermines the competitive process and may constitute an unfair method of competition in violation of Section 5 of the FTC Act.

Improper Orange Book listings may have played a role in distorting pharmaceutical markets for decades. The Supreme Court has observed that since the late 1990s there has been evidence that some brand drug companies were exploiting the Orange Book listing process “to prevent or delay the marketing of generic drugs.”19 The FTC examined the potential anticompetitive effect of improper Orange Book listings as part of a 2002 study, in which it identified numerous instances in which the 30-month stay was used to block competition.20 The same year, the FTC charged Biovail Corporation for, among other things, wrongfully listing a 13 Id. at § 355(j)(2)(A)(vii).

14 Id. at § 355(j)(2)(A)(vii)(IV). If the generic is not contending the patents are invalid or not infringed, it would simply file a “paragraph III” certification signifying it will wait to come to market until patent expiry. Id. 15 There is no right to file an infringement suit in response to a paragraph IV certification if the patent was obtained by fraud on the United States Patent and Trademark Office or if the infringement suit would be objectively baseless. See, e.g., AbbVie Inc., 976 F.3d at 361 (“[W]e must not immunize a brand-name manufacturer who uses the Hatch- Waxman Act’s automatic, 30-month stay to thwart competition. Doing so would excuse behavior that Congress proscribed in the antitrust laws.”).

16 21 U.S.C. § 355(j)(5)(B)(iii).

17 For purposes of this statement the terms “brand drug manufacturer” and “NDA holder” are used synonymously. 18 According to 21 C.F.R. § 314.53(c)(2)(ii)(R), NDA holders are required to submit a signed verification as part of Form FDA 3542 that states:

The undersigned declares that this is an accurate and complete submission of patent information for the NDA, amendment, or supplement pending under section 505 of the Federal Food, Drug, and Cosmetic Act. This time-sensitive patent information or response to a request under 21 C.F.R 314.53(f)(1) is submitted pursuant to 21 C.F.R. 314.53. I attest that I am familiar with 21 C.F.R. 314.53 and this submission complies with the requirements of the regulation. I verify under penalty of perjury that the foregoing is true and correct.

19 Caraco Pharm. Labs., Ltd. v. Novo Nordisk A/S, 566 U.S. 399, 408 (2012). 20 FED. TRADE COMM’N., GENERIC DRUG ENTRY PRIOR TO PATENT EXPIRATION: AN FTC STUDY 39-52 (2022) www.ftc.gov/sites/default/files/documents/reports/generic-drug-entry-prior-patent-expiration-ftc­ study/genericdrugstudy_0.pdf.

Page 140

patent in the Orange Book to block generic competition in violation of the FTC Act.21 Over the years, the FTC has filed amicus briefs in private litigations relating to the anticompetitive effects of improper Orange Book patent listings, including most recently in Jazz Pharms., Inc. v. Avadel CNS Pharms.22 Improper Orange Book patent listings may disincentivize investments in developing a competing product and increase the risk of delayed generic and follow-on product entry, reducing patient access to more affordable prescription drugs and increasing costs to the healthcare system. Given the enormous profit margins of many branded drugs, even small delays in generic competition can generate substantial additional profits for brand companies at the expense of patients.

In the Hatch-Waxman framework, Congress struck a careful balance between preserving financial incentives for innovative drug development and accelerating the availability of followon lower-priced generics.23 When brand companies improperly list patents in the Orange Book that do not meet the statutory criteria, it undermines the pro-competitive goals of Congress and risks significantly harming patients. By improperly listing a patent and timely filing an infringement suit, a brand can generally rely on the automatic stay to block FDA approval of a competing drug product, generally for 30 months, regardless of the validity or scope of the patent and regardless of whether the patent meets the statutory listing criteria. As a result, a generic company with a competing product facing an infringement suit based on a patent that was improperly listed in the Orange Book cannot launch its product because the automatic stay would prevent the FDA from granting approval to market the product. Patients suffer because they are deprived of the ability to choose between competing products and may be forced to pay inflated prices.24 21 Decision and Order, In re Biovail Corp., FTC Dkt. No. C-4060 (Oct. 2, 2002). 22 See Brief for Fed. Trade Comm’n as Amicus Curiae, Jazz Pharms., Inc. v, Avadel CNS Pharms. No. 1:21-cv­ 00691 (D. Del. Nov. 10, 2022) (Doc. No. 22-3) (arguing that a patent covering a system for implementing a REMS was not properly listed), https://www.ftc.gov/system/files/ftc_gov/pdf/P163500JazzPharmaAmicusBrief.pdf; Mem. of Law of the Federal Trade Commission as Amicus Curiae, SmithKline Beecham Corp. v. Apotex Corp., No. 99-cv­ 4304 (E.D. Pa. January 28, 2003), https://www.ftc.gov/sites/default/files/documents/amicus_briefs/smithkline­ beechamcorp.v.apotex-corp./smithklineamicus.pdf; Mem. of Law of Amicus Curiae the Federal Trade Commission In Opposition to Defendant’s Motion to Dismiss, In re: Buspirone Patent Litig., MDL Docket No. 1410 (S.D.N.Y. Jan. 8, 2002), https://www.ftc.gov/sites/default/files/documents/amicus_briefs/re-buspirone-antitrust­ litigation/buspirone.pdf; Brief for Fed. Trade Comm’n as Amicus Curiae, American Bioscience, Inc. v. Bristol- Myers Squibb Co., No. 00-cv-08577 (C.D. Cal. September 7, 2000), https://www.ftc.gov/sites/default/files/documents/amicus_briefs/american-bioscience-v.bristol­ myers/amicusbrief.pdf.

23 The FDA has noted that these requirements “reflect an attempt to balance two competing interests: Promoting competition between ‘brand name’ or ‘innovator drugs’ and ‘generic’ drugs and encouraging research and innovation.” Applications for FDA Approval to Market a New Drug: Patent Submission and Listing Requirements and Application of 30-Month Stays on Approval of Abbreviated New Drug Applications Certifying That a Patent Claiming a Drug Is Invalid or Will Not Be Infringed, 68 Fed. Reg. 36,676 (June 18, 2003) (codified at 21 C.F.R. pt. 314).

24 See Fed. Trade Comm’n Generic Drug Entry Study, supra note 20.

Page 141

IV.

The FTC will enforce the law against those companies and individuals who continue to improperly list patents in the Orange Book The FTC intends to use its full legal authority to protect patients and payors, including Medicare and Medicaid, from business practices that tend to negatively affect competitive conditions. This includes taking actions against companies and individuals that improperly list patents in the Orange Book that do not meet the statutory listing criteria. Listing patents in the Orange Book that do not meet the statutory listing criteria may constitute an unfair method of competition in violation of Section 5 of the FTC Act.25 First, the Commission views the improper listing of patents in the Orange Book as a method of competition. It is undertaken by a brand drug manufacturer and is not an inherent market condition.26 Second, improperly listing patents in the Orange Book can be unfair because it is not competition on the merits of drug quality or price, and it tends to negatively affect competitive conditions by impeding opportunities for generic rivals to compete, thus limiting consumer choice.27 Further, recognizing that improperly listing patents in the Orange Book can be an unfair method of competition is consistent with the FTC’s historical use of Section 5, which has reached “conduct resulting in direct evidence of harm, or likely harm to competition, that does not rely upon market definition.”28 Accordingly, the FTC intends to scrutinize whether brand drug companies and responsible individuals are improperly listing patents in violation of Section 5.

The improper listing of patents in the Orange Book may also constitute illegal monopolization. Monopolization requires proof of “the willful acquisition or maintenance of [monopoly] power as distinguished from growth or development as a consequence of a superior product, business acumen, or historic accident.”29 This requires proof that “the defendant has engaged in improper conduct that has or is likely to have the effect of controlling prices or excluding competition,”30 and courts have recognized that improperly listing patents in the 25 Fed. Trade Comm’n, Policy Statement Regarding the Scope of Unfair Methods of Competition Under Section 5 of the Federal Trade Commission Act (Nov. 10, 2022), https://www.ftc.gov/system/files/ftc_gov/pdf/P221202Section5PolicyStatement.pdf. 26 Id. at 8 (“The conduct must implicate competition, but the relationship can be indirect. For example, misuse of regulatory processes that can create or exploit impediments to competition (such as those related to licensing, patents, or standard setting) constitutes a method of competition.”). See Charles Pfizer & Co. v. FTC, 401 F.2d 574, 585 (6th Cir. 1968), cert. denied, 394 U.S. 920 (1969) (affirming Commission order holding that defendants violated Sec. 5 of the Federal Trade Commission Act where substantial evidence supported the Commission’s findings that misrepresentations and withholding of material information misled Patent Office officials into granting a patent on tetracycline).

27 Fed. Trade Comm’n Unfair Methods of Competition Policy Statement, supra note 25 at 8-9. 28 Id. at 15 n.85 (citing Fed. Trade Comm’n v. Ind. Fed’n of Dentists, 476 U.S. 447, 460-61 (1986) (finding of sustained effects legally sufficient even in absence of elaborate market analysis); Toys “R” Us v. Fed. Trade Comm’n, 221 F.3d 928, 937 (7th Cir. 2000) (finding “sufficient proof of anticompetitive effects [such] that no more elaborate market analysis was necessary”). Cf. Fed. Trade Comm’n v. Staples, Inc., 970 F. Supp. 1066, 1075-6 (D.D.C. 1997) (relying in part on direct evidence that pricing for key products from office superstores lower where three such stores exist in same metropolitan area and higher where only one or two such stores present). 29 U.S. v. Grinnell Corp., 384 U.S. 563, 570-71 (1966).

30 PepsiCo, Inc. v. Coca-Cola Co., 315 F.3d 101, 108 (2d Cir. 2002).

Page 142

Orange Book may constitute an “improper means” of competition.31 Accordingly, improperly listing patents in the Orange Book may also be worthy of enforcement scrutiny from government and private enforcers under a monopolization theory. Additionally, the FTC may also scrutinize a firm’s history of improperly listing patents during merger review.32 Individuals who submit or cause the submission of improper Orange Book patent listings, including those who certify compliance under 21 C.F.R. § 314.53(c)(2)(ii)(R), may be held individually liable.33 Further, if the FTC encounters false certifications filed under 21 C.F.R. § 314.53(c)(2)(ii)(R) that may constitute a potential criminal violation for the submission of false statements,34 the Commission may refer such cases to the U.S. Department of Justice for further investigation.

NDA holders must ensure that submitted patent information complies with all applicable Orange Book requirements under the law. Accordingly, NDA holders that currently have patents listed in the Orange Book must ensure that those listings comply with the law and should immediately remove any patents that fail to meet listing requirements. Failure to remove improperly listed patents from the Orange Book promptly may result in legal liability under the FTC Act. The FTC may also dispute patent listings through the FDA process set out in 21 C.F.R. 314.53(f)(1), which allows any interested person to request correction of patent information published in the Orange Book.

Patents improperly listed in the Orange Book can significantly undermine fair competition and harm the American public. The FTC will continue to use all its tools to halt unlawful business practices that contribute to high drug prices. 31 In re Lantus Direct Purchaser Antitrust Litig., 950 F.3d 1, 7 (1st Cir. 2020) (quoting Town of Concord v. Bos. Edison Co., 915 F.2d 17, 21 (1st Cir. 1990)). In In re Lantus, the First Circuit found a device patent covering an injector pen drive mechanism that drugmaker Sanofi submitted for listing in the Orange Book was improperly listed because the patent did not claim insulin glargine or the Lantus SoloSTAR product. Id. See also United Food & Com. Workers Local 1776 v. Takeda Pharm. Co., 11 F.4th 118, 134-136 (2d Cir. 2021). 32 15 U.S.C. § 18. See also Michael A. Carrier, et al., Prior Bad Acts and Merger Review, 111 GEO. L. J. 106 (2023).

33 See Fed. Trade Comm’n v. Shkreli, 581 F. Supp. 3d 579, 637 (S.D.N.Y. 2022) (citing Hartford-Empire Co. v. United States, 323 U.S. 386, 407 (1945)); Lorain Journal Co. v. United States, 342 U.S. 143, 145 n.2 (1951) (officers and directors “participated in the conduct alleged to constitute the attempt to monopolize”). 34 18 U.S.C. § 1001. FDA Form 3542—the form used by NDA holders to submit their patent information for listing in the Orange Book—warns those submitting patents for listing that “[a] willfully and knowingly false statement is a criminal offense under 18 U.S.C. 1001” directly beneath the declaration certifying to the accuracy and completeness of the submission. See FDA Form 3542, Section 6, https://www.fda.gov/media/133512/download.

Page 143

Policy Statement of the Federal Trade Commission on Franchisors’ Use of Contract Provisions, Including Non-Disparagement, Goodwill, and Confidentiality Clauses1 I.

Introduction The Federal Trade Commission (“Commission” or “FTC”) is charged with protecting franchisees from unfair methods of competition and unfair and deceptive practices.2 Communications with franchisees are essential for the Commission to accomplish this statutory mandate. The FTC is concerned that franchisees are reluctant or unwilling to voluntarily discuss or file reports about their experiences with franchisors, even if the franchisees believe a law violation has occurred.3 The Commission is issuing this Policy Statement to make clear its view that provisions included in franchise agreements or other contractual documents between franchisors and franchisees4 may not restrict franchisees’ communications with the Commission or any other state or federal law enforcer or regulator about potential law violations.5 In 2022, after hearing that franchisees may have had difficulty filing reports using the Commission’s reportfraud.ftc.gov portal, the Commission streamlined the reporting process.6 Since then, the number of reports has increased but the FTC remains concerned that some franchisees continue to report that they feel chilled or even contractually prohibited from 1This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates one or more existing statutory or regulatory requirements. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action under the FTC Act or other statutes.

215 U.S.C. 41-58, as amended; Franchise Rule, 16 C.F.R. pt. 436. The Franchise Rule is a pre-sale disclosure rule, which requires franchisors to provide prospective franchisees with material information to help prospective franchisees determine whether a franchise deal is in his or her best interest. 72 FR 15444 (Mar. 30, 2007). 3 This concern is not unique to franchising. See, e.g., Contracts that Impede Bureau of Competition Investigations, FED. TRADE COMM’N (June 15, 2023), https://www.ftc.gov/system/files/ftc_gov/pdf/Formal-Analysis.pdf. 4 Typically, a written contractual agreement – often called a “franchise agreement” – is entered into between a franchisee and franchisor. (That agreement also typically references, incorporates, or attaches the franchisor’s Operating Manual.) Once signed, the franchise agreement remains in effect for a specified period of time stated in the agreement. As part of the Franchise Disclosure Document required by the FTC’s Franchise Rule, franchisors must provide prospective franchisees with copies of all contracts, including the franchise agreement, at least fourteen days before the prospect signs any contract or makes any payment to the franchisor or an affiliate. 5 The Commission does not intend to provide legal advice to any potential report filers or witnesses and advises anyone with concerns about liability to consult an attorney. The Commission takes no issue with a company’s legitimate interest in protecting its intellectual property rights. The Commission notes that it will continue to analyze, on a case-by-case basis, whether contract provisions, such as confidentiality clauses, are unfair or deceptive under Section 5.

6 ReportFraud, FED. TRADE COMM’N, https://reportfraud.ftc.gov (last visited June 6, 2024); Lesley Fair, Franchise Fundamentals: Reducing the risks – and reporting if things go awry, FED. TRADE COMM’N (Sept. 5, 2023), https://consumer.ftc.gov/consumer-alerts/2023/09/franchise-fundamentals-reducing-risks-and-reporting-if-things-go­ awry (describing how to file a report via reportfraud.ftc.gov).

Page 144

reporting to the FTC.7 Franchisee reports and voluntary interviews are a critical part of FTC investigations. If franchisees are unwilling or unable to file reports and discuss their experiences, the FTC’s ability to protect franchisees is weakened. Furthermore, the competitive and consumer protection benefits that flow from the franchise business model are undermined. II.

Responses to Request for Information For several years, the Commission has been concerned that current and former franchisees are reluctant to file reports or speak with Commission staff about their experiences with particular franchises. Franchisee advocates have stated that franchisees fear retribution for speaking out against the franchisor.8 Franchisees may even be worried about speaking with regulators anonymously.9 In 2023, the Commission issued a Request for Information (“RFI”) related to franchise agreements and franchisor business practices in order to explore the ways in which franchisors may exert control over franchisees and their workers, including the effect certain contractual provisions have on franchisees’ ability to file reports with regulators.10 The RFI sought public comment on several topics, including whether non-disparagement, goodwill, and similar clauses inhibit franchisees from filing reports with regulators or from providing information to prospective franchisees or third parties about their experience with a franchise system.11 The Commission posted approximately 2,200 public comments in response to the RFI.12 Among the commenters who addressed the question of whether such clauses impact franchisees’ ability to speak with regulators, some expressed concerns that such clauses are likely to impede franchisees from speaking with the government.13 Some of those commenters filed their 7 See infra n.13 (comments filed in response to the Request for Information); FED. TRADE COMM’N, CONSUMER SENTINEL NETWORK BOOK 2023, https://www.ftc.gov/system/files/ftc_gov/pdf/CSN-Annual-Data-Book-2023.pdf. Of the 110,504 reports related to business and job opportunities, 3,232 pertained to franchises. 8 See e.g, Federal Trade Commission: Actions Needed to Improve Education Efforts and Awareness of Complaint Process for Franchise Owners, GOVERNMENT ACCOUNTABILITY OFFICE (Apr. 5, 2023), https://www.gao.gov/assets/gao-23-105338.pdf.

9 See infra n.13.

10 Fed. Trade Comm’n, Solicitation for Public Comments on Provisions of Franchise Agreements and Franchisor Business Practices, https://www.ftc.gov/system/files/ftc_gov/pdf/Franchise-RFI.pdf. 11 Id.

12 The Commission received 5,291 comments. Of those, 2,216 were publicly posted on the docket; the remainder were nonresponsive.

13 FTC-2023-0026-0042, filed by Anonymous (“Even submitting comments such as this one, to a governmental agency, is fraught due to the non-disparag[e]ment clauses included in all Franchise Agreements.”); FTC-2023-0026­ 0049, filed by Anonymous (“Furthermore, the non-disparagement and goodwill clauses are concerning. Franchisors often enforce these clauses to prevent franchisees from filing complaints about unfair or deceptive conduct. This not only harms franchisees but also consumers and workers.”); FTC-2023-0026-0167, filed by Caroline Fichter (“The mere presence of a non-disparagement clause in the franchise agreement has an immediate and devastating effect on the franchisee’s behavior. It prevents them from providing honest feedback to prospective franchisees and from reporting unfair and deceptive practices to federal or state authorities.”); FTC-2023-0026-1034, filed by Coalition of Franchisee Associations (“Non-disparagement clauses contained in the FA further prohibit franchisees from

Page 145

comments anonymously.14 At least one commenter stated that a franchisor threatened to terminate franchisees who spoke with regulators.15 Some noted a fear of retaliation for filing reports or otherwise communicating with regulators about their experience.16 Commenters disagreed about the extent to which franchisors use non-disparagement clauses, but agreed that confidentiality clauses are often included in settlement agreements and that goodwill clauses are very common. For example, one commenter noted that, while historically common in settlement agreements, non-disparagement and goodwill clauses are routinely included in franchise agreements and have expanded dramatically over the past several years.17 Others noted that, in their experience, specific non-disparagement clauses are uncommon, but clauses that prohibit the franchisee from doing anything that reflects negatively on the franchisor’s goodwill are very discussing their concerns with prospective franchisees or anyone at all - including government agencies.”); FTC­ 2023-0026-1093, filed by Maryland State Bar Association (“[W]e encourage the FTC to make a clear distinction between clauses that prohibit disparaging the franchisor or the brand in consumer-facing public forums, as opposed to clauses that inhibit franchisee communications with prospective franchisees, their fellow active franchisees, or with governmental agencies or in courts with regard to the franchise relationship.”); FTC-2023-0026-1557, filed by Anonymous (“Non-disparagement, goodwill or similar clauses, by their very nature, ABSOLUTELY inhibit franchisees from filing complaints with state, local, or federal agencies related to unfair or deceptive conduct by franchisors. As a franchisee, the fear of retribution and legal action is too great to justify risking a complaint that can be tied back to them.”); FTC-2023-0026-2104, filed by North American Securities Administrators Association (“Nondisparagement and goodwill clauses are also ubiquitous in franchising. Those agreements that limit franchisees’ ability to complain to government agencies are of particular concern. One such agreement states that the franchisee ‘must covenant never to commence any action or proceeding against [the franchisor], file any complaint with any regulatory authority concerning [the franchisor] or otherwise assert any claim against [the franchisor].’”); FTC-2023-0026-2062, filed by National Owners Association (“The nondisparagement clause, paired with systemic threats, intimidation, and retaliation, significantly inhibits franchisees from filing complaints with state, local, or federal agencies related to unfair or deceptive conduct by franchisors, or even from speaking publicly or participating in franchisee-only organizations designed to protect and pursue franchisee interests.”). 14 FTC-2023-0026-0042, filed by Anonymous; FTC-2023-0026-0049, filed by Anonymous; FTC-2023-0026-1557, filed by Anonymous.

15 FTC-2023-0026-1952, filed by Thomas Ayres, Warner, Federico & Ryan LLP (“The franchisor has threatened to terminate franchisees that sought clarification from regulators on new policies and that were quoted in trade publications because such actions falsely stating [sic] that the comments reflected materially and unfavorably upon the operation and reputation of the system and disclosed sensitive and confidential information.”). 16 FTC-2023-0026-2062, filed by National Owners Association; FTC-2023-0026-2123, filed by North American Subway Association of Franchisees (“Franchisees, anecdotally, are and have been fearful of retribution for launching complaints to proper authorities.”); FTC-2023-0026-2170, filed by American Association of Franchisees and Dealers (“Many franchise agreements now consider anything said negatively about the brand, no matter who it is said to, a violation of the non-disparagement clause. This includes between franchisees that are part of a chapter or franchisee association or a franchisee post on their private discussion groups. Often any negative discussion is followed by a threatening legal letter to the franchisee which quickly silences them. But it often does not stop there; increased inspections follow and amazingly, these franchisees are found in default for another reason. The retaliation is obvious, but often hard to prove, especially since in many businesses it is not that hard to find some level of default.”); FTC-2023-0026-1943, filed by Independent Association of Home Instead Franchisees, Inc (“We are aware of at least one case in our network where a franchisee was sanctioned for communications with government regulatory authority but will not provide additional details for fear of further retaliation against the franchisee.”) 17 FTC-2023-0026-1941, filed by Bundy & Fichter; see also FTC-2023-0026-2104, filed by North American Securities Administrators Association (“Non-disparagement and goodwill clauses are also ubiquitous in franchising”).

Page 146

common.18 A few commenters stated that, while franchise agreements may include nondisparagement or goodwill clauses, the franchisors either do not enforce them or such provisions do not inhibit franchisees’ ability to communicate with regulators.19 III.

Analysis The Commission has seen contract provisions that may restrict current and former franchisees from speaking about potential law violations. These provisions may take the form of nondisparagement clauses (“franchisee shall not disparage the brand in any way”), confidentiality or non-disclosure clauses (“franchisee is prohibited from sharing any information about the franchise or their experience”), goodwill clauses (“franchisee shall not engage in any conduct that may tarnish the goodwill of the brand”), and similar clauses. They are sometimes included in franchise agreements or may be entered into post-sale, including at termination of the relationship.20 Generally, case law establishes that clauses that impair or prohibit free communication about potential law violations with an administrative agency acting within its statutory mandate are void and unenforceable. For example, courts have struck down contractual clauses that otherwise prevent a government agency from seeking and obtaining complete, candid information in 18 FTC-2023-0026-1093, filed by Maryland State Bar Association (“It is our experience that these clauses are not usually present in Franchise Agreements, other than a general clause that the Franchisee does not do anything that can reflect negatively on the Franchisor’s goodwill.”); FTC-2023-0026-1936, filed by Lathrop GPM, LLP (“We are aware of very few instances where non-disparagement provisions are used in standard franchise agreements, with such provisions appearing in approximately 6% of the FDDs we surveyed. Such clauses are generally used in termination, release, and settlement agreements to resolve disputes and prevent adverse actions by both parties. It is not clear what is meant in the RFI by “goodwill” clauses. If this is intended to mean that the trademark goodwill arising from the franchisee’s use of the franchised brand inures to the benefit of the franchisor, then such clauses are likely universal in franchising…”).

19 FTC-2023-0026-1724, filed by Wyndham Hotels & Resorts (“The existence of the goodwill provision in our franchise agreements does not inhibit franchisees from pursuing claims they feel they may have relating to unfair or deceptive conduct or from providing non-confidential, non-trade secret information to prospective or current franchisees or third parties.”); FTC-2023-0026-2152, filed by International Franchise Association (“IFA believes that franchisees generally support such clauses and that the clauses do not inhibit franchisees from sharing information with other franchisees, prospective franchisees or with regulators.”); FTC-2023-0026-2129, filed by Domino’s Pizza, Inc. (“The SFA contains a non-disclosure provision which is intended, in part, to prohibit franchisees from disclosing non-public information about Domino’s or the Domino’s system to others outside the Domino’s system, including financial analysts, or from disparaging Domino’s or the Domino’s system in the manner that would harm the Domino’s brand. The provision is not intended to prohibit franchisees from communicating with other franchisees, prospective franchisees, or federal, state, or local government agencies, nor has Domino’s sought to enforce this provision to prevent any such communication.”). 20 The Franchise Rule requires franchisors to disclose the use of confidentiality clauses, and nothing in this Statement alters that requirement. See 16 C.F.R. § 436.5(t)(7). To the extent, however, such clauses, as drafted, impair or prohibit the free communication about potential law violations with a government agency acting within its statutory mandate, the Commission views such clauses as void and unenforceable and in violation of Section 5 of the FTC Act. To the extent such clauses narrowly articulate a company’s legitimate interest in protecting its intellectual property rights, however, they raise no concern under this Statement. See supra n.5.

Page 147

furtherance of a statutory mandate.21 Such clauses cannot operate to inhibit a franchisee from reporting potential law violations to the government.

Similarly, the FTC has challenged companies’ use of tactics, including non-disparagement clauses, that discourage purchasers from speaking or publishing truthful or non-defamatory negative comments or reviews as unfair practices under the FTC Act. For example, in FTC v. Roca Labs, Inc., the court found on summary judgment that Defendants’ use of gag clauses to prohibit purchasers from speaking or publishing truthful or non-defamatory negative comments or reviews about the Defendants, their products, or their employees was an unfair practice in violation of Section 5 of the FTC Act.22 A practice is unfair if it causes or is likely to cause substantial consumer injury, which consumers cannot reasonably avoid, and which is not outweighed by benefits to consumers or competition.23 Clauses that prohibit a franchisee from reporting potential law violations to the government are unfair. Similarly, implicit or explicit threats of retaliation, by legal action or otherwise, against a franchisee for reporting potential law violations to the government are unfair. By suppressing reports of potential legal violations by franchisors to the government, franchisors impede the flow of franchisee reports and voluntary interviews that are critical to government 21 See, e.g., EEOC v. Astra USA, 94 F.3d 738, 744–45 (1st Cir. 1996) (holding that employers may not use confidentiality agreements to interfere with or restrict law enforcement agencies’ ability to interview their employees); FTC v. AMG Services, Inc., No. 2:12-cv-00536-GMN-VCF, 2013 WL 12320929, at *2 (D. Nev. Aug. 20, 2013) (“[T]he court finds that the confidentiality agreements at issue before the court are unenforceable to prohibit former employees from willingly cooperating with the FTC.”); Sparks v. Seltzer, No. 05-CV-1061 (NG) (KAM), 2006 WL 2358157, at *4 (E.D.N.Y. Aug. 14, 2006) (“Indeed, agreements restricting former employee revelation of events in the workplace which are not privileged but may involve violations of federal law have the effect of hindering implementation of the Congressionally mandated duty to enforce the provisions of federal statutes.”) (internal quotations and citation omitted); EEOC v. Int’l Profit Assocs., No. 01 C 4427, 2003 U.S. Dist. LEXIS 6761 at *6 (N.D. Ill. Apr. 21, 2003) (“[A]ny contractual impairment of present or former [] employees’ ability to communicate freely with the EEOC is void as against public policy.”); Hoffman v. Sbarro, Inc., No. 97 CIV. 4484(SS), 1997 WL 736703, at *1 (S.D.N.Y. Nov. 26, 1997) (“To the extent that the [nondisclosure] agreement might be construed as requiring an employee to withhold evidence relevant to litigation designed to enforce federal statutory rights, it is void.”).

22 FTC v. Roca Labs, Inc., 345 F. Supp. 3d 1375, 1393-96 (M.D. Fla. 2018); see also FTC v. World Patent Mktg., Inc., No. 17-CV-20848-DPG (S.D. Fla. May 25, 2017) (in entering a preliminary injunction, court found that “by intimidating, threatening, and coercing consumers from reporting Defendants’ misrepresentations, Defendants are able to hinder competition and harm legitimate competitors in the marketplace.”), 2017 WL 3508639, Preliminary Injunction entered August 16, 2017; id., Compl. ¶ 36 (alleging that “if consumers do complain to the BBB or law enforcement about Defendants’ business practices, Defendants and their lawyers often make legal threats against the complainants until they retract their complaints.”).

The Consumer Review Fairness Act (CRFA), 15 U.S.C. § 45b, makes it illegal for companies to include standardized contract provisions that threaten or penalize people for posting honest reviews. Regardless of whether the franchisor/franchisee relationship would fall outside of the CRFA, the Commission is of the view that any contract provision that directly or indirectly restricts or chills communications between franchisees and law enforcers or regulators is an unfair or deceptive act or practice, or an unfair method of competition under Section 5 of the FTC Act. To the extent a contract provision chills communications outside of law enforcers or regulators, the Commission will evaluate its legality on a case-by-case basis.

23 15 U.S.C. § 45(n); see also Federal Trade Commission Policy Statement on Unfairness, appended to Int’l. Harvester Co., 104 F.T.C. 949, 1070-76 (1984).

Page 148

investigations.24 Suppressing such information undermines the government’s ability to learn about practices that violate the Franchise Rule, the FTC Act, and other laws. It also impedes the ability of franchisees to demand lawful conduct from the franchisor by exposing such conduct to the government. These limitations undermine the government’s ability to police the marketplace and the ability of prospective and existing franchisees to protect themselves, and are thus likely to cause substantial harm. For example, prospective franchisees may not learn about deceptive practices before they invest. Such harm, resulting from the franchisor’s contract provisions or communications, is not reasonably avoidable. Most prospective and existing franchisees would need to seek legal counsel on such contractual terms to understand that they are illegal, thus effectively chilling truthful communication with government agencies.25 No benefits flow from the suppression of truthful information to the government. Indeed, the competitive and consumer protection benefits that flow from the franchise business model are compromised.26 Other federal agencies, including the Securities and Exchange Commission, the National Labor Relations Board, the Federal Aviation Administration, and the National Highway Traffic Safety Administration, have determined that such contractual provisions can impede agencies’ ability to conduct lawful investigations and, as a result, run contrary to public policy.27 24 See also supra n.22.

25 C.f. Complaint, United States v. Square One Dev. Grp., (E.D. Mo. Nov. 21, 2022) (No. 4:22-cv-01243) (complaint alleged unfairness where defendants induced consumers into signing contracts for timeshare exit services containing non-negotiable and unenforceable terms). See also Complaint ¶¶ 30-34, 56-58, United States v. Asset Acceptance Corp. (M.D. Fla. Jan. 30, 2012) (No. 8:12-cv-182-T-27-EAJ), https://www.ftc.gov/sites/default/files/documents/cases/2012/01/120130assetcmpt.pdf (alleging deception where defendant failed to disclose in debt collection activities that it cannot require that consumers pay debts beyond the statute of limitations).

26 To be clear, this Statement is focused on clauses that restrict or inhibit franchisees from discussing their experience with law enforcers and regulators. The concern is that these types of contract provisions are obstructing the Commission’s statutory mandate to protect consumers, including franchisees, from unfair methods of competition and unfair or deceptive acts or practices. This issue is distinct from the potential harm analyzed by the Commission as part of the 2007 rulemaking proceeding for the Franchise Rule focused on whether such clauses would inhibit prospective franchisees’ ability to conduct due diligence regarding particular franchise opportunities. 72 Fed. Reg. 15444, 15454-55, 15504-07 (Mar. 30, 2007). Notably, in the amended Franchise Rule, the Commission limited the definition of “confidentiality clause” in a way that it would apply only to restricted speech to prospective franchisees and not to regulators. 16 C.F.R. § 436.1(c). At least one commenter noted in the rulemaking that the use of confidentiality clauses may restrict franchisees’ willingness to talk to regulators, but the Commission’s analysis focused on the harm such clauses would have on prospective franchisees. 72 Fed. Reg. at 15505 (“In addition, one franchisee representative, contended that the harm flowing from confidentiality provisions goes beyond individual franchise sales, noting that such provisions intimidate franchisees into not testifying before legislative committees and public agencies, such as the Federal Trade Commission.”).

27 The U.S. Securities and Exchange Commission adopted Rule 21F-17, which prohibits enforcing or threatening to enforce a confidentiality agreement that would impede communications with the agency. 17 C.F.R. § 240.21F-17. The National Highway Transportation Safety Administration has stated that it is unlawful to use confidentiality and non-disclosure provisions to impede oversight and enforcement-related regulatory obligations. See, e.g., Neal Boudette, Tesla Model S Suspension Failures Under Scrutiny by Safety Agency, N.Y. TIMES, June 9, 2016, https://www.nytimes.com/2016/06/10/business/tesla-model-s-nhtsa-suspension-failure.html; see also Fed. Aviation Admin., Impact of Non-Disclosure and Confidentiality Covenants on Agency Investigations, https://www.faa.gov/sites/faa.gov/files/about/office_org/headquarters_offices/agc/Non_Disclosure_Guidance.pdf; Complaint and Consent Decree, EEOC v. Baker & Taylor, Inc., No. 13-cv-03729 (N.D. Ill. May 20, 2013), ECF

Page 149

IV.

Conclusion The FTC takes seriously its statutory obligation to enforce the FTC Act. Whether the contract includes a non-disparagement, non-disclosure, goodwill, or similar clause, the caselaw is clear that such clauses cannot operate to inhibit a franchisee from reporting potential law violations to the government. Clauses prohibiting franchisees from reporting potential law violations to the government are considered unfair and unenforceable. Further, the use of implicit or explicit threats to sue or otherwise retaliate against a franchisee who reports potential law violations to the government is also an unfair practice.

For purposes of this policy statement, it is immaterial when the contract containing the provision was entered, and it is immaterial whether the clause is in a binding contract or any other document. In addition, the principles set forth in this policy statement apply to any communications invoking or referencing the types of clauses described in this statement. Accordingly, any such communications must be consistent with this policy statement. Nos. 1, 14 (requiring that employee agreements include language protecting the right to communicate with the EEOC and comparable regulatory agencies).

Page 150

Staff Guidance on the Unlawfulness of Undisclosed Fees Imposed on Franchisees1 The Franchise Rule requires franchisors to disclose fees in a Franchise Disclosure Document (FDD) so that prospective franchisees are advised of their likely purchase obligations while operating the franchise.2 The issue of franchisors imposing and collecting fees from franchisees that were not disclosed in their FDDs recently has been raised with the FTC in various forums, including comments submitted in response to the FTC’s Request for Information Related to Franchisors’ Business Practices,3 at an event Chair Khan attended with franchisee associations,4 and elsewhere. We’ve heard that one way franchisors may impose previously undisclosed fees is by making changes to the Operating Manual. Within the past year, Washington’s Department of Financial Institutions5 and California’s Department of Financial Protection and Innovation6 have opined on whether franchisors may impose fees on franchisees that were not disclosed in the franchisor’s FDD. Given the recent interest in this issue, staff is releasing this guidance regarding the unlawful imposition of undisclosed fees.7 The Franchise Rule requires franchisors to disclose in the FDD certain fees.8 If a franchisor fails to disclose those fees in the FDD, such failure is a violation of the Franchise Rule and Section 5 of the FTC Act.9 Furthermore, if a franchisor imposes or collects a new fee, through its operating manual or otherwise, that was not disclosed in the FDD and included in the franchise agreement, the franchisor may be engaging in an unfair act or practice in violation of Section 5 of the FTC Act.10 Courts have upheld the FTC’s view that unilateral changes to contract terms are an unfair act or practice. For example, in FTC v. Orkin Exterminating Co., the 11th Circuit upheld the FTC’s finding that Orkin had engaged in an unfair act or practice by increasing the fee it charged customers above the amount provided in their contracts. The company had entered into agreements with consumers to provide lifetime termite protection services for a fixed annual 1 This document represents the views of FTC staff and is not binding on the Commission. 2 72 Fed. Reg. 15444 (Mar. 30, 2007).

3 E.g., Comment from Anonymous, FTC-2023-0026-0464; Comment from AAHOA, FTC-2023-0026-1938. 4 Is Franchising Fair? Franchisee Conversations and the Federal Trade Commission (May 2, 2023), https://register.gotowebinar.com/recording/recordingView?webinarKey=8052325513814056792&registrantEmail=l andscooter%40gmail.com.

5 Wash. State Dep’t of Fin. Insts., Franchise Act Interpretive Statement – FIS-09 (Nov. 1, 2023), https://dfi.wa.gov/industry/franchise-act-interpretive-statements/franchise-act-interpretive-statement-fis-09. 6 Franchises – Frequently Asked Questions and Answers, CAL. DEP’T OF FIN. PROT. & INNOVATION, https://dfpi.ca.gov/franchise-investment-law/franchises-frequently-asked-questions-and-answers/#b15 (last visited June 10, 2024).

7 Staff does not intend to provide legal advice to any franchisor or franchisee and advises anyone with concerns about liability regarding particular practices to consult an attorney. 8 E.g., 16 C.F.R. § 436.5(e) (initial fees); 16 C.F.R. § 436.5(f) (other fees). Also, Item 9 provides a Table to facilitate finding references to fees throughout the FDD. 16 C.F.R. § 436.5(i). 9 16 C.F.R. § 436.6(a).

10 An act or practice is unfair if it causes or is likely to cause substantial consumer injury, which consumers cannot reasonably avoid, and which is not outweighed by benefits to consumers or competition. 15 U.S.C. § 45(n); see also Federal Trade Commission Policy Statement on Unfairness, appended to Int’l. Harvester Co., 104 F.T.C. 949, 1070­ 76 (1984). We also note that state law may offer additional protections for franchisees against the imposition of undisclosed fees. E.g., Wash. Rev. Code § 19.100.170(2).

Page 151

fee.11 Years after entering the contracts, Orkin unilaterally modified the contracts and raised the amount of the annual fee.12 The Commission found that although there was no deception in the formation of the contracts, the practice was unfair because it caused substantial, unavoidable consumer injury that was not outweighed by benefits to consumers or competition.13 Any determination of whether a franchisor is engaged in violations of the Franchise Rule or the FTC Act will be fact specific, and staff is not taking a position on whether any particular company is currently violating the Franchise Rule or Section 5. Nevertheless, franchisors should review their practices to ensure compliance with the law.

11 108 F.T.C. 263 (1986), aff’d, Orkin Exterminating Co. v. FTC, 849 F.2d 1354 (11th Cir. 1988). 12 Id.

13 Id.

Page 152

Joint Statement on Competition in Generative AI Foundation Models and AI Products Margrethe Vestager, Executive Vice-President and Competition Commissioner, European Commission Sarah Cardell, Chief Executive Officer, U.K. Competition and Markets Authority Jonathan Kanter, Assistant Attorney General, U.S. Department of Justice Lina M. Khan, Chair, U.S. Federal Trade Commission Working in the interests of fair, open, and competitive markets As competition authorities for the European Union, the United Kingdom and the United States of America, we share a commitment to the interests of our people and economies. Guided by our respective laws, we will work to ensure effective competition and the fair and honest treatment of consumers and businesses. This is grounded in the knowledge that fair, open, and competitive markets will help unlock the opportunity, growth and innovation that these technologies could provide. Sovereign decision-making Our legal powers and jurisdictional contexts differ, and ultimately, our decisions will always remain sovereign and independent. However, if the risks described below materialize, they will likely do so in a way that does not respect international boundaries. As a result, we are working to share an understanding of the issues as appropriate and are committed to using our respective powers where appropriate.

A technological inflection point We have all, in a variety of documents and fora, recognized the transformational potential of artificial intelligence, including foundation models. At their best, these technologies could materially benefit our citizens, boost innovation and drive economic growth. Although there are many unknowns about the precise trajectory these tools will take, generative AI has rapidly evolved in recent years, potentially becoming one of the most significant technological developments of the past couple of decades. Technological inflection points can introduce new means of competing, catalyzing opportunity, innovation, and growth. Accordingly, we must work to ensure the public reaps the full benefits of these moments. This requires being vigilant and safeguarding against tactics that could undermine fair competition. For example, there are risks that firms may attempt to restrict key inputs for the development of AI technologies; that firms with existing market power in digital markets could entrench or extend that power in adjacent AI markets or across ecosystems, taking advantage of feedback and network effects to increase barriers to entry and harm competition; that lack of choice for content creators among buyers could enable the exercise of monopsony power; and that AI may be developed or wielded in ways that harm consumers, entrepreneurs, or other market participants. Given the speed and dynamism of AI developments, and learning from our experience with digital markets, we are committed to using our available powers to address any such risks before they become entrenched or irreversible harms.

Page 153

Risks to competition While we recognise the great potential benefits from the new services that AI is helping bring to market, we also see risks requiring ongoing vigilance. Key to assessing these risks will be focusing on how the emerging AI business models drive incentives, and ultimately behaviour. 1. Concentrated control of key inputs. Specialized chips, substantial compute, data at scale, and specialist technical expertise are critical ingredients to develop foundation models. This could potentially put a small number of companies in a position to exploit existing or emerging bottlenecks across the AI stack and to have outsized influence over the future development of these tools. This could limit the scope of disruptive innovation, or allow companies to shape it to their own advantage, at the expense of fair competition that benefits the public and our economies.

2. Entrenching or extending market power in AI-related markets. Foundation models are arriving at a time when large incumbent digital firms already enjoy strong accumulated advantages. For example, platforms may have substantial market power at multiple levels related to the AI stack. This can give these firms the ability to protect against AI-driven disruption, or harness it to their particular advantage, including through control of the channels of distribution of AI or AI-enabled services to people and businesses. This may allow such firms to extend or entrench the positions that they were able to establish through the last major technological shift to the detriment of future competition. 3. Arrangements involving key players could amplify risks. Partnerships, financial investments, and other connections between firms related to the development of generative AI have been widespread to date. In some cases, these arrangements may not harm competition but in other cases these partnerships and investments could be used by major firms to undermine or coopt competitive threats and steer market outcomes in their favour at the expense of the public.

Principles for protecting competition in the AI ecosystem Our experience in related markets suggests that, while competition questions in AI will be fact-specific, several common principles will generally serve to enable competition and foster innovation: 1. Fair dealing. When firms with market power engage in exclusionary tactics, they can deepen their moats, discourage investment and innovation by third parties, and undermine competition. The AI ecosystem will be better off the more that firms engage in fair dealing. 2. Interoperability. Competition and innovation around AI will likely be greater the more that AI products and services and their inputs are able to interoperate with each other. Any claims that interoperability requires sacrifices to privacy and security will be closely scrutinized. 3. Choice. Businesses and consumers in the AI ecosystem will benefit if they have choices among diverse products and business models resulting from a competitive process. This means scrutinizing ways that companies may employ mechanisms of lock-in that could prevent companies or individuals from being able to meaningfully seek or choose other options. It also means scrutinizing investments and partnerships between incumbents and newcomers, to ensure that these agreements are not sidestepping merger enforcement or handing incumbents undue influence or control in ways that undermine competition. For content creators, choice among buyers could limit the exercise of monopsony power that can harm the free flow of information in the marketplace of ideas.

Page 154

Other competition risks associated with AI We are mindful of other risks that can arise where AI is deployed in markets. These include, for instance, the risk that algorithms can allow competitors to share competitively sensitive information, fix prices, or collude on other terms or business strategies in violation of our competition laws; or the risk that algorithms may enable firms to undermine competition through unfair price discrimination or exclusion. We will be vigilant of these and other risks that might emerge as AI technology develops further.

In light of these risks, we are committed to monitoring and addressing any specific risks that may arise in connection with other developments and applications of AI, beyond generative AI. Consumer risks associated with AI AI can turbocharge deceptive and unfair practices that harm consumers. The CMA, DOJ and the FTC, which have consumer protection authority, will also be vigilant of any consumer protection threats that may derive from the use and application of AI.

Firms that deceptively or unfairly use consumer data to train their models can undermine people’s privacy, security, and autonomy. Firms that use business customers’ data to train their models could also expose competitively sensitive information. Furthermore, it is important that consumers are informed, where relevant, about when and how an AI application is employed in the products and services they purchase or use.

Page 155

Federal Trade Commission Enforcement Policy Statement on Exemption of Protected Labor Activity by Workers from Antitrust Liability0F1 I.

Introduction Congress enacted the Clayton and Norris-LaGuardia Acts in significant part to protect the ability of workers to organize and to collectively bargain over wages and labor conditions. Several provisions of these acts prevent courts from enjoining qualifying labor activity and shield such activity from antitrust liability. Collectively, these provisions are known as the labor exemption to the antitrust laws, and they shield from antitrust liability the conduct of bona fide labor organizations engaged in labor disputes—i.e., organizing and bargaining over the terms and conditions of employment.

It has long been clear that employees who are directly hired by an employer are protected from antitrust liability by the labor exemption when they are organizing or bargaining with that employer over their compensation and/or working conditions. More recently, however, the rise of independent contracting, and of “gig work” in particular, has presented questions about the labor exemption’s application to the organizing and bargaining of workers who are classified—or potentially misclassified—by a firm as independent contractors.1F2 Particularly as gig workers contemplate efforts to organize or bargain collectively with platforms for the first time, they face a patchwork of cases regarding the exemption’s application.

In this enforcement policy statement, the Commission clarifies its view that the labor exemption’s application does not turn on whether a worker is formally classified by a firm as an independent contractor under the Fair Labor Standards Act (“FLSA”), the National Labor Relations Act (“NLRA”), tax law, state common law, or any other law. Rather, workers’ organizing and collective bargaining activity may be protected from antitrust liability when what is at issue is the compensation for their labor or their working conditions. Workers engaged in such protected activity are not categorically beyond the scope of the labor exemption from antitrust liability simply because they do not have a formal employer-employee relationship with the firm with whom they seek to negotiate over the compensation for their labor or their working conditions.

II.

Background A. Enactment of the Labor Exemption from the Antitrust Laws

1 This Policy Statement does not confer any rights on any person and does not operate to bind the FTC or the public. In any enforcement action, the Commission must prove the challenged act or practice violates one or more existing statutory or regulatory requirements. In addition, this Policy Statement does not preempt federal, state, or local laws. Compliance with those laws, however, will not necessarily preclude Commission law enforcement action under the FTC Act or other statutes. Pursuant to the Congressional Review Act (5 U.S.C. § 801 et seq.), the Office of Information and Regulatory Affairs designated this Policy Statement as not a “major rule,” as defined by 5 U.S.C. § 804(2).

2 See, e.g., Rebecca K. Slaughter, Comm’r, Fed. Trade Comm., Comment Letter on Dep’t of Labor Notice of Proposed Rulemaking re: Independent Contractor Status under the Fair Labor Standards Act (Oct. 26, 2020), https://www.ftc.gov/system/files/documents/public_statements/1582178/comment_of_commissioner_rebecca_kelly _slaughter_on_the_department_of_labor_proposed_rule_on_0.pdf.

Page 156

The labor exemption from the antitrust laws stems from several enactments in which Congress sought to broadly protect workers’ ability to organize and to negotiate for better pay and working conditions. After Congress passed the Sherman Act in 1890, employers used the Act to challenge and disrupt the activities of labor unions. Indeed, twelve of the first thirteen successful antitrust lawsuits under the Sherman Act were brought against labor unions, not corporations.2F3 In what was popularly known as the “Danbury Hatters’ Case,” the Supreme Court in 1908 enjoined employees of a Danbury, Connecticut hat manufacturer from unionizing, unanimously holding that organizations of laborers were not exempt from the Sherman Act.3F4 In response to such uses of the Sherman Act against organizing workers, Congress enacted Sections 6 and 20 of the Clayton Act in 1914,4F5 creating what is known as the labor exemption to the antitrust laws. Section 6 of the Clayton Act provides that the “labor of a human being is not a commodity or article of commerce” and that the antitrust laws shall not be “construed to forbid the existence and operation of labor . . . organizations” or “to forbid or restrain individual members of such organizations from lawfully carrying out the legitimate objects” of those organizations.5F6 Section 20 of the Clayton Act prohibits “restraining order[s] or injunction[s] . . . in any case between an employer and employees, or between employers and employees, or between employees, or between persons employed and persons seeking employment, involving, or growing out of, a dispute concerning terms or conditions of employment,” unless necessary to protect certain property interests.6F7 It further prohibits “restraining order[s] or injunctions” that “prohibit any person or persons” from engaging in certain protected activities, including “ceasing to perform any work or labor,” peacefully persuading others to “abstain from working,” “ceasing to patronize” parties to a dispute, peacefully persuading others not to patronize parties to a dispute, peacefully and lawfully assembling, providing strike benefits, and “doing any act or thing which might lawfully be done in the absence of such dispute by any party thereto.”7F8 Senator Ashurst referred to the labor provisions of the bill as the “laborer’s bill of rights.”8F9 Despite the broad language of the Clayton Act, courts construed Sections 6 and 20 narrowly and continued to issue injunctions and impose antitrust liability on labor unions’

3 Edward Berman, LABOR AND THE SHERMAN ACT 3 (1930). See also Kate Andrias, Beyond the Labor Exemption: Labor’s Antimonopoly Vision and the Fight for Greater Democracy 6 (2023) (“By one count, at least 4,300 injunctions were issued against union activity between 1880 and 1930.”). 4 Loewe v. Lawlor, 208 U.S. 274 (1908).

5 Senator Ashurst specifically noted the “Danbury Hat” case as one of many “strained and harsh” judicial interpretations of the Sherman Act that militated for the adoption of explicit exemptions in the Clayton Act to protect laborers from antitrust enforcement. 51 Cong. Rec. 13663 (1914) (statement of Sen. Henry Ashurst). Senator Hollis similarly remarked that the Sherman Act had been “tortured into a meaning” that transformed a law “intended for the relief of the plain people . . . into an instrument for their oppression.” Id. at 13967 (statement of Sen. Henry Hollis). See generally Alvaro M. Bedoya & Bryce Tuttle, “Aiming at Dollars, Not Men”: Recovering the Congressional Intent Behind the Labor Exemption to Antitrust Law, 85 ANTITRUST L.J. 805, 809-13 (2024). 6 15 U.S.C. § 17 (1914).

7 29 U.S.C. § 52 (1914). Section 20 generally prohibits restraining orders or injunctions in cases “growing out of, a dispute concerning terms or conditions of employment, unless necessary to prevent irreparable injury” to specific property interests. The statute also enumerates a number of protected activities for which restraining orders or injunctions may not issue.

8 Id.

9 51 Cong. Rec. 13663 (1914) (statement of Sen. Henry Ashurst).

Page 157

organizing and collective bargaining activity.9F10 In response, Congress passed the Norris- LaGuardia Act in 1932, which expanded the labor exemption.10F11 As the Supreme Court has explained, “[t]he underlying aim of the Norris-LaGuardia Act was to restore the broad purpose which Congress thought it had formulated in the Clayton Act but which was frustrated, so Congress believed, by unduly restrictive judicial construction.”11F12 The Norris-LaGuardia Act states that “the individual unorganized worker is commonly helpless to exercise actual liberty of contract and to protect his freedom of labor, and thereby to obtain acceptable terms and conditions of employment.”12F13 Specifically, Section 2 of the Norris- LaGuardia Act declares “the public policy of the United States” as follows: Whereas under prevailing economic conditions, developed with the aid of governmental authority for owners of property to organize in the corporate and other forms of ownership association, the individual unorganized worker is commonly helpless to exercise actual liberty of contract and to protect his freedom of labor, and thereby to obtain acceptable terms and conditions of employment, wherefore, though he should be free to decline to associate with his fellows, it is necessary that he have full freedom of association, self-organization, and designation of representatives of his own choosing, to negotiate the terms and conditions of his employment, and that he shall be free from the interference, restraint, or coercion of employers of labor, or their agents, in the designation of such representatives or in self-organization or in other concerted activities for the purpose of collective bargaining or other mutual aid or protection[.]13F14 Section 1 of the Norris-LaGuardia Act strips federal courts of jurisdiction “to issue any restraining order or temporary or permanent injunction in a case involving or growing out of a labor dispute” except in limited cases where necessary to prevent “substantial and irreparable injury to complainant’s property” flowing from “unlawful acts.”14F15 It further provides that “nor

10 See, e.g., 3 Julian O. von Kalinowinski, ANTITRUST LAWS AND TRADE REGULATION § 54.02(1) (collecting cases) (“[D]espite the statutes’ broad terminology and the intent of Congress to exempt labor organizations from the antitrust laws, the courts strictly construed Sections 6 and 20 of the Clayton Act and continued to hold labor unions and their members liable under the Sherman Act,” thus “weaken[ing]” Section 20 of the Clayton Act and “virtually nullify[ing]” Section 6 of the Act); Jacksonville Bulk Terminals, Inc. v. Int’l Longshoremen’s Ass’n, 457 U.S. 702, 712 (1982) (noting that the Supreme Court “unduly restricted the Clayton Act’s labor exemption” after it was created).

11 See United States v. Hutcheson, 312 U.S. 219, 231 (1941) (“whether trade union conduct constitutes a violation of the Sherman Law is to be determined only by reading the Sherman Law and § 20 of the Clayton Act and the Norris- LaGuardia Act as a harmonizing text of outlawry of labor conduct”); 15 U.S.C. § 17 (1914); 29 U.S.C. §§ 101–14 (1932).

12 Hutcheson, 312 U.S. at 235-36. Congressman LaGuardia himself explained that judicial opinions following enactment of the Clayton Act had “willfully disobeyed the law,” “emasculated it,” “took out its meaning as intended by Congress,” and “made the law absolutely destructive of the very intent of Congress.” 75 Cong. Rec. 5478 (1932) (Statement of Rep. Fiorello LaGuardia).

13 29 U.S.C. § 102 (1932).

14 Id.

15 Id. §§ 101, 107.

Page 158

shall any such restraining order or temporary or permanent injunction be issued contrary to the public policy” quoted above.15F16 Section 113(c) of the Act then defines “labor dispute” to include: any controversy concerning terms or conditions of employment, or concerning the association or representation of persons in negotiating, fixing, maintaining, changing, or seeking to arrange terms or conditions of employment, regardless of whether or not the disputants stand in the proximate relation of employer and employee.16F17 The Norris-LaGuardia Act further explains that in addition to encompassing disputes involving “employees of the same employer” and other scenarios, “[a] case shall be held to involve or to grow out of a labor dispute when the case involves persons who are engaged in the same industry, trade, craft or occupation; or have direct or indirect interests therein.”17F18 Although the Norris-LaGuardia Act is phrased as a bar on judicial injunctions, the Supreme Court has long read it in conjunction with the Clayton Act provisions as establishing a labor exemption that operates as a general shield from antitrust liability.18F19 B. The Rise in Independent Contracting and Gig Work and Confusion Regarding the Labor Exemption’s Application Across the U.S. economy, firms are turning to independent contracting models to accomplish work previously performed under traditional direct hire employment models.19F20 In particular, online gig platforms often seek to categorize their workers as independent contractors, even though in practice these firms may tightly prescribe their workers’ tasks and compensation in ways that run counter to the promise of independence.20F21 Additionally, many gig workers have lower incomes and may earn less than the minimum wage.21F22 More than half of American gig

16 Id. § 101.

17 Id. § 113(c); see, e.g., Jacksonville Bulk Terminals, Inc. v. Int’l Longshoremen’s Ass’n, 457 U.S. 702, 709 (1982) (observing that the term “labor dispute” is defined “broadly” in Section 113(c)). 18 29 U.S.C. § 113(a) (1932); see also id. § 113(b).

19 United States v. Hutcheson, 312 U.S. 219, 235 (1941) (“[I]t would be strange indeed” if Congress’s “elaborate efforts to permit [activities related to labor disputes] failed to prevent criminal liability punishable with imprisonment and heavy fines. That is not the way to read the will of Congress, particularly when expressed by a statute which, as we have already indicated, is practically and historically one of a series of enactments touching one of the most sensitive national problems. Such legislation must not be read in a spirit of mutilating narrowness.”); see also id. at 231 (noting that “whether trade union conduct constitutes a violation of the Sherman Law is to be determined only by reading the Sherman Law and § 20 of the Clayton Act and the Norris-LaGuardia Act as a harmonizing text”).

20 See, e.g., David Weil, Preparing for the Future of Work Through Understanding the Present of Work: A Fissured Workplace Perspective, Testimony before the U.S. House of Representatives Committee on Education and Labor Subcommittee on Workforce Protections and Subcommittee on Health, Employment, Labor, and Pensions, at 2 (Oct. 23, 2019).

21 See FTC Policy Statement on Enforcement Related to Gig Work, at 4 (Sept. 15, 2022), https://www.ftc.gov/legallibrary/browse/policy-statement-enforcement-related-gig-work. 22 See Ben Zipperer, Celine McNicholas, Margaret Poydock, Daniel Schneider, and Kristen Harknett, Econ. Pol’y Inst., National Survey of Gig Workers Paints a Picture of Poor Working Conditions, at 1 (June 1, 2022) (“[A] survey of gig workers reveals that these workers often are paid low wages, in some instances less than the minimum wage [and] they face economic insecurity at high rates . . . .”); see also Monica Anderson, Colleen McClain, Michelle

Page 159

workers report that the money they earn through the gig economy is essential or important for meeting their basic needs.22F23 Against this backdrop, some gig workers have begun contemplating forming unions to bargain with online gig platforms, giving rise to questions about the protections afforded to such activity under federal law. To date, courts have not addressed whether organizing and bargaining activities of gig workers are shielded from antitrust liability by the labor exemption, and there is a patchwork of cases addressing whether independent contractors are excluded from the exemption’s protections against antitrust liability. The Commission accordingly seeks to clarify its enforcement policy relating to the labor exemption from antitrust liability. The Commission notes that while this enforcement policy statement reflects its view of the correct application of the labor exemption, it does not bind other potential antitrust litigants, such as private plaintiffs or other enforcement agencies. Accordingly, the Commission’s policy not to challenge labor organizing or bargaining activity by independent contractors that the Commission believes to be properly protected under the labor exemption does not provide workers any guarantee against antitrust claims by others. Additionally, the Commission notes that this enforcement policy statement addresses only the labor exemption from antitrust liability. This policy statement thus does not address the legal status of organizing, bargaining, or other labor activity by independent contractors under the National Labor Relations Act or any other statute.

III.

Analysis The protection of all workers from antitrust liability when they are engaged in protected labor activities is firmly grounded in the statutory text of the Clayton and Norris-LaGuardia Acts, is consistent with existing case law, and constitutes sound enforcement policy reflective of the original meaning of the labor exemption.

A. Workers Engaged in Protected Labor Activity Are Exempt from Antitrust Liability Even If Classified (or Misclassified) as Independent Contractors The Supreme Court has explained that the labor exemption’s definition of a protected “‘labor dispute’ must not be narrowly construed because the statutory definition itself is extremely broad and because Congress deliberately included a broad definition to overrule judicial decisions that had unduly restricted the Clayton Act’s labor exemption from the antitrust laws.”23F24 Indeed, several aspects of the plain text of the labor exemption make clear that the

Faverio, and Risa Gelles-Watnick, Pew Research Center, The State of Gig Work in 2021, at 4–5, 7, 23 (Dec. 8, 2021); Gallup, Gallup’s Perspective on the Gig Economy and Alternative Work Arrangements, at 8 (2018). 23 See Anderson et al., supra n. 22, at 31 (reporting that 58% of current or recent gig workers said that money earned via gig jobs has been “essential or important for meeting their basic needs”). 24 Jacksonville Bulk Terminals, Inc. v. Int’l Longshoremen’s Ass’n, 457 U.S. 702, 712 (1982); see also Bowater SS Co. v. Patterson, 303 F.2d 369, 383 (2nd Cir. 1962) (cautioning against allowing formal legal distinctions imported from other areas of law to undermine the public policy set forth in Norris-LaGuardia, even though those legal distinctions might be accorded deference in other legal settings: “the policy behind the Norris-LaGuardia Act was a strong one; we cannot think Congress would have meant this to be defeated by” technical legal distinctions between corporate entities, “however much these might properly be respected for other purposes”).

Page 160

exemption’s protections are not limited to workers who are formally classified as the direct employee of an employer.

First, the original Clayton Act labor exemption provisions protect not only “employees,” but also “any person or persons.”24F25 And the subsequently enacted Norris-LaGuardia labor exemption provisions extend to the “individual unorganized worker,”25F26 and to “persons engaged in the same industry, trade, craft, or occupation.”26F27 As the Supreme Court has explained in another context, “‘workers’ [is] a term that everyone agrees easily embraces independent contractors.”27F28 In any event, even were the labor exemption limited to “employees,” as used in statutes enacted in the early 20th century, that term often had a broader meaning than that used in the common law to differentiate employees from independent contractors.28F29 For that reason, when interpreting the term “employee” in the original versions of the NLRA and the FLSA, the Supreme Court construed the term to be broader than the workers who would have constituted employees under the common law.29F30 For example, interpreting the term “employee” in the original version of the NLRA, the Court rejected the argument that newsboys classified as independent contractors under common law tests were unprotected.30F31 Rather, it held that where “the economic facts of the relation make it more nearly one of employment than of independent business enterprise . . . those characteristics may outweigh technical legal classification for purposes unrelated to [the NLRA’s] objectives and bring the relation within its protections.”31F32 Congress later overruled the Court’s expansive interpretation of “employee” in the NLRA (but not the FLSA) by expressly exempting “independent contractors” from the definition of “employee” in the NLRA in 1947.32F33 Congress similarly amended the Social Security Act to expressly exclude independent contractors.33F34 However, never in the intervening decades did it adopt such a limitation on the labor exemption to the antitrust laws. Second, the definition of “labor dispute” adopted in the Norris-LaGuardia Act expressly provides that the exemption’s application does not turn on formalistic “employer and employee” relationships between the disputants. Instead, disputes are covered “regardless of whether or not the disputants stand in the proximate relation of employer and employee.”34F35 The definition of

25 29 U.S.C. § 52 (1914).

26 Id. § 102 (declaring public policy); see also id. § 101 (precluding orders “contrary to the public policy declared”). 27 Id. § 113(a).

28 New Prime Inc. v. Oliveira, 586 U.S. 105, 116 (2019).

29 See NLRB v. Hearst Publications, Inc., 322 U.S. 111, 120 (1944). 30 See Rutherford Food Corp. v. McComb, 331 U.S. 722, 729 (1947) (holding that definitions of “employee,” “employer,” and “employ” in the FLSA were “comprehensive enough to require its application to many persons and working relationships, which prior to this Act, were not deemed to fall within an employer-employee category”); Hearst Publications, 322 U.S. at 126 (holding that “[t]he mischief at which the [National Labor Relations] Act is aimed and the remedies it offers are not confined exclusively to ‘employees’ within the traditional legal distinctions separating them from ‘independent contractors’”).

31 Hearst Publications, 322 U.S. at 120-26.

32 Id. at 128.

33 Labor Management Relations Act (Taft-Hartley Act) § 2(3), 29 U.S.C. § 152(3) (1947). 34 Social Security Act of 1948, ch. 468, § 1(a), 62 Stat. 438 (1948). 35 29 U.S.C. § 113(c) (1932).

Page 161

“labor dispute” thus “establishe[s] that the allowable area of union activity was not to be restricted to an immediate employer-employee relation.”35F36 The Supreme Court has accordingly held exempt from antitrust liability the labor organizing activities of persons who were not employees of the firm whose labor practices they sought to change. For example, in New Negro Alliance v. Sanitary Grocery Co., the Court found that alliance members who picketed a grocery store to press the store to hire Black workers were “persons interested” in a “labor dispute” despite the fact that they were not employees of the store.36F37 And in Milk Wagon Drivers’ Union v. Lake Valley Farm Products, Inc., the Court held that the labor exemption protected members of a drivers’ union who picketed dairies that did not use union labor, because the drivers were “engaged in the same industry, trade, craft, or occupation” as the dairies, “namely the milk industry.”37F38 Third, the labor exemption’s use of the phrase “terms or conditions of employment” to define covered labor disputes further indicates that its protections do not categorically exclude independent contractors, because the original meaning of “employment” in the early 20th century did not categorically exclude independent contracting arrangements. In New Prime Inc. v. Oliveira, the Supreme Court considered whether the Federal Arbitration Act (“FAA”) applied and required arbitration of a dispute over alleged failure to pay the minimum wage to a driver labeled by the parties’ contracts as an independent contractor.38F39 The Court analyzed the original meaning of the phrase “contracts of employment” in an exception to the FAA—which Congress enacted in 1925, just seven years before the Norris- LaGuardia Act. The Court explained that although “[t]o many lawyerly ears today, the term ‘contracts of employment’ might call to mind only agreements between employers and employees (or what the common law sometimes called masters and servants)[,] . . . this modern intuition isn’t easily squared with evidence of the term’s meaning at the time of the Act’s adoption in 1925.”39F40 Rather, examining dictionaries spanning from 1891 and 1933, the Court held that the original meaning of “contracts of employment” referred to “agreements to perform work,” and was not limited to “agreements between employers and employees (or what the common law sometimes called masters and servants).”40F41 Accordingly, the Court held that the exception to the FAA for certain “contracts of employment” applied to exempt the wage dispute from arbitration, even though the parties assumed that the relevant contract “establish[ed] only an independent contractor relationship.”41F42 By the same reasoning, the original meaning of “terms or conditions of employment” in the labor exemption encompasses disputes over wages or job conditions, irrespective of whether the worker is classified (or misclassified) as an independent contractor. Nothing in the legislative history of the Clayton and Norris-LaGuardia Acts suggests Congress intended the phrase to have anything other than its ordinary meaning at the time and, as elaborated above, several other

36 Am. Fed’n of Musicians v. Carroll, 391 U.S. 99, 106 (1968). 37 303 U.S. 552, 560-61 (1938).

38 311 U.S. 91, 97 (1940).

39 586 U.S. 105, 108-09 (2019).

40 Id. at 114.

41 Id.

42 Id. at 113-14, 121.

Page 162

aspects of the labor exemption’s plain text also indicate that the exemption is not limited to disputes involving formal, direct employer-employee relationships.

The First Circuit recently reached a similar conclusion and held that the labor exemption does not categorically exclude independent contractors from its protections.42F43 In Confederación Hípica de Puerto Rico, Inc. v. Confederación de Jinetes Puertorriqueños, Inc., the First Circuit considered claims by horse owners alleging that thirty-seven horse jockeys’ refusal to race constituted a group boycott in violation of federal antitrust laws.43F44 Examining the text and history of the labor exemption, the First Circuit held that “[t]he district court erred when it concluded that the jockeys’ alleged independent-contractor status categorically meant they were ineligible for the [labor] exemption,” reasoning that “by the express text of the Norris-LaGuardia Act, a labor dispute may exist ‘regardless of whether or not the disputants stand in the proximate relation of employer and employee.’”44F45 The First Circuit further noted Supreme Court cases rejecting “interpretation of the exemption limited to employees alone.”45F46 The court concluded that, notwithstanding that the jockeys were independent contractors, they “sought higher wages and safer working conditions, making this a core labor dispute [to which] the labor-dispute exemption applies.”46F47 The Commission agrees with the First Circuit. The Commission acknowledges that some cases have held particular independent contractors or other third-parties are unprotected by the labor exemption. However, such cases do not hold that all independent contractors are categorically beyond the scope of the labor exemption due to their formal status as independent contractors. Rather, they examine the specific facts of a given dispute and the trade relationships involved and reject application of the exemption where the core of the dispute does not involve the wages or working conditions of a worker who provides labor services. For example, in Columbia River Packers Assoc. v. Hinton, the Supreme Court rejected application of the exemption to a group of independent contractor fishermen who were “an association of commodity sellers,” holding that the Norris-LaGuardia Act “was not intended to have application to disputes over the sales of commodities.”47F48 Courts have similarly rejected application of the labor exemption to disputes regarding the sale of other commodities,48F49 or regarding the terms of sale of a finished product.49F50

43 Confederación Hípica de Puerto Rico, Inc. v. Confederación de Jinetes Puertorriqueños, Inc., 30 F.4th 306, 314 (1st Cir. 2022), cert. denied, 143 S. Ct. 631 (2023).

44 Id. at 311.

45 Id. at 314.

46 Id. (citing New Negro Alliance v. Sanitary Grocery Co., 303 U.S. 522, 560-61 (1938); Am. Fed’n of Musicians v. Carroll, 391 U.S. 99, 111-14 (1968); H.A. Artists & Assocs. v. Actors’ Equity Ass’n, 451 U.S. 704, 718, 721-22 (1981)).

47 Id.

48 315 U.S. 143, 145 & n.3 (1942).

49 L.A. Meat & Provision Drivers Union, Loc. 626 v. United States, 371 U.S. 94, 101-02 (1962) (“as in Columbia River Assn., the grease peddlers were sellers of commodities”; they were businessmen who attempted to “immunize themselves from [the antitrust laws] by the simple expedient of calling themselves . . . a labor union”). 50 Ring v. Spina, 148 F.2d 647, 652 (2d Cir. 1945) (dispute concerned “the terms at which a finished product or certain rights therein may be sold. And no wages or working conditions of any group of employees are directly dependent on these terms.”).

Page 163

Courts have also rejected application of the exemption where the party seeking the exemption was best characterized as an independent business pursuing its business interests, rather than as a worker who provides labor services seeking to improve his or her compensation or labor conditions. For example, courts have rejected application to disputes involving “an entrepreneur, not a laborer,”50F51 to “a businessman organization” seeking a better “return on capital investment,”51F52 and to “an association of individual practitioners each exercising his calling as an independent unit.”52F53 These cases are all consistent with the First Circuit’s holding that the core question is “whether what is at issue is compensation for [a worker’s] labor” or working conditions.53F54 As such, owners of independent businesses that sell finished products or are primarily concerned with a return on capital investments are often appropriately characterized as independent contractors and will generally be outside the labor exemption’s protections. For example, highly paid professionals who operate their own businesses would often be more appropriately characterized as entrepreneurs pursuing business interests as opposed to workers who provide labor services. However, that does not mean that the labor exemption’s application stands or falls with whether a worker is formally classified (or misclassified) as an independent contractor.

To further dispel confusion, two other cases bear mention. In H.A. Artists & Associates, Inc. v. Actors’ Equity Assoc., the Supreme Court held that the Equity actors’ union was protected by the labor exemption when it sought to regulate the conduct of independent contractor agents in order to protect actors’ compensation.54F55 In a footnote, the Court stated, “[o]f course, a party seeking refuge in the statutory exemption must be a bona fide labor organization, and not an independent contractor or entrepreneur.”55F56 However, this statement was mere dicta because, as the Court explained, there was “no dispute” that the Equity union seeking the labor exemption’s protections was a bona fide labor group.56F57 In any event, the Commission does not read this dicta as opining on whether workers who provide labor services would be unprotected by the labor exemption if classified (or misclassified) as independent contractors. Rather, in referring to “independent contractor or entrepreneur[s],” the Commission believes the Court was referring to the types of business entities and interests discussed above that would indeed be beyond the scope of the labor exemption because they do not reflect a worker who provides labor services seeking better compensation or working conditions (e.g., businesses negotiating over finished

51 United States v. Women’s Sportswear Mfg. Ass’n, 336 U.S. 460, 463-464 (1949) (holding labor exemption inapplicable to stitching contractors who turned fabric supplied by jobbers into completed garments and shipped them directly to the customer, because “although he furnishes chiefly labor, [he] also utilizes the labor through machines and has his rentals, capital costs, overhead, and profits”); see also United States v. Nat’l Ass’n of Real Est. Bds., 339 U.S. 485, 490 (1950) (real estate board members were “entrepreneurs . . . each is in business on his own”). 52 U.S. Steel Corp. v. Fraternal Ass’n of Steelhaulers, 431 F.2d 1046, 1049 (3d Cir. 1970) (holding labor exemption inapplicable to truck owner-operators who were “demand[ing] . . . a more profitable operation of [their] equipment” rather than “a raise [that] goes to the driver”).

53 Am. Med. Ass’n v. United States, 317 U.S. 519, 536 (1943) (holding that independent physician practices who operated on a fee-for-service model not protected by labor exemption where they objected to a nonprofit hospital’s “method of doing business” using a risk-sharing prepayment model; independent physician practices “were interested in the terms and conditions of the employment only in the sense that they desired wholly to prevent Group Health from functioning by having employes”).

54 Confederación Hípica de Puerto Rico v. Confederación de Jinetes Puertorriqueños, Inc., 30 F.4th 306, 314 (1st Cir. 2022), cert. denied, 143 S. Ct. 631 (2023).

55 451 U.S. 704, 720 (1981).

56 Id. at 717 n.20.

57 Id.

Page 164

products or highly paid professionals who operate their own businesses furthering other nonlabor interests).

In another case, Taylor v. Local No. 7, International Union of Journeymen Horseshoers of the United States & Canada (AFL-CIO), the Fourth Circuit held the labor exemption did not protect the conduct of “independent businessmen” horseshoers who charged an agreed-upon fixed price for shoeing a horse (for both the horseshoe and the service) and who boycotted those who did not use union horseshoers.57F58 The Fourth Circuit reversed the district court’s holding that the horseshoers were protected by the labor exemption because they were employees. In rejecting the district court’s reasoning, the Fourth Circuit applied the NLRA’s test for independent contractor status—i.e., the test Congress adopted when it enacted an express exemption to the NLRA for independent contractor status.58F59 The Fourth Circuit found the horseshoers to be independent contractors because, among other things, they controlled when and how much to work, controlled their own horseshoeing process, chose and owned their own tools, controlled their own prices and the risk of profit and loss, did not work regular hours for one employer, chose whether to hire their own employees, and regarded themselves as independent contractors.59F60 The Fourth Circuit did not, however, find the horseshoers’ independent contractor status under the NLRA test dispositive of the labor exemption’s application, acknowledging that the exemption can apply to disputes in which the parties to the dispute do not themselves stand in the relationship of employer and employee.60F61 Instead, the court went on to reject application of the exemption to the horseshoers’ conduct because it found that there was no employer-employee relationship involved in the dispute—whether extant or prospective.61F62 The Fourth Circuit explained, “the horseshoers are not attempting to force the owners and trainers to use any of them as employees, nor are the unions attempting to organize any employees of the trainers or owners.”62F63 Rather, “[t]he only interests [they] sought to . . . advance[]” through their boycott and price-fixing were “of those independent horseshoers who render services to trainers and owners for a certain fee, unilaterally fixed, per horse.”63F64 Accordingly, Taylor did not confront a scenario, like that in Confederación Hípica de Puerto Rico, in which independent contractors who provide labor services engage in a dispute over their compensation and job conditions. Nor did Taylor hold that the conduct of a worker currently classified (or misclassified) as an independent contractor can never be protected by the labor exemption. To the contrary, the Fourth Circuit’s decision implied that it would have found the horseshoers’ conduct protected were they organizing for the purpose of becoming directly hired union employees.64F65 Moreover, although Taylor applies the NLRA test for independent contractor status in the course of rejecting the district court’s reasoning, it never addressed the fact that the Clayton and Norris-LaGuardia Acts lack the express independent contractor

58 353 F.2d 593, 595-606 (4th Cir. 1965).

59 See id. at 595-601 (applying test from NLRB v. A.S. Abell Co., 327 F.2d 1 (4th Cir. 1964)). 60 Id. at 599-600.

61 Id. at 605-06.

62 Id.

63 Id. at 606.

64 Id.

65 Id. (“[T]he horseshoers are not attempting to force the owners and trainers to use any of them as employees . . . .”).

Page 165

exemption present in the NLRA.

For the forgoing reasons, the Commission believes that the First Circuit’s decision in Confederación Hípica de Puerto Rico is correct and that workers who provide labor services and that are engaged in protected labor activities can be shielded by the labor exemption, even if formally classified (or misclassified) as independent contractors. As the First Circuit explained, this understanding is consistent with the plain text and original meaning of the Clayton and Norris-LaGuardia Acts, as well as with judicial decisions applying the labor exemption.65F66 B. Proper Application of the Labor Exemption As explained above, the labor exemption’s application does not turn on how a worker is classified (or misclassified) under other laws. Rather, applying Supreme Court precedents, the Commission assesses whether the exemption applies based on “whether this is a ‘case involving or growing out of any labor dispute,’” which is “broadly defin[ed] . . . to include ‘any controversy concerning terms or conditions of employment.’”66F67 A dispute concerning “the hours, wages, job security, and working conditions” of workers who provide labor services qualifies as “concerning terms or conditions of employment.”67F68 In contrast, disputes concerning the price of commodities or other finished products are not protected.68F69 Accordingly, with respect to organizing or bargaining by workers who provide labor services classified (or misclassified) as independent contractors, “the key question” is generally “whether what is at issue is compensation for their labor” or their working conditions.69F70 Note that for a labor organization such as a union to be protected under the labor exemption, it must be acting in its self-interest and not in combination with non-labor groups.70F71 Formal recognition as a union is not necessary for a labor group to be considered a bona fide labor organization.71F72 Moreover, the protected conduct of a labor organization such as a union does not lose its protected status merely because the labor organization seeks to work with independent contractors. Independent contractors can constitute “labor groups” such that when a union works in concert with them on legitimate labor interests (such as compensation and/or job

66 For this reason, the Commission would exercise its enforcement discretion not to pursue actions inconsistent with this policy statement even if another circuit court (or district court) were in the future to disagree with the First Circuit.

67 Jacksonville Bulk Terminals, Inc. v. Int’l Longshoremen’s Ass’n, 457 U.S. 702, 709 (1982) (quoting 29 U.S.C. § 113(c)).

68 Am. Fed’n of Musicians v. Carroll, 391 U.S. 99, 106 (1968). 69 See, e.g., Columbia River Packers Ass’n v. Hinton, 315 U.S. 143, 145, 147 (1942) (explaining that the Norris- LaGuardia Act “was not intended to have application to disputes over the sale of commodities” and that a dispute “relating solely to the sale of fish,” did not qualify for protection because it “does not place in controversy the wages or hours or other terms and conditions of employment”).

70 Confederación Hípica de Puerto Rico v. Confederación de Jinetes Puertorriqueños, Inc., 30 F.4th 306, 314 (1st Cir. 2022), cert. denied, 143 S. Ct. 631 (2023).

71 United States v. Hutcheson, 312 U.S. 219, 232 (1941).

72 See, e.g., New Negro Alliance v. Sanitary Grocery Co., 303 U.S. 522, 555(1938) (applying labor exemption to actions by a non-union organization founded for the “mutual improvement of its members and the promotion of civic, educational, benevolent, and charitable enterprises”); Brady v. NFL, 644 F.3d 661, 670-73 (8th Cir. 2011) (rejecting argument that the labor exemption applies only to disputes involving recognized labor organizations); see also NLRB v. Wash. Aluminum Co., 370 U.S. 9, 14-15 (1962) (finding a walkout by unorganized workers who lacked a formal bargaining representative to be protected activity related to a “labor dispute” under the National Labor Relations Act).

Page 166

conditions), the union’s activity can still be protected by the labor exemption.72F73 The test for whether the “independent contractors [are] a ‘labor group’ and party to a labor dispute” is “the presence of a job or wage competition or some other economic interrelationship affecting legitimate union interests between the union members and the independent contractors.”73F74 In contrast, “antitrust immunity is forfeited when a union combines with one or more employers in an effort to restraint trade.”74F75 IV.

Conclusion The Commission believes that workers who provide labor services are not subject to antitrust liability when engaging in protected collective action—such as seeking better compensation and job conditions—even if the firm whose labor practices the workers seek to improve classifies (or misclassifies) them as independent contractors. This view is not only the best reading of the labor exemption’s text and history, but it is also sound policy. As the Norris- LaGuardia Act recognizes, workers must be free to organize and to bargain collectively as a counterbalance to the power of “owners of property . . . organize[d] in the corporate and other forms of ownership association.”75F76 That is no less true simply because a firm seeks to classify such workers as independent contractors; for example, many gig workers face significant power imbalances in securing adequate compensation and safe, secure working conditions.76F77 Reading the labor exemption as categorically excluding all independent contractors would give employers both the incentive and the opportunity to exploit such asymmetries. Under such a reading, firms could absolve themselves of responsibilities under employment and labor laws by classifying their workforce as independent contractors. Firms could also simultaneously wield antitrust law to prevent those same workers from organizing to attain the rights afforded to employees under such laws. Additionally, businesses would have an opportunity and incentive to classify (or misclassify) their workers as independent contractors to suppress wages and to gain an unfair advantage against competitors who provide better compensation and job conditions to workers.77F78 Just as Congress did nearly a century ago, the Commission emphasizes that the antitrust laws should not be used to disrupt collective action by workers who provide labor services to improve their terms and conditions of employment. Accordingly, the Commission will not challenge collective action by independent contractors who provide labor services and are seeking better compensation and job conditions because such activities are exempted under the Clayton Act and the Norris-LaGuardia Act.

73 See H. A. Artists & Assocs. v. Actors' Equity Ass’n, 451 U.S. 704, 707 (1981) (holding actors’ union did not forfeit immunity by combining with a non-labor group when independent contractor theatrical agents agreed to become franchised by the union; franchise restrictions protected the wage structure the union negotiated with theatre producers); Am. Fed’n of Musicians, 391 U.S. at 105 (holding that “involvement of the orchestra leaders” who were “employers and independent contractors” did not “create[] a combination or conspiracy with a ‘non-labor’ group which violates the Sherman Act”).

74 Am. Fed'n of Musicians, 391 U.S. at 105-106.

75 H. A. Artists, 451 U.S. at 716.

76 29 U.S.C. § 102 (1914).

77 See FTC Policy Statement on Enforcement Related to Gig Work, at 5-6 (Sept. 15, 2022), https://www.ftc.gov/legal-library/browse/policy-statement-enforcement-related-gig-work. 78 Alvaro Bedoya & Max M. Miller, “Overawed”: Worker Misclassification as a Potential Unfair Method of Competition, 44 YALE L. & POL’Y REV. 333, 345-348 (Fall 2024 forthcoming).

Page 167

Antitrust Guidelines for Business Activities Affecting Workers U.S. Department of Justice and the Federal Trade Commission

Revised: January 2025

Page 168

Overview1 These Guidelines explain how the U.S. Department of Justice’s Antitrust Division (“DOJ”) and the Federal Trade Commission (“FTC”) (collectively, the “Agencies”) assess whether business practices affecting workers violate the antitrust laws. The Agencies enforce the nation’s antitrust laws, which include the Sherman Act, Clayton Act, and Federal Trade Commission Act. These laws provide “a central safeguard for the Nation’s free market structures” by promoting open and fair competition.2 The antitrust laws protect competition for labor, just as they protect competition for goods and services that companies provide.3 They protect the freedom of working people to choose the best job for them and their families. Just as vibrant competition for goods and services benefits consumers, competition among employers benefits workers through better wages, benefits, and other terms and conditions for working people. Business practices may violate the antitrust laws when they harm the competitive process, especially if they deprive labor markets of independent centers of decisionmaking4 or they create or abuse employers’ monopsony power.5 By interfering with free and fair competition for workers, such practices can lead to fewer job opportunities, lower wages, and worse working conditions.6 Similarly, businesses should be free to hire the right person for a job. Vibrant, open markets to recruit and retain workers create market opportunities that are conducive to new business formation, innovation, and productivity. Conversely, when companies act in ways that harm competition for workers, that behavior might lead to fewer job opportunities for workers, lower wages, and worse job quality. That is why the antitrust laws prohibit certain practices that harm competition for workers. How to Use These Guidelines: These Guidelines are intended to promote clarity and transparency for the public about how the Agencies identify and assess business practices affecting workers that may violate the antitrust laws.7 The following sections explain how the Agencies approach

1 This document replaces the Antitrust Guidance for Human Resource Professionals (2016). It should not be construed as legal advice, and it has no force or effect of law. It is not intended to create any substantive or procedural rights enforceable at law by any party. Nothing in this statement should be construed as mandating a particular outcome in any specific case, and nothing in this statement limits the discretion of any U.S. government agency to take any action, or not to take action, with respect to matters under its jurisdiction.

2 N. Carolina State Bd. of Dental Examiners v. FTC, 574 U.S. 494, 502 (2015). 3 See generally Nat’l Collegiate Athletic Ass’n v. Alston, 594 U.S. 69 (2021); Mandeville Island Farms v. Am. Crystal Sugar Co., 334 U.S. 219 (1948); Anderson v. Shipowners’ Ass’n of Pac. Coast, 272 U.S. 359 (1926). 4 Am. Needle, Inc. v. Nat’l Football League, 560 U.S. 183, 190 (2010) (“[C]oncerted activity inherently is fraught with anticompetitive risk insofar as it deprives the marketplace of independent centers of decisionmaking that competition assumes and demands.” (internal quotation marks and citations omitted)). 5 Alston, 594 U.S. at 90 (concluding that the NCAA used its monopsony power to impose restraints that “can (and in fact do) harm competition” for student-athletes’ labor).

6 See Alston, 594 U.S. at 110 (Kavanaugh, J., concurring) (“Price-fixing labor is price-fixing labor. And price-fixing labor is ordinarily a textbook antitrust problem because it extinguishes the free market in which individuals can otherwise obtain fair compensation for their work.”).

7 The 2023 Merger Guidelines provide guidance to the public about how agencies consider the effects of business transactions such as mergers and acquisitions on workers. See U.S. Dep’t of Just. & Fed. Trade Comm’n, Merger Guidelines (2023), https://www.justice.gov/d9/2023-12/2023%20Merger%20Guidelines.pdf.

Page 169

particular antitrust issues affecting labor. Sections 1–5 discuss specific types of agreements or business practices that may violate the antitrust laws. Certain agreements and other activities may give rise to criminal liability. Other types of agreements may be subject to civil liability rather than criminal prosecution. Section 6 explains that the antitrust laws apply to relationships between businesses and independent contractors. For example, an agreement between businesses to fix the compensation that each pays to independent contractors may violate the antitrust laws, just as an agreement between businesses to fix the wages each pays to workers may violate the antitrust laws. Section 7 explains that false claims about workers’ potential earnings may violate federal laws against unfair, deceptive, or abusive practices. Section 8 provides information about reporting potential antitrust violations to the Agencies.

As discussed further in Sections 1–5, the Agencies may investigate certain types of agreements or business practices as potential violations of the antitrust laws. Examples of such agreements include: 1. Agreements between companies not to recruit, solicit, or hire workers, or to fix wages or terms of employment, may violate the antitrust laws and may expose companies and executives to criminal liability. Where appropriate, DOJ exercises its authority to bring felony criminal charges against companies and individuals who participate in these conspiracies. 2. Agreements in the franchise context not to poach, hire, or solicit employees of the franchisor or franchisees may violate the antitrust laws. No-poach and similar agreements are subject to antitrust scrutiny even if they are between a franchisor and a franchisee or, for example, among the franchisees of the same franchisor.

3. Exchanging competitively sensitive information with companies that compete for workers may violate the antitrust laws. This includes exchanges of information about compensation or other terms or conditions of employment, and other exchanges of information that harm competition for workers. Exchanging such information with competitors may be illegal even if companies use a third party or intermediary—including a third party using an algorithm—to share such information.

4. Employment agreements that restrict workers’ freedom to leave their job may violate the antitrust laws. These include non-compete provisions that prevent workers from leaving their job to join a competing or potentially competing employer; that prevent workers from leaving their job to start a new business; or that require workers to pay a penalty upon leaving their job. 5. Other restrictive, exclusionary, or predatory employment conditions that harm competition may violate the antitrust laws. These include overly broad non-disclosure agreements, training repayment agreement provisions, non-solicitation agreements, and exit fee or liquidated damages provisions.

This list is not exhaustive. Listed activities may or may not be an antitrust violation. The Agencies encourage anyone with information about these activities or other potential antitrust violations to report them to the Agencies. See Section 8 below for further information. General Principles for Analyzing Agreements that Impact Workers: In many of these circumstances, the Agencies will focus on whether there is an agreement between businesses that harms competition for workers. An agreement need not be explicit or written down in order to violate the antitrust laws. Agreements—sometimes called conspiracies, gentleman’s agreements, handshake agreements, or shared or mutual understandings—that violate the antitrust laws can be formal or

Page 170

informal; express or implicit; and need not be written down or talked about at all. Such agreements are illegal even if they are never carried out. In assessing whether businesses have entered into an illegal agreement, the Agencies consider direct and circumstantial evidence. For example, they may consider whether a business has discussed with another company wages or other potential terms of employment; engaged in parallel behavior that demonstrates a shared understanding; invited another company to participate in a plan to restrict competition for workers followed by action consistent with that plan; or used a common intermediary to obtain competitively sensitive information. If the Agencies identify an agreement between companies relating to workers, they assess its impact on competition and the competitive process. Some types of agreements are illegal regardless of their effects. In other cases, the Agencies perform a deeper analysis, examining the impact of the agreement on workers by impairing the competitive process, suppressing competition, or the actual or likely effects of the conduct in the affected labor market.8 The Agencies also focus on whether the participants in a potential agreement compete for workers. Businesses can compete to hire or retain workers even if they make different products or offer different services. Accordingly, when assessing agreements that affect workers, the Agencies will focus on whether the businesses compete in the same labor markets even if they do not compete as sellers of products or services.

Companies can be labor market competitors even if they have some other collaborative or cooperative relationship, such as a joint venture that produces a good or provides a service. Companies can also be competitors in a labor market even if they are not competitors in downstream markets to produce a good or service. For example, airplane manufacturers and their part suppliers may both hire from the same market for engineers.

8 United States v. Am. Airlines Grp. Inc., 121 F.4th 209, 220 (1st Cir. 2024).

Page 171

1. Some types of agreements, including wage-fixing and no-poach agreements, may violate the antitrust laws and can lead to criminal charges Businesses that compete with each other for workers may be committing an antitrust crime if they enter into an agreement not to recruit, solicit, or hire workers or to fix wages or terms of employment. Even if criminal charges are not pursued, these agreements may also be subject to civil liability.9 Such agreements can violate the antitrust laws whether they are informal or formal, written or unwritten, or spoken or unspoken.10 Examples include:

• agreements between businesses, or between individuals at different businesses, about workers’ salaries or other terms of compensation, such as bonuses, benefits, or other terms of employment, either at a specific level or within a range (sometimes called “wage-fixing agreements”); and • agreements between businesses, or between individuals at different businesses, not to hire, solicit, and/or otherwise compete for current, former, or potential workers (sometimes called “no-poach” agreements, which may also be referred to as “no-hire” or “no-solicit”11 or “market allocation” agreements).

The Agencies focus on the substance of a wage-fixing or no-poach agreement regardless of its precise form. If companies agree to align, stabilize, or otherwise coordinate the wages they set, including by agreeing to a range, ceiling, or benchmark for calculating wages, it does not matter if they do not agree on a specific wage.12 Similarly, if a company agrees to restrict its ability to hire another

9 See United States v. Lucasfilm Ltd., No. 10-02220 RBW (D.D.C. June 3, 2011); United States v. Adobe Sys., Inc., No. 1:10- CV-01629-RBW (D.D.C. Mar. 17, 2011); United States v. eBay, Inc., No. 12-CV-05869-EJD-PSG (N.D. Cal. 2014); In re: Guardian Service Industries, Inc., No. 241 0082 (F.T.C. Dec. 4, 2024). 10 See United States v. Jindal, No. 4:20-CR-00358, 2021 WL 5578687, at *4–5 (E.D. Tex. Nov. 29, 2021); United States v. DaVita Inc., No. 1:21-CR-00229-RBJ, 2022 WL 266759, at *9 (D. Colo. Jan. 28, 2022); United States v. Manahe, No. 2:22- CR-00013-JAW, 2022 WL 3161781, at *6 (D. Me. Aug. 8, 2022).

11 In this context, the term “no-poach agreement” refers to the types of market-allocation agreements that affect employees’ attempts to get other jobs, such as an agreement between two competitors not to try to hire or solicit each other’s employees, or an agreement to request permission from the other company before trying to hire an employee. These no-poach agreements are different than, for example, agreements between an employer and its workers that prevent the workers from soliciting clients or vendors at a future employer or for a future competing business. Non-solicitation agreements are discussed below. 12 See Arizona v. Maricopa Cnty. Med. Soc., 457 U.S. 332, 348 (1982) (holding, in a civil case, that an agreement among doctors fixing maximum rates that the doctors could receive for their services was a per se violation of the antitrust laws); Plymouth Dealers’ Ass’n of No. Cal. v. United States, 279 F.2d 128, 132 (9th Cir. 1960) (holding, in a civil case, that an agreement to fix the starting point for prices is a per se violation of the antitrust laws); Plea Agreement, United States v. Topkins, No. CR-15-201 (N.D. Cal. Apr. 30, 2015) (defendant pled guilty to price-fixing conspiracy implemented through conspirators’ joint use of specific pricing algorithms), available at https://www.justice.gov/atr/case-document/file/628891/dl; Press Release, U.S. Dep’t of Just., Former E-Commerce Executive Charged with Price Fixing in the Antitrust Division's First Online Marketplace Prosecution (Apr. 6, 2015), https://www.justice.gov/opa/pr/former-e-commerce-executive-chargedprice-fixing-antitrust-divisions-first-online-marketplace.

Page 172

company’s workers, it does not matter if the agreement does not completely prohibit hiring the other company’s workers. For example, an agreement not to “cold call” workers is considered a no-solicit agreement regardless of whether the firms are allowed to hire the workers who applied for a position without first being solicited.13 When formed between competing or potentially competing employers, these types of agreements—whether entered into directly or through an intermediary14—are illegal even if they did not result in actual harm such as lower wages.15 Nor does it matter if the agreement does not include specific pay rates. For example, an agreement to set a starting point for compensation may be a form of wage fixing under the law.16 The DOJ may criminally investigate and, where appropriate, bring felony charges against the participants in these agreements, including both individuals and companies. The Criminal Antitrust Anti-Retaliation Act (CAARA) provides whistleblower protections for employees, contractors, subcontractors, and agents who report antitrust crimes, including no-poach and wage-fixing agreements.17 2. Franchise no-poach agreements may violate the antitrust laws No-poach clauses in franchise agreements are also subject to antitrust scrutiny. Often, franchisors compete with franchisees for workers.18 Franchisors sometimes enter into agreements with franchisees in which the franchisor and franchisee agree not to compete for workers. Such an agreement can be per

13 In re High-Tech Emp. Antitrust Litig., 856 F. Supp. 2d 1103, 1122 (N.D. Cal. 2012) (in private civil damages case following Department of Justice consent decree, holding that plaintiffs plausibly alleged that five no-cold-call agreements were per se violations of the antitrust laws); In re Animation Workers Antitrust Litigation, 123 F. Supp. 3d 1175, 1213 (N.D. Cal. 2015) (in private civil damages case following Department of Justice consent decree, holding that plaintiffs had plausibly alleged that anti-solicitation agreements were per se violations of the antitrust laws); Final Judgment, United States v. Ass’n of Fam. Prac. Residency Dirs., No. 95-0575-CV-W-2 (W.D. Mo. Aug. 15, 1996) (entering consent decree in a civil case to resolve allegations that defendants established policies prohibiting the use of certain practices for recruiting medical residents, which restrained price and other forms of competition), available at https://www.justice.gov/atr/casedocument/file/628591/dl.

14 See Final Judgment, United States v. Ariz. Hosp. and Healthcare Ass’n, No. CV07-1030-PHX (D. Ariz. Sept. 12, 2007), available at https://www.justice.gov/atr/case-document/file/487106/dl (entering consent decree to resolve allegations that association of hospitals violated the antitrust laws by setting a uniform bill rate schedule that member hospitals would pay for temporary and per diem nurses).

15 Such agreements may require a fuller analysis of their effects, however, when the restraint is subordinate and collateral to a broader business collaboration, such as a joint venture, and is reasonably necessary to achieve the procompetitive potential of that collaboration. See Aya Healthcare Servs., Inc. v. AMN Healthcare, Inc., 9 F.4th 1102, 1109 (9th Cir. 2021); see also, e.g., In re Ins. Brokerage Antitrust Litig., 618 F.3d 300, 345–46 (3d Cir. 2010); Rothery Storage & Van Co. v. Atlas Van Lines, Inc., 792 F.2d 210, 224 (D.C. Cir. 1986); United States v. Addyston Pipe & Steel Co., 85 F. 271, 281 (6th Cir. 1898). 16 See Plymouth Dealers’ Ass’n, 279 F.2d at 132–34 (holding that an agreement between car dealers to fix list prices was price fixing, although the dealers often used the list price as a starting point). 17 See 15 U.S.C. § 7a-3.

18 See, e.g., Arrington v. Burger King Worldwide, Inc., 47 F.4th 1247, 1250 (11th Cir. 2022) (noting that Burger King “compete[s] . . . for employees” against “its separate and independent franchise restaurants”).

Page 173

se illegal under the antitrust laws.19 In other words, the agreement itself may be illegal regardless of whether it actually harms workers.

Similarly, a franchisor may violate the antitrust laws by organizing or enforcing a no-poach agreement among franchisees that compete for workers.20 Agreements among franchisees, either written or unwritten, not to poach, hire, or solicit each other’s workers may violate other federal and state laws.21 3. Sharing competitively sensitive information—including wage information—with competitors may violate antitrust laws Sharing competitively sensitive information with competitors about terms and conditions of employment may violate the antitrust laws.22 Exchanging competitively sensitive compensation or other employment information with a competitor may be unlawful when the information exchange has, or is likely to have, an anticompetitive effect, whether or not that effect was intended.23 An information exchange may be explicit or it may be implied from the conduct of parties who share competitively sensitive information (for example, information about compensation, benefits, or the terms of an employment contract). In addition, information exchanges may indicate the existence of a wage-fixing conspiracy.

Providing competitively sensitive information through an algorithm or through a third party’s tool or product may also be unlawful. For example, the DOJ obtained a court-ordered settlement with a group of poultry processing companies and a data consulting company to resolve allegations that they (i) directly exchanged competitively sensitive information about current and future wages and benefits for plant workers; and (ii) did so through a third-party firm that facilitated the exchange of competitively sensitive compensation information.24 Information exchanges facilitated by or through a third party (including through an algorithm or other software) that are used to generate wage or other benefit recommendations can be unlawful even if the exchange does not require businesses to strictly adhere to those recommendations.25 An agreement

19 See, e.g., Deslandes v. McDonald’s USA, LLC, 81 F.4th 699, 705 (7th Cir. 2023). 20 See United States v. Apple Inc., 791 F.3d 290, 325 (2d Cir. 2015). 21 See, e.g., Wash. Rev. Code Ann. § 49.62.060 (“No franchisor may restrict, restrain, or prohibit in any way a franchisee from soliciting or hiring any worker of a franchisee of the same franchisor.”); Minn. Stat. Ann. § 181.99. 22 See Am. Column & Lumber Co. v. United States, 257 U.S. 377, 410–12 (1921). 23 See Final Judgment, United States v. Utah Soc. for Healthcare Hum. Res. Admin., Civ. A. No. 94-C-282G (D. Utah Sep. 12, 1994), available at https://www.justice.gov/atr/case-document/file/628496/dl (entering consent decree to resolve allegations that a society of HR professionals conspired to exchange nonpublic prospective and current wage information about registered nurses, which enabled hospitals to keep nurses’ wages artificially low). 24 Final Judgment, United States v. Cargill Meat Solutions Corp., No. 1:22-CV-01821 (D. Md. June 5, 2023), available at https://www.justice.gov/d9/2023-11/418169.pdf; see also Jien v. Perdue Farms, Inc., No. 1:19-CV-2521-SAG, 2020 WL 5544183 (D. Md. Sept. 16, 2020).

25 See Duffy v. Yardi Sys., Inc., No. 2:23-CV-01391-RSL, 2024 WL 4980771, at *5 (W.D. Wash. Dec. 4, 2024).

Page 174

to use shared wage recommendations, lists, calculations, or algorithms can also still be unlawful even where co-conspirators retain some discretion or cheat on the agreement. Companies can sometimes work together as part of a transaction or collaboration (like a joint venture) in ways that are not illegal. Even if companies are parties to a legitimate transaction or are otherwise involved in a joint venture or other collaborative activity, an agreement between the companies to share information about wages or other terms of employment, including company data regarding worker compensation, may violate the antitrust laws.

4. Non-compete clauses can violate antitrust and other laws Non-compete clauses that restrict workers from switching jobs or starting a competing business can violate the antitrust laws.26 By preventing workers from leaving jobs to pursue better employment opportunities, non-competes decrease competition for workers. Non-competes may also harm competition by preventing other businesses from obtaining enough workers to enter a market or prevent potential competitors from forming, thereby blocking competitors from competing effectively with the original employer.

The Agencies may investigate and take action against non-competes and other restraints on worker mobility that limit competition. For example, in 2020, the DOJ entered into a deferred prosecution agreement in which a medical oncology practice admitted to conspiring to allocate chemotherapy and radiation treatments for cancer patients.27 To remediate the harm and increase competition in the treatment of cancer patients going forward, the criminal resolution required the defendant to waive and not enforce non-compete provisions in contracts with its current or former employees who open or join an oncology practice in the region.

In 2021, the FTC pursed several enforcement actions charging the use of non-competes as unfair methods of competition under Section 5 of the Federal Trade Commission Act. These actions resulted in orders requiring the firms to eliminate non-competes for thousands of workers.28 The FTC has also

26 See, e.g., United States v. Am. Tobacco Co., 221 U.S. 106 (1911) (holding that several tobacco companies violated both Section 1 and Section 2 of the Sherman Act because of the collective effect of six of the companies’ practices, one of which was the “constantly recurring” use of non-compete clauses); Newburger, Loeb & Co., Inc. v. Gross, 563 F.2d 1057, 1082 (2d Cir. 1977) (“[E]mployee agreements not to compete are proper subjects for scrutiny under section 1 of the Sherman Act.”); Decision and Order, In re Ardagh Group S.A., et al., No. C-4785 (F.T.C. Feb. 21, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/2110182-c4785-ardagh-decision-and-order.pdf; Decision, In re: O-I Glass, Inc., No. C-4786 (F.T.C. Feb. 21, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/2110182_c4786-o-i-glass-incdecision-and-order.pdf; Decision, In re: Prudential Security, Inc., No. C-4787 (F.T.C. Feb. 23, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/c47872210026prudentialsecurityfinalconsent.pdf; Decision and Order, In re Anchor Glass Container Corp., No. C-4793 (F.T.C May 18, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/211_0182_c4793_anchor_glass_final_order_with_appendices.pdf. 27 Deferred Prosecution Agreement, United States v. Fla. Cancer Specialists & Rsch. Inst., LLC, No. 2:20-cr-00078-TPB- MRM (M.D. Fla. Apr. 30, 2020), available at https://www.justice.gov/atr/case-document/file/1281681/dl; Press Release, U.S. Dep’t of Just., Leading Cancer Treatment Center Admits to Antitrust Crime and Agrees to Pay $100 Million Criminal Penalty (Apr. 30, 2020), https://www.justice.gov/opa/pr/leading-cancer-treatment-center-admits-antitrust-crime-and-agreespay-100-million-criminal.

28 Decision and Order, In re Ardagh Group S.A., et al., No. C-4785 (F.T.C. Feb. 21, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/2110182-c4785-ardagh-decision-and-order.pdf; Decision, In re: O-I Glass, Inc., No. C-4786 (F.T.C. Feb. 21, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/2110182_c4786-o-i-glass-inc-

Page 175

taken action against non-competes when reviewing mergers. In multiple final orders settling charges that certain mergers violated federal antitrust laws, the FTC has required the parties to cease using, enforcing, and/or entering into non-compete clauses.29 In April 2024, the FTC issued a final rule banning most non-compete agreements, including provisions that function as non-competes.30 That rule was scheduled to take effect on September 4, 2024. However, on August 20, 2024, the District Court for the Northern District of Texas issued an order setting aside the rule.31 The order is currently on appeal.32 The latest information regarding the status of the non-compete final rule is available at ftc.gov/noncompetes. Regardless, the FTC retains the legal authority to address non-competes through case-by-case enforcement actions under the FTC Act, as it has done in the past.

Non-competes may also violate other federal laws, such as the National Labor Relations Act33 and the Packers and Stockyards Act.34 Non-competes can also violate state laws, including laws banning unfair methods of competition and unfair or deceptive practices, as well as statutes banning or restricting some or all non-competes.35

decision-and-order.pdf; Decision, In re: Prudential Security, Inc., No. C-4787 (F.T.C. Feb. 23, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/c47872210026prudentialsecurityfinalconsent.pdf; Decision and Order, In re Anchor Glass Container Corp., No. C-4793 (F.T.C May 18, 2023), available at https://www.ftc.gov/system/files/ftc_gov/pdf/211_0182_c4793_anchor_glass_final_order_with_appendices.pdf. 29 Decision and Order, In the Matter of Zimmer Holdings, Inc., No. C-4534 (F.T.C. Aug. 11, 2015), available at https://www.ftc.gov/system/files/documents/cases/150820zimmerdo.pdf; Press Release, Fed. Trade Comm’n, FTC Approves Final Order Requiring Divestitures of Hundreds of Retail Gas and Diesel Fuel Stations Owned by 7-Eleven, Inc. (Nov. 10, 2021), https://www.ftc.gov/news-events/news/press-releases/2021/11/ftc-approves-final-order-requiring-divestitureshundreds-retail-gas-diesel-fuel-stations-owned-7; Decision and Order at 12–14, In the Matter of Davita Inc. and Total Renal Care, Inc., No. C-4752 (F.T.C. Jan. 10, 2022), available at https://www.ftc.gov/system/files/documents/cases/211_0056_c4752_davita_utah_health_order.pdf; Press Release, Fed. Trade Comm’n, FTC Approves Final Order Restoring Competitive Markets for Gasoline and Diesel in Michigan and Ohio (Aug. 9, 2022), https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-approves-final-order-restoringcompetitive-markets-gasoline-diesel-michigan-ohio.

30 Non-Compete Clause Rule, 89 Fed. Reg. 38342 (May 7, 2024).

31 Ryan LLC v. FTC, No. 3:24-CV-00986-E, 2024 WL 3879954 (N.D. Tex. Aug. 20, 2024). 32 See Notice of Appeal, Ryan LLC et al. v. FTC, No. 3:24-CV-00986-E (N.D. Tex. Oct. 18, 2024), available at https://www.uschamber.com/assets/documents/FTC-Notice-of-Appeal-Ryan-LLC-v.-FTC-Fifth-Circuit.pdf. 33See Nat’l Lab. Rels. Bd., Filing an Unfair Labor Practice Charge with the National Labor Relations Board (2024), https://www.nlrb.gov/sites/default/files/attachments/pages/node-184/info-for-workers-subject-to-noncompetes-or-stay-orpay-provisions.pdf.

34 Final Judgment, United States v. Koch Foods Inc., No. 1:23-CV-15813 (N.D. Ill. Feb. 12, 2024), available at https://www.justice.gov/atr/media/1377131/dl; Press Release, U.S. Dep’t of Just., Justice Department Files Lawsuit and Proposed Consent Decree to Prohibit Koch Foods from Imposing Unfair and Anticompetitive Termination Penalties in Contracts with Chicken Growers (Nov. 9, 2023), https://www.justice.gov/opa/pr/justice-department-files-lawsuit-andproposed-consent-decree-prohibit-koch-foods-imposing.

35 For example, non-competes have been void in California and North Dakota for over a century. See Cal. Bus. & Prof. Code § 16600 et seq.; N.D. Cent. Code § 9-08-06.

Page 176

5. Other restrictive, exclusionary, or predatory employment conditions can also be unlawful The Agencies may also investigate and take action against other restrictive agreements that impede worker mobility or otherwise undermine competition. The following examples illustrate how restrictive conditions could potentially violate the antitrust laws or other federal or state laws.

• Non-disclosure agreements can violate the antitrust laws when they span such a large scope of information that they function to prevent workers from seeking or accepting other work or starting a business after they leave their job. For example, a non-disclosure agreement drafted so broadly as to prohibit disclosure of any information that is “usable in” or “relates to” an industry may be unlawful.36 Non-disclosure agreements can also violate federal law when they are worded so broadly as to suggest that workers who report potential violations of law to state or federal law enforcement or regulators, or who cooperate with a government investigation, could face lawsuits and adverse employment consequences.37 • Training repayment agreement provisions are requirements that a person repay any training costs if they leave their employer. Depending on the facts and circumstances, these provisions can be anticompetitive, such as if they function to prevent a worker from working for another firm or starting a business.38 • Non-solicitation agreements that prohibit a worker from soliciting former clients or customers of the employer similarly can, depending on the facts and circumstances, be anticompetitive, such as if they are so broad that they function to prevent a worker from seeking or accepting another job or starting a business.

• Exit fee and liquidated damages provisions require workers to pay a financial penalty for leaving their employer. Depending on the facts and circumstances, these provisions can be anticompetitive,39 such as if they prevent workers from working for another firm or starting a business.

36 See Brown v. TGS Mgmt., 57 Cal. App. 5th 303, 316–19 (2020). 37 See, e.g., EEOC v. Astra USA, 94 F.3d 738, 744–45 (1st Cir. 1996); FTC v. AMG Services, Inc., No. 2:12-CV-00536- GMN-VCF, 2013 WL 12320929, at *4 (D. Nev. Aug. 20, 2013); Sparks v. Seltzer, No. 05-CV-1061 (NG) (KAM), 2006 WL 2358157, at *4 (E.D.N.Y. Aug. 14, 2006); EEOC v. Int’l Profit Assocs., No. 01 C 4427 (N.D. Ill. Apr. 23, 2003) (unpublished); Hoffman v. Sbarro, Inc., No. 97 CIV. 4484(SS), 1997 WL 736703, at *1 (S.D.N.Y. Nov. 26, 1997). 38 See Statement of Interest of the United States of America at 20, Mizell v. Univ. of Pittsburgh Med. Ctr., No. 1:24-CV- 00016-SPB (W.D. Penn. Sept. 30, 2024), ECF No. 50 [hereinafter Mizell Statement of Interest], available at https://www.justice.gov/atr/media/1371576/dl.

39 See Final Judgment, United States v. Koch Foods Inc., No. 1:23-CV-15813 (N.D. Ill. Feb. 12, 2024), available at https://www.justice.gov/atr/media/1377131/dl (consent decree resolving allegations that termination payment provisions in poultry grower contracts violated Section 1 of the Sherman Act and Section 202(a) of the Packers and Stockyards Act in which the defendant poultry processor agreed to repay all termination payments it had received from farmers and to refrain from including termination payment obligations in future poultry grower contracts).

Page 177

These types of restrictions can harm labor market competition by preventing workers from seeking better, higher-paying jobs. When firms hold monopsony power in a labor market, they may exploit their bargaining power to impose restrictive, exclusionary, or predatory employment terms that deprive workers of fair competitive pay and of the ability to bargain for better working conditions.40 These restrictions can also harm competition for goods and services by raising entry barriers for new businesses, and by depriving existing businesses of the opportunity to hire the talent necessary to compete. Such provisions raise many of the same antitrust concerns as non-competes, and the Agencies may investigate if there are indications that such a restrictive condition on workers is harming competition.

Other federal agencies have their own authorities to address unfair methods of competition, including practices that undermine labor market competition.41 Many of these agencies have enforced against restraints on worker mobility.42 State law also sets limits on training repayment requirements and NDA restrictions.43 6. The antitrust laws apply to agreements that businesses reach with independent contractors The antitrust laws prohibit anticompetitive conduct directed at workers, which includes both employees and independent contractors. Many businesses hire workers as independent contractors rather than as employees. Independent contractors typically are hired to perform discrete jobs, are not under the direct supervision of the firm, and often use their own tools.44 With the growth of technology platforms such as smartphone apps, some firms use independent contractors rather than employees to match workers who provide labor with consumers seeking their services. The antitrust laws also apply to these kinds of platform businesses, with respect to both their employees and independent contractors seeking work through their platform. For example, an agreement between two or more competing platforms to fix the compensation of independent contractors offering their services via the platforms may constitute the type of per se violation of the antitrust laws that the exposes the platforms to criminal liability.

40 See Mizell Statement of Interest at 1.

41 See, e.g., 7 U.S.C. § 192 (U.S. Department of Agriculture’s Section 202 authority under the Packers and Stockyards Act); 29 U.S.C. §§ 157, 158 (National Labor Relation Board’s Section 7 and 8(a)(1) authorities under the National Labor Relations Act); 49 U.S.C. § 41712 (U.S. Department of Transportation’s authority under the Federal Aviation Act). 42 See, e.g., Consumer Fin. Prot. Bureau Office for Consumer Populations, Issue Spotlight: Consumer Risks Posed by Employer-Driven Debt (July 20, 2023), https://www.consumerfinance.gov/data-research/research-reports/issue-spotlightconsumer-risks-posed-by-employer-driven-debt/full-report; Nat’l Lab. Rels. Bd., Region 9-Cincinnati Secures Settlement Requiring Juvly Aesthetics to Rescind Unlawful Non-Compete and Training Repayment Agreement Provisions (TRAPs) and Pay Over $25,000 to Employees (Feb. 6, 2024), https://www.nlrb.gov/news-outreach/region-09-cincinnati/region-9cincinnati-secures-settlement-requiring-juvly; Su v. Advanced Care Staffing, LLC, 23-CV-2119 (E.D.N.Y. March 20, 2023) (suing to enjoin enforcement of a training repayment agreement as a violation of the Fair Labor Standards Act). 43 See, e.g., Colo. Rev. Stat. § 8-2-113(3)(a)-(b).

44 Employee or Independent Contractor Classification Under the Fair Labor Standards Act, 89 Fed. Reg. 1638, 1639 (Jan. 10, 2024) (codified at 29 C.F.R. 780).

Page 178

7. False earnings claims can violate the law The Agencies may investigate and take action against businesses that make false or misleading claims about potential earnings that workers (including both employees and independent contractors) may realize. For example, the FTC has taken action against an online retailer,45 a ride-sharing company,46 a customer service gig work platform,47 and a food delivery company48 for allegedly falsely advertising that workers would earn substantially more in compensation and/or tips than they did in reality. When workers are lured to these businesses by false earnings promises, honest businesses are less able to fairly compete for those workers.

45 Complaint, Fed. Trade Comm’n, In the Matter of Amazon.com, Inc. and Amazon Logistics, Inc., No. 1923123 (Feb. 2021), available at https://www.ftc.gov/system/files/documents/cases/amazon_flex_complaint.pdf. 46 Complaint, FTC v. Uber Technologies, Inc., No. 3:17-CV-00261 (N.D. Cal. Jan. 19, 2017), available at https://www.ftc.gov/system/files/documents/cases/1523082ubercmplt.pdf. 47 Complaint, FTC v. Arise Virtual Solutions, Inc., No. 0:24-CV-61152 (S.D. Fla. July 2, 2024), available at https://www.ftc.gov/system/files/ftc_gov/pdf/arise_complaint.pdf. 48 Complaint, FTC v. Grubhub Inc., No. 1:24-CV-12923 (N.D. Ill. Dec. 17, 2024), available at https://www.ftc.gov/system/files/ftc_gov/pdf/2024-12-17-GrubhubComplaint.pdf.

Page 179

8. Report violations The Department of Justice’s Antitrust Division and the Federal Trade Commission encourage anyone who notices any of the above activities or other suspicious behavior and believes that there has been an antitrust violation to report it to either or both offices. Contact the Antitrust Division’s Complaint Center Contact the FTC’s Bureau of Competition Complaint Intake E-mail: [email protected] Online complaint portal:

https://www.ftc.gov/enforcement/reportantitrust-violation Phone: 202-307-2040; 888-647-3258

Mail: Complaint Center, U.S. Department of Justice, Antitrust Division 950 Pennsylvania Avenue NW Room 3322 Washington, DC 20530 Mail: Office of Policy and Coordination, Bureau of Competition, Federal Trade Commission 600 Pennsylvania Avenue NW Washington, DC 20580 The Antitrust Division and the FTC encourage anyone seeking to submit a complaint to provide the following types of information with your complaint: • What are the names of companies, individuals, or organizations that are involved? • How have these companies, individuals, or organizations potentially violated federal antitrust laws? • What examples can you give of the conduct that you believe may violate the antitrust laws? • Who is affected by this conduct? • How do you believe competition may have been harmed? • How did you learn about the situation?

Page 180

UNITED STATES OF AMERICA FEDERAL TRADE COMMISSION WASHINGTON, D.C. 20580 Office of the Secretary January 18, 2022 Commission Statement on the Holder Rule and Attorneys’ Fees and Costs This advisory opinion addresses the Federal Trade Commission’s Trade Regulation Rule Concerning Preservation of Consumers’ Claims and Defenses, 16 C.F.R. § 433.2, commonly known as the Holder Rule, and its impact on consumers’ ability to recover costs and attorneys’ fees. This issue has arisen repeatedly in court cases, with some courts correctly concluding that the Holder Rule does not limit recovery of attorneys’ fees and costs when state law authorizes awards against a holder,1 and others misinterpreting the Holder Rule as a limitation on the application of state cost-shifting laws to holders.2 Background on the Rule. The Commission adopted the Holder Rule to protect consumers when they purchase goods or services on credit. The Commission identified multiple practices that sellers use to “cut off” consumers’ rights so that the holder of the loan may demand full payment from the consumer despite misconduct by the seller.3 The Commission determined that 1 See, e.g., In re Stewart, 93 B.R. 878 (Bankr. E.D. Pa. 1988); Home Sav. Ass’n v. Guerra, 733 S.W.2d 134 (Tex. 1987); Kish v. Van Note, 692 S.W.2d 463 (Tex. 1985); Reliance Mortg. Co. v. Hill-Shields, No. 05-99-01615-CV, 2001 Tex. App. LEXIS 140 (Tex. App. Jan. 10, 2001); Oxford Fin. Cos. v. Velez, 807 S.W.2d 460 (Tex. App. 1991); Green Tree Acceptance, Inc. v. Pierce, 768 S.W.2d 416 (Tex. App. 1989); see also Pulliam v. HNL Auto. Inc., 60 Cal. App. 5th 396, 274 Cal. Rptr. 3d 547, 559-67 (Cal. Ct. App. 2021), review granted, 484 P.3d 564, 277 Cal. Rptr. 3d 323 (Cal. Apr. 28, 2021) (No. S267576) (concluding that Holder Rule does not limit attorney fee recovery from holder; rejecting contrary position attributed to FTC and ruling that such an agency interpretation would not be entitled to deference). 2 See, e.g., Spikener v. Ally Fin., Inc., 50 Cal. App. 5th 151, 162, 263 Cal. Rptr. 3d 726, 735 (Cal. Ct. App. 2020) (concluding statements by the Commission in 2019 (84 Fed. Reg. 18,711, 18,713 (May 2, 2019)) demonstrate “clear intent” to preempt attorney fee recovery “regardless of whether state claim being asserted pursuant to the Holder Rule contains fee-shifting provisions”, but declining to express opinion on whether costs are preempted for the same reason); Order on Motion, Reyes v. Beneficial State Bank, No. BCV-17-100082 (Cal. Sup. Ct., Kern Co., Dec. 5, 2019), appeal docketed, No. F080827 (Cal. Ct. App. Feb. 13, 2020) (ruling state statute is preempted by Commission statements on application of Holder Rule to attorney’s fees); see also Lafferty v. Wells Fargo Bank, NA, 25 Cal. App. 5th 398, 414-16, 275 Cal. Rptr. 3d 842, 855-57 (Cal. Ct. App. 2018) (concluding that second sentence of the Holder Rule Notice caps attorneys’ fees claim against defendant-holder unless “another state or local cause of action can be found to support such a claim,” but that costs are not subject to the same cap). 3 See 40 Fed. Reg. 53,506, 53,507-08 (1975) (use of promissory notes and waiver of defense clauses in seller-financed sales); Id. at 53,514-15 (use of “vendor-related” or “direct” loans by

Page 181

sellers’ use of these practices to foreclose consumer claims and defenses constitutes an unfair practice under Section 5 of the FTC Act.4 To preserve consumers’ claims and defenses, the Holder Rule requires a seller that finances sales to include in credit contracts the following provision, also known as the “Holder Rule Notice”:

ANY HOLDER OF THIS CONSUMER CREDIT CONTRACT IS SUBJECT TO ALL CLAIMS AND DEFENSES WHICH THE DEBTOR COULD ASSERT AGAINST THE SELLER OF GOODS OR SERVICES OBTAINED PURSUANT HERETO OR WITH THE PROCEEDS HEREOF. RECOVERY HEREUNDER BY THE DEBTOR SHALL NOT EXCEED AMOUNTS PAID BY THE DEBTOR HEREUNDER.

16 C.F.R. § 433.2(a). Where the seller is not the creditor, but receives payment from the proceeds of a loan by a creditor that has a referral or business relationship with the seller (defined in the Rule as a “Purchase Money Loan”), the consumer credit contract must have the same provision, except the words “PURSUANT HERETO OR” are omitted. Id. § 433.2(b). A creditor or assignee of credit contracts with the Holder Rule Notice is thus subject to any claims or defenses that the consumer could assert against the seller. Analysis. The Holder Rule does not eliminate any rights the consumer may have as a matter of separate state, local, or federal law. Consequently, whether costs and attorneys’ fees may be awarded against the holder of the credit contract is determined by the relevant law governing costs and fees.5 Nothing in the Holder Rule states that application of such laws to holders is inconsistent with Section 5 of the FTC Act or that holders should be wholly or partially exempt from these laws.

third party) (1975); see also FTC, Statement of Enforcement Policy, 41 Fed. Reg. 34,594, 34,596 (1976). (explaining affiliation and referral standards applicable to “transactions in which a seller accepts the proceeds of a loan extended directly from a lender to a purchaser.”). 4 40 Fed. Reg. at 53,523.

5 States have passed varying laws regarding recovery of attorneys’ fees and costs under which responsibility to pay fees may depend a variety of factors. Compare ALASKA R. CIV. P. 82(a) (2021) (“Except as otherwise agreed to by the parties, the prevailing party in a civil case shall be awarded attorney’s fees calculated under this rule”); WASH. REV. CODE § 4.84.330 (2021) (if a contract provides for fees to one party, the prevailing party is entitled to fees); KY. REV. STAT. Ann. § 367.220(1) (West 2015) (court may award attorneys’ fees and costs to prevailing party in any action under Kentucky Consumer Protection Act), with WASH. REV. CODE § 4.84.185 (court may award fees incurred in opposing claims or defenses that court finds were “frivolous and advanced without reasonable cause”); COLO. REV. STAT. § 6-1-113(2)(b) (2021) (in successful action to enforce liability, “person who is found to have engaged or caused another to engage in” deceptive trade practice is liable for costs and attorney fees). Statement on the Holder Rule and Attorneys’ Fees Page 2

Page 182

Further, if the applicable law requires or allows costs or attorneys’ fee awards against a holder, the Holder Rule does not impose a cap on such an award. The sentence in the Holder Rule Notice that limits recovery to “amounts paid by the debtor” applies only to monetary recovery against holders based on the Holder Rule Notice (i.e., recovery on the claims or defenses the debtor could assert against the seller); the Rule places no cap on a consumer’s right to recover from the holder for other reasons. Thus, for example, in an action between a consumer and a holder, if the applicable law authorizes the consumer to recover costs or fees from parties that unsuccessfully oppose the consumer’s claims or defenses, a prevailing consumer’s right to recovery against the holder is not restricted by the Holder Rule Notice. In this scenario, the cost or fee award is separate and supported by a law that is independent of the Holder Rule. Thus, the Holder Rule Notice does not limit costs or attorneys’ fees that the applicable law directs or permits a court to award against a holder because of its role in litigation. In a situation where the applicable law permits assessing costs or attorneys’ fees exclusively against the seller, the seller’s liability for such costs and fees may be raised against the holder because of the Holder Rule Notice. The holder’s obligation to pay costs or fee awards available exclusively against the seller, however, would be limited to the amount paid by the consumer. Thus, for example, if a consumer is awarded fees in a suit solely against the seller, or the law allows awards only against a seller that has engaged in specified conduct, the Holder Rule Notice authorizes the consumer to recover such an award from the holder up to the amount paid. The consumer also may rely on a claim against the seller for costs or attorneys’ fees to offset an obligation to the holder.

Some courts have read the Commission’s statements in a 2019 Rule Confirmation notice regarding the Holder Rule as mandating a different result.6 Insofar as these decisions conclude that the Holder Rule precludes state law from providing for costs or attorneys’ fees against the holder, they misconstrue the Commission’s statements. Neither the Rule itself nor the 2019 Rule Confirmation notice say that the Holder Rule invalidates state law or that there is a federal interest in limiting state remedies. To the contrary, the 2019 Rule Confirmation says that nothing in the Holder Rule limits recovery of attorneys’ fees if a federal or state law separately 6 Supra note 2.

Statement on the Holder Rule and Attorneys’ Fees Page 3

Page 183

provides for recovery of attorneys’ fees independent of claims or defenses arising from the seller’s misconduct.7 By direction of the Commission.

April J. Tabor Secretary 7 We have previously observed that the Holder Rule Notice does not limit the availability of injunctive relief against a holder: “The final sentence of the Holder Rule Notice does not restrict the types of remedies available when a claim or defense is preserved; it simply states that the money that a consumer may obtain from a holder based on the Notice may not exceed amounts paid. The Commission affirms that the plain language of the Rule does not limit the types of relief a court may award against a holder.” 84 Fed. Reg. at 18,713 n.32. Statement on the Holder Rule and Attorneys’ Fees Page 4

Page 184

37022 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 1 This program consisted of compliance monitoring, counseling, and targeted enforcement pursuant to the FTC’s general authority under 15 U.S.C. 45 (‘‘Section 5’’ of the FTC Act). Section 5 prohibits unfair or deceptive acts or practices in or affecting commerce. An act or practice is deceptive if it is likely to mislead consumers acting reasonably under the circumstances and is material—that is, likely to affect a consumer’s decision to purchase or use the advertised product or service. A claim need not mislead all—or even most—consumers to be deceptive under the FTC Act. Rather, it need only be likely to deceive some consumers acting reasonably. See FTC Policy Statement on Deception, 103 F.T.C. 174 (1984) (appended to Cliffdale Assocs., Inc., 103 F.T.C. 110, 177 n.20 (1984) (‘‘A material practice that misleads a significant minority of reasonable consumers is deceptive.’’); see also FTC v. Stefanchik, 559 F.3d 924, 929 (9th Cir. 2009) (‘‘The FTC was not required to show that all consumers were deceived . . . .’’). 2 Commenters argued such a rule could have a strong deterrent effect against unlawful MUSA claims without imposing new burdens on lawabiding companies. See generally Transcript of Made in USA: An FTC Workshop (Sept. 26, 2019) at 63–72, available at https://www.ftc.gov/newsevents/events-calendar/made-usa-ftc-workshop; FTC Staff Report, Made in USA Workshop (June 2020) (‘‘MUSA Report’’), available at https:// www.ftc.gov/system/files/documents/reports/madeusa-ftc-workshop/p074204_-_musa_workshop_ report_-_final.pdf.

3 See Section 320933 of the Violent Crime and Law Enforcement Act of 1994, Public Law 103–322, 108 Stat. 1796, 2135, codified in relevant part at 15 U.S.C. 45a. Section 45a also states: ‘‘This section shall be effective upon publication in the Federal Register of a Notice of the provisions of this section.’’ The Commission published such a notice in 1995 (60 FR 13158 (Mar. 10, 1995). 4 Under the statute, violations of any rule promulgated pursuant to Section 45a ‘‘shall be treated by the Commission as a violation of a rule under section 57a of this title regarding unfair or deceptive acts or practices.’’ For violations of rules issued pursuant to 15 U.S.C. 57a, the Commission may commence civil actions to recover civil penalties. See 15 U.S.C. 45(m)(1)(A). 5 See, e.g., Vulcan Lamp Works, Inc., 32 F.T.C. 7 (1940); Windsor Pen Corp., 64 F.T.C. 454 (1964) (articulating this standard as a ‘‘wholly of domestic origin’’ standard).

6 This principle was incorporated into the Commission’s 1997 Enforcement Policy Statement on U.S. Origin Claims (the ‘‘Policy Statement’’) following consumer research and public comment, as the ‘‘all or virtually all’’ principle. Specifically, the Policy Statement provides a marketer making an unqualified claim for its product should, at the time of the representation, have a reasonable basis for asserting ‘‘all or virtually all’’ of the product is made in the United States. FTC, Issuance of Enforcement Policy Statement on ‘‘Made in USA’’ and Other U.S. Origin Claims, 62 FR 63756, 63766 information directly to the manager of the certification office, send it to the attention of the person identified in Related Information. Information may be emailed to: 9-ANM- [email protected]. (2) Before using any approved AMOC, notify your appropriate principal inspector, or lacking a principal inspector, the manager of the responsible Flight Standards Office. (j) Related Information (1) Refer to Mandatory Continuing Airworthiness Information (MCAI) Civil Aviation Authority of Israel (CAAI) Israeli AD ISR–I–24–2021–6–6R1, dated June 27, 2021, for related information. This MCAI may be found in the AD docket on the internet at https://www.regulations.gov by searching for and locating Docket No. FAA– 2021–0566.

(2) For more information about this AD, contact Brian Hernandez, Aerospace Engineer, Systems and Equipment Section, FAA, Seattle ACO Branch, 2200 South 216th St., Des Moines, WA 98198; phone and fax: 206–231–3535; email: Brian.Hernandez@ faa.gov.

(k) Material Incorporated by Reference (1) The Director of the Federal Register approved the incorporation by reference (IBR) of the service information listed in this paragraph under 5 U.S.C. 552(a) and 1 CFR part 51.

(2) You must use this service information as applicable to do the actions required by this AD, unless this AD specifies otherwise. (i) IAI-Aviation Group Alert Service Bulletin 368–24–098, Revision 1, dated June 2021.

(ii) [Reserved] (3) For service information identified in this AD, contact Israel Aerospace Industries, Ltd., Ben Gurion Airport, Israel 70100; telephone 972–39359826; email tmazor@ iai.co.il.

(4) You may view this service information at the FAA, Airworthiness Products Section, Operational Safety Branch, 2200 South 216th St., Des Moines, WA. For information on the availability of this material at the FAA, call 206–231–3195.

(5) You may view this service information that is incorporated by reference at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, email [email protected], or go to: https:// www.archives.gov/federal-register/cfr/ibrlocations.html.

Issued on July 8, 2021.

Gaetano A. Sciortino, Deputy Director for Strategic Initiatives, Compliance & Airworthiness Division, Aircraft Certification Service. [FR Doc. 2021–15026 Filed 7–12–21; 11:15 am] BILLING CODE 4910–13–P FEDERAL TRADE COMMISSION 16 CFR Part 323 [3084–AB64] Made in USA Labeling Rule AGENCY: Federal Trade Commission. ACTION: Final rule.

SUMMARY: The Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) issues a final rule related to ‘‘Made in USA’’ and other unqualified U.S.-origin claims on product labels.

DATES: This final rule is effective August 13, 2021.

FOR FURTHER INFORMATION CONTACT: Julia Solomon Ensor (202–326–2377) or Hampton Newsome (202–326–2889), Attorneys, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Room CC–9528, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: I. Background On July 16, 2020, the Commission published a Notice of Proposed Rulemaking (‘‘NPRM’’) (85 FR 43162) seeking comments on a new rule regarding unqualified U.S.-origin claims (‘‘MUSA claims’’) on product labels. The NPRM was preceded by a review of the Commission’s longstanding program to prevent deceptive MUSA claims.1 The review included a 2019 public workshop and public comment period, where stakeholders expressed nearly universal support for a rule addressing MUSA labels.2 The Commission published a new rule in the NPRM pursuant to its authority under 15 U.S.C. 45a (‘‘Section 45a’’). Section 45a declares: ‘‘[t]o the extent any person introduces, delivers for introduction, sells, advertises, or offers for sale in commerce a product with a ’Made in the U.S.A.’ or ‘Made in America’ label, or the equivalent thereof, in order to represent that such product was in whole or substantial part of domestic origin, such label shall be consistent with decisions and orders of the Federal Trade Commission.’’ The statute authorizes the agency to issue rules to effectuate this mandate and prevent unfair or deceptive acts or practices relating to MUSA labeling.3 Specifically, under the statute, the Commission ‘‘may from time to time issue rules pursuant to section 553 of title 5, United States Code’’ requiring MUSA labeling to ‘‘be consistent with decisions and orders of the Federal Trade Commission issued pursuant to [Section 5 of the FTC Act].’’ The statute authorizes the FTC to seek civil penalties for violations of such rules.4 Consistent with these statutory provisions, the NPRM proposed a rule covering labels on products that make unqualified U.S.-origin claims. Consistent with the Commission’s MUSA Decisions and Orders since the 1940s,5 the NPRM proposed to codify the established principle that unqualified U.S.-origin claims imply to consumers no more than a de minimis amount of the product is of foreign origin.6 VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00022 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 185

37023 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations (Dec. 2, 1997). The Commission first used the ‘‘all or virtually all’’ language in Hyde Athletic Industries, File No. 922–3236 (consent agreement accepted subject to public comment Sept. 20, 1994) and New Balance Athletic Shoes, Inc., Docket 9268 (complaint issued Sept. 20, 1994). In the 1997 Federal Register Notice requesting public comment on Proposed Guides for the Use of U.S. Origin Claims, the Commission explained the ‘‘all or virtually all’’ standard merely rearticulated longstanding principles governing MUSA claims. FTC, Request for Public Comment on Proposed Guides for the use of U.S. Origin Claims, 62 FR 25020 (May 7, 1997). The Commission has routinely applied this standard in its MUSA Decisions and Orders since 1997. See Compilation of cases at https://www.ftc.gov/tips-advice/business-center/ legal-resources?type=case&field_consumer_ protection_topics_tid=234. 7 See, e.g., Textile Fiber Products Identification Act (15 U.S.C. 70b); Wool Products Labeling Act (15 U.S.C. 68); American Automobile Labeling Act (49 U.S.C. 32304); Agricultural Marketing Act (7 U.S.C. 1638a); Buy American Act (41 U.S.C. 10a–10c); and implementing rules.

8 As discussed in Section III of this Notice, the Commission has added a provision (section 323.6) in the final Rule related to petitions for exemption. 9 Comments appear on FTC Docket FTC–2020– 0056 and are available at www.regulations.gov. For purposes of this Notice, all comments are referred to by their short docket number (e.g., ‘‘1’’), rather than long docket number (e.g., ‘‘FTC–2020–0056– 0001’’).

10 See, e.g., Senators Sherrod Brown, Tammy Baldwin, Christopher Murphy, and Richard Blumenthal (‘‘Senators’’) (373); North American Insulation Manufacturers (631); see also Letter from Representative Frank Pallone, Jr., Chairman, and Representative Jan Schakowsky, Chair, Subcommittee on Consumer Protection and Commerce, U.S. House of Representatives (Oct. 15, 2020). But see Retail Industry Leaders Association (‘‘RILA’’) (570) (arguing low levels of enforcement activity suggest codifying the guidance into a rule is unnecessary).

11 UIUC Accounting Group A13 (5); Delphine MUREKATETE, iMSA Program, University of Illinois at Urbana Champaign (21); Anonymous Anonymous (24); UIUC–BADM 403–A02 (25); Nirma Ramirez (26); Jaymee Westover (358); Joy Winzerling (419); United Steelworkers (526); Anonymous Anonymous (533); R–CALF USA (588). 12 Chris Jay Hoofnagle (613) (advocating use of civil penalties to deter MUSA fraud). 13 UIUC Accounting Group A13 (5); Chris Posey (7); Family Farm Action Alliance (543). 14 See, e.g., United Steelworkers (526); Alliance for American Manufacturing (‘‘AAM’’) (611). 15 Honey Boynton (32); Holly Mastromatto (33); Doug Thompson (123); Lucilla Rinehimer (702). 16 UIUC Accounting Group A13 (5); UIUC Group A06 Anonymous (22); Truth in Advertising, Inc. (‘‘TINA.org’’) (369); Senators (373); Southern Shrimp Alliance (380); Council for Responsible Nutrition (‘‘CRN’’) (569); Personal Care Products Council (‘‘PCPC’’) (587); Anonymous Anonymous (592); Alliance for AAM (611); National Association of Manufacturers (‘‘NAM’’) (623); Coalition for a Prosperous America (625). 17 15 U.S.C. 45a.

18 UIUC Accounting Group A13 (50); UIUC Group A06 (22); TINA.org (369); Senators (373); Southern Shrimp Alliance (380); AAM (611); Coalition for a Prosperous America (625). 19 TINA.org (369) (emphasis in original) (also arguing the Commission may draw support from the dictionary definition of ‘‘labels,’’ which includes digital labels).

20 Id. at 2. TINA.org also suggested ‘‘courts regularly interpret laws expansively in the face of technological innovation,’’ and the ‘‘possibility that Congress may not have anticipated the application of the term label to apply online does not change [the] outcome.’’ The NPRM, consistent with the Commission’s prior rulings and consumer perception surveys, proposed a rule prohibiting marketers from including unqualified U.S.-origin claims on labels unless: (1) Final assembly or processing of the product occurs in the United States; (2) all significant processing for the product occurs in the United States; and (3) all or virtually all of the product’s ingredients or components are made and sourced in the United States. By codifying existing guidance, the proposed rule sought to impose no new obligations on market participants.

To avoid confusion or perceived conflict with other country-of-origin labeling laws and regulations, the NPRM contained a provision specifying the rule does not supersede, alter, or affect any other federal or state statute or regulation relating to country-oforigin labels, except to the extent a state country-of-origin statute, regulation, order, or interpretation is inconsistent with the proposed rule.7 In response to the NPRM, the Commission received hundreds of comments, discussed infra Section II. Although some raised concerns or recommended changes to the Commission’s proposal, the majority supported finalizing the rule as drafted. Accordingly, the Commission adopts the proposed rule with limited modifications as discussed below.8 The rule will take effect August 13, 2021. II. Response to Comments The Commission received more than 700 comments 9 in response to the NPRM from individuals, industry groups, consumer organizations, and members of Congress. Commenters generally supported the rule,10 stating it provided much-needed clarity 11 and would deter bad actors 12 without imposing new burdens on marketers.13 Most commenters agreed the rule should incorporate the longstanding ‘‘all or virtually all’’ standard.14 Additionally, the majority of commenters addressing the issue agreed the proposed rule represented a proper exercise of the Commission’s rulemaking authority under Section 45a. Although the Commission received mostly supportive comments, some commenters raised concerns with the Commission’s proposal to codify the ‘‘all or virtually all’’ guidance through rulemaking, suggesting the standard may not reflect current consumer perception. Others proposed specific additions to the rule, including additional definitions, guidance on implied claims, and an effective date. Members of the beef and shrimp industries requested specific guidance for their industries. A few stakeholders proposed changes outside the scope of the FTC’s Section 45a rulemaking authority. For example, some commenters proposed making countryof-origin labeling mandatory in all instances. Finally, some raised miscellaneous concerns about particular businesses’ practices or claims.15 As discussed below, these comments do not provide a compelling basis to change the substantive requirements of the rule proposed in the NPRM. A. Rulemaking Authority Regarding Mail Order Advertising Eleven stakeholders filed comments addressing the FTC’s rulemaking authority under Section 45a, with the majority agreeing the proposed rule is consistent with that grant of authority.16 As described in Section I, Section 45a authorizes the Commission ‘‘[to] issue rules pursuant to section 553 of title 5 [of the U.S.C.]’’ to govern the use of ‘‘ ‘Made in the U.S.A.’ or ‘Made in America’ label[s], or the equivalent thereof’’ when a person ‘‘introduces, delivers for introduction, sells, advertises, or offers for sale [a product] in commerce.’’ The statute provides such labels must be ‘‘consistent with decisions and orders of the Federal Trade Commission issued pursuant to [Section 5 of the FTC Act].’’ 17 1. Comments Eleven commenters addressed the Commission’s authority under Section 45a. The majority asserted the proposed rule was within the scope of Section 45a’s grant of rulemaking authority, and the proposed rule appropriately covered labels in mail order (electronic) advertising.18 For example, TINA.org argued the Commission properly interpreted Section 45a as authorizing coverage of electronic labels because Section 45a does not limit the term ‘‘labels’’ to physical labels, and physical and digital labels are ‘‘functionally equivalent’’ in terms of providing product information to consumers.19 TINA.org further noted ‘‘[w]hen Congress seeks to limit ‘labels’ to the physical, it knows how . . . [and here] the statute makes no attempt to restrict the definition or distinguish physical labels from digital labels.’’ 20 Moreover, TINA.org explained, limiting the proposed rule to physical labels without addressing electronic labels VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00023 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 186

37024 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 21 Id. at 5.

22 Id. at 3 (emphasis in original). 23 Southern Shrimp Alliance (380); AAM (611). 24 AAM (611). Coalition for a Prosperous America (625) agreed Section 45a’s plain language permits coverage of electronic claims (arguing coverage is authorized where a ‘‘substantial part’’ of the product is of domestic origin) (citing Section 45a (‘‘To the extent any person introduces, delivers for introduction, sells, advertises, or offers for sale in commerce a product with a ‘Made in the U.S.A.’ or ‘Made in America’ label, or the equivalent thereof, in order to represent that such product was in whole or substantial part of domestic origin, such label shall be consistent with decisions and orders of the Federal Trade Commission issued pursuant to section 45 of this title (emphasis added).’’)). 25 AAM (611).

26 CRN (569); PCPC (587); Anonymous Anonymous (592); NAM (623). 27 PCPC (587); CRN (569). 28 Anonymous Anonymous (56). 29 NAM (623) at 5.

30 Shirley Boyd (6).

31 Southern Shrimp Alliance (380); AAM (611). 32 See TINA.org (369).

33 See, e.g., In re Vulcan Lamp Works, Inc., 32 F.T.C. 7 (1940).

34 CRN (569); Consumer Technology Association (‘‘CTA’’) (579); Global Organization for EPA and DHA Omega-3s (604); American Association of Exporters and Importers (‘‘AAEI’’) (605); NAM (623); Pharmavite LLC (695). 35 CRN (569).

would ‘‘leave American consumers unprotected.’’ 21 Accordingly, TINA.org concluded, ‘‘[a]s a matter of statutory interpretation, the Commission can regulate digital MUSA labels. As a matter of consumer protection, the Commission ought to regulate digital MUSA labels.’’ 22 The Southern Shrimp Alliance (‘‘SSA’’) and AAM agreed, arguing Congress made an affirmative decision to defer to the FTC when it removed a definition of ‘‘labels’’ that appeared in initial drafts of the legislation.23 Moreover, AAM argued the text of Section 45a specifically authorizes coverage of electronic labels because of the words ‘‘the equivalent thereof’’ in the phrase authorizing coverage of products introduced into commerce ‘‘with a ‘Made in the U.S.A.’ or ‘Made in America’ label, or the equivalent thereof.’’ 24 AAM argued the phrase refers to the ‘‘equivalent’’ of introducing a product into commerce with a label, i.e., making a claim on a website.25 In contrast, four commenters asserted the proposed rule exceeds the scope of the Commission’s rulemaking authority under Section 45a.26 CRN and PCPC argued Section 45a’s consistent use of the term ‘‘label’’ demonstrates Congress’s intent to authorize a rule limited to labels on products, not one that would cover advertising generally.27 An anonymous commenter argued Section 45a does not provide authority to regulate claims in mail order advertising materials as proposed in Section 323.3, so the proposed rule ‘‘should be revised to only cover labels on products.’’ 28 Should the FTC finalize a rule that purports to cover more than labels on products, NAM warned, the result could be ‘‘lengthy litigation [, which would leave] manufacturers and consumers alike . . . without clear guidance at a time when manufacturers need as much regulatory certainty as possible.’’ 29 Given these concerns over the scope of the Commission’s rulemaking authority, Shirley Boyd stated the Commission should proceed pursuant to the Magnuson Moss Warranty-Federal Trade Commission Improvements Act to issue a broader rule covering MUSA advertising generally.30 2. Analysis After reviewing the comments, the Commission has concluded proposed Section 323.3 falls within the scope of its authority under Section 45a. As described above, Section 45a authorizes the Commission to issue rules to govern labeling of products as ‘‘Made in the U.S.A.’’ or ‘‘Made in America,’’ or the equivalent thereof. Section 45a specifies: ‘‘[t]o the extent any person introduces, delivers for introduction, sells, advertises, or offers for sale in commerce a product with a ‘Made in the U.S.A.’ or ’Made in America’ label, or the equivalent thereof, in order to represent that such product was in whole or substantial part of domestic origin, such label shall be consistent with decisions and orders of the Federal Trade Commission.’’ The Commission is empowered to ensure such labels are consistent with decisions and orders of the Federal Trade Commission defining unfair or deceptive acts or practices under Section 5. The Commission agrees with SSA and AAM that Congress’s removal of a definition of ‘‘label’’ from Section 45a before its passage strongly suggests Congress deliberately chose to defer to the FTC’s interpretation of the term in the context of MUSA claims.31 Moreover, the Commission agrees with TINA.org that digital and physical labels are functionally equivalent, especially with the growth of e-commerce, and a failure to cover labels in print or electronic mail order catalogs or promotional materials would leave consumers without much-needed protection.32 The final rule does not cover MUSA claims in all advertising. Instead, as Section 323.3 explains, the rule covers labels appearing in all contexts, whether, for example, they appear on product packaging or online. With this clarification, the Commission adopts Section 323.3 as proposed. B. ‘‘All or Virtually All’’ Standard As described in Section I above, the NPRM proposed to codify the Commission’s longstanding interpretation of Section 5’s requirements governing substantiation of unqualified MUSA claims. This interpretation was first articulated in Commission cases dating back to the 1940s 33 and was formalized in the 1997 Policy Statement. Specifically, the NPRM proposed to prohibit unqualified MUSA claims on labels unless: (1) Final assembly or processing of the product occurs in the United States, (2) all significant processing that goes into the product occurs in the United States, and (3) all or virtually all ingredients or components of the product are made and sourced in the United States. Although many commenters, particularly those with interest in food products, supported the decision to incorporate the ‘‘all or virtually all’’ guidance, others raised concerns. In particular, commenters questioned whether the ‘‘all or virtually all’’ standard represents current consumer understanding of MUSA claims. Some proposed alternative standards for consideration.

After analyzing these comments, as discussed below in Section II.B.3., the Commission has determined it has a reasonable basis to adopt the longstanding ‘‘all or virtually all’’ standard, and the rule provides appropriate and clear guidance to marketers.

1. Consumer Perception Testing Six commenters argued the FTC should conduct new consumer perception testing before codifying the ‘‘all or virtually all’’ guidance into a rule.34 They noted the Commission has not conducted comprehensive testing since the 1990s. CRN explained ‘‘codifying a standard for unqualified U.S.-origin claims that is based on consumer perception data that has not been reanalyzed by the Commission in over 20 years’’ is potentially problematic because ‘‘[g]iven significant changes to the global economy, consumer perceptions of U.S.-origin claims are very likely to have changed over time and consumer perception in 1997, and even 2013, could be very different from how consumers perceive U.S.-origin claims today.’’ 35 CTA agreed and asserted that proposing to codify the ‘‘all or virtually standard’’ without conducting new consumer perception VerDate Sep<11>2014 17:31 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00024 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 187

37025 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 36 CTA (579).

37 NAM (623).

38 See, e.g., CTA (579) (arguing the ‘‘all or virtually all’’ guidance deters innovation because many electronic product components are only made internationally); Personal Care Products Council (587) (guidance deters manufacturers from using maximum levels of U.S. parts and materials); AAEI (605) (guidance negatively impacts U.S. companies that will not risk making the claim). 39 National Fisheries Institute (‘‘NFI’’) (628); RILA (570); TRAVIS HEDSTROM (600); Acuity Brands (609); NAM (623); American Coatings Association (‘‘ACA’’) (666) (stating marketers need guidance on percentage values or other guidance on how to deal with trace components of foreign/unknown origin). 40 NFI (628).

41 See Cal. Bus. & Prof. Code § 17533.7 (as revised in 2015).

42 RILA (570).

43 TRAVIS HEDSTROM (660). 44 GOED (604); Pharmavite LLC (695). 45 The California law makes such an allowance, although it is not unlimited. Specifically, California permits up to 10% (instead of 5%) of costs to be attributable to imported content if that content cannot be made or obtained in the USA for reasons other than cost. Cal. Bus. & Prof. Code § 17533.7. 46 BWC (622). Indeed, BWC argued, given consumer expectations and current supply chains, rather than analyzing the percentage of costs attributable to U.S. versus foreign costs, it might be more appropriate to analyze the proportion of an entity’s overall manufacturing workforce in the U.S. Id.

47 NAM (623). See also Glenda Smith (612) (requesting more detail on how to handle raw materials not capable of being sourced in the USA). 48 CBP defines ‘‘substantial transformation’’ as a manufacturing process that results in a new and different product with a new name, character, and use different from that which existed before. This standard does not take into account the origin of materials or parts. See 19 CFR part 134; Energizer Battery, Inc. v. United States, 190 F. Supp. 3d 1308 (Ct. Int’l Tr. 2016) (holding a substantial transformation occurs when a product emerges from a manufacturing process with a new name, character, and use, and the ‘‘simple assembly’’ of a limited number of components does not constitute a substantial transformation). 49 International Precious Metals Institute, Inc. (‘‘IPMI’’) (520); AAEI (605); American Apparel and Footwear Association (‘‘AAFA’’) (675). 50 AAEI (605). See also BWC (622) (raising concerns about increased regulatory burden). 51 AAFA (675) (also suggesting the FTC ‘‘eliminate’’ qualified claims for any products that do not meet the ‘‘substantial transformation’’ threshold).

52 China (699).

testing ‘‘put the cart before the horse.’’ 36 NAM also encouraged the FTC to undertake a comprehensive review similar to the Commission’s process in the 1990s before promulgating any rule.37 2. Alternative Standards In addition to requesting the FTC conduct new perception testing, numerous commenters proposed alternatives to the ‘‘all or virtually all’’ standard. These proposals, which were based on policy arguments and were not accompanied by supporting consumer perception evidence, fell into two groups. On one hand, more than twenty commenters, mostly individual consumers, suggested unqualified MUSA claims should be limited to products 100% made in the United States. On the other hand, other commenters, mostly manufacturers, argued ‘‘all or virtually all’’ is too strict, and by incorporating it into a rule, the FTC could chill unqualified claims, discourage innovation, and harm industries where parts or ingredients are not available in the United States.38 To address these concerns, this second group of commenters suggested alternatives: (1) Introducing a percentage-of-costs standard; (2) adopting a standard that makes allowances for imported parts or materials not available in the United States; (3) aligning with U.S. Customs and Border Protection’s (‘‘CBP’’) substantial transformation standard; or (4) adding a safe harbor for ‘‘good faith’’ efforts to comply.

i. Percentage-Based Standards Several commenters argued the Commission should provide marketers greater certainty by promulgating a ‘‘bright line’’ rule outlining a specific percentage of manufacturing costs that must be attributable to U.S. costs to substantiate an unqualified claim.39 For example, NFI suggested the FTC could align the rule with California state law,40 which permits manufacturers to make unqualified MUSA claims for products with up to 5% of the final wholesale value of the product attributable to articles, units, or parts of the merchandise obtained from outside the USA.41 RILA agreed a rule providing a brightline percentage would help marketers comply, and suggested the FTC consider ‘‘analogous federal regulations that incentivize U.S. manufacturing,’’ and incorporate a 70% threshold for unqualified claims.42 Alternatively, one commenter suggested a rule that would permit an unqualified claim for a product assembled in the United States where more than 50% of its value is based on components of U.S.-origin.43 Two representatives of the dietary supplement industry, the Global Organization for EPA and DHA Omega- 3s (‘‘GOED’’) and Pharmavite LLC, made an alternative percentage-based proposal with different standards for active and inactive ingredients. Specifically, they argued consumers likely interpret an unqualified MUSA claim to mean 100% of a dietary supplement’s active ingredients are made and sourced in the United States. They claimed, however, consumers care less about the origin of inactive ingredients. Accordingly, they contended the rule should incorporate a 10% tolerance for foreign-made or sourced inactive ingredients.44 ii. Unavailability Exemption Other commenters argued the rule should allow marketers to make unqualified MUSA claims for products that include imported content only if the imported components are not available in the United States.45 Some argued there should be a blanket exemption for such content. For example, Bradford White Corporation (‘‘BWC’’) suggested the rule broadly allow marketers to exclude foreign parts from the analysis if those parts cannot be ‘‘reasonably sourced’’ from a domestic manufacturer.46 Others agreed the rule should permit unqualified claims for products that contain foreign content that cannot be sourced in the United States, but argued this exemption should be capped at a certain percentage of manufacturing costs. In NAM’s view, a rule permitting marketers to incorporate an appropriate percentage of imported components or labor, not otherwise unavailable domestically, ‘‘would give manufacturers clear and predictable rules and play a significant role in helping to encourage manufacturers to increase domestic investments in order to meet an attainable standard.’’ 47 iii. Substantial Transformation Analysis Several commenters suggested the FTC adopt a ‘‘substantial transformation’’ standard for unqualified claims.48 Three commenters from U.S. trade associations 49 explained harmonizing the FTC’s rule with the CBP standard for determining foreign country of origin pursuant to the Tariff Act, 19 U.S.C. 1304, would provide clarity and alleviate the burden on U.S. companies that ‘‘must navigate a number of different country of origin requirements.’’ 50 AAFA explained adopting the ‘‘substantial transformation’’ standard would result in a ‘‘clear, simple, and easy-tounderstand rule.’’ 51 The People’s Republic of China (‘‘China’’) also argued, to avoid uncertainties and bias, the FTC should incorporate CBP’s ‘‘change in Tariff Classification’’ analysis, as suggested in Article 9 of the World Trade Organization’s (‘‘WTO’’) Agreement on Rules of Origin.52 iv. Good Faith Efforts To Comply PCPC and RILA recommended the Commission provide safe harbors for two types of good-faith efforts to comply. PCPC, a trade association VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00025 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 188

37026 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 53 PCPC (587). Although not specifically advocating for a good-faith claim safe harbor, the Family Farm Action Alliance similarly argued the FTC should continue its practice of counseling inadvertent offenders into compliance (543). 54 PCPC (587) at 3.

55 RILA (570).

56 Commission staff considered this study previously as part of a request for a staff advisory opinion on unqualified MUSA claims for recycled gold jewelry products. See Response to Request for FTC Staff Advisory Opinion (Sept. 9, 2014), https:// www.ftc.gov/system/files/documents/closing_ letters/made-usa/140909madeisusajvc.pdf (declining to provide an opinion stating MUSA claims for recycled jewelry do not deceive consumers based on perception evidence provided by Richline Group).

57 See also Hanna, Transcript of Made in USA: An FTC Workshop (Sept. 26, 2019) (hereinafter, ‘‘MUSA Tr.’’) at 14 (study showed ‘‘25% or 30% of [American consumers] really did feel that everything, including the natural resource, including the gold, had to be part of the final product in order to say it was made in the USA’’). 58 62 FR 25020, 25036.

59 Hanna, MUSA Tr. at 15. 60 See, e.g., FTC Staff Closing Letter to Niall Luxury Goods, LLC (Nov. 20, 2015), available at https://www.ftc.gov/system/files/documents/ closing_letters/nid/151120niall_letter.pdf. 61 See Policy Statement, 62 FR 63756, 63768. representing manufacturers, distributors, and suppliers of personal care products, suggested incorporating a safe harbor for ‘‘good actors who are trying to overcome the difficulties in sourcing domestic components and materials.’’ 53 PCPC explained, ‘‘[a] safe harbor provision for unqualified claims would not dilute the purpose of the FTC’s goal with this proposed rule—to deter bad actors from making false claims. Rather, such a provision would provide businesses who in good faith make every reasonable effort to make as much of their product as possible in the U.S. the flexibility to comply with any new regulations.’’ 54 Alternatively, RILA suggested that to avoid deterring retailers and marketplaces from offering products with MUSA labels the final rule should ‘‘include an express statement . . . that allows retailers and marketplaces that have exercised reasonable due diligence to rely on documented supplier and vendor certifications to substantiate MUSA labeling claims.’’ 55 3. Analysis The Commission has concluded it is not necessary to undertake additional consumer perception testing before adopting the proposed Rule. Accordingly, the Commission adopts the ‘‘all or virtually all standard’’ to govern unqualified claims as proposed in the NPRM. Although some commenters speculated consumer perception may have shifted over time, or argued the Commission should adopt a new standard for unqualified claims, there is no evidence on the record disputing the Commission’s past findings that at least a significant minority of consumers expect a MUSAadvertised product to be ‘‘all or virtually all’’ made in the United States. Nor is there evidence suggesting new perception testing would find otherwise.

Indeed, the limited survey evidence submitted in conjunction with the 2019 workshop on MUSA claims suggested consumer perception has remained stable since the 1990s. Specifically, one panelist, Mark Hanna of Richline Group, Inc. submitted a survey, conducted in 2013, which found almost 3 in 5 Americans (57%) agree ‘‘Made in America’’ means all parts of a product, including any natural resources it contains, originated in the United States.56 Additionally, the survey found 33 percent of consumers thought 100 percent of a product must originate in a country for that product to be labeled as ‘‘Made’’ in that country.57 These findings are consistent with the FTC’s 1995 survey, which found roughly 30 percent of consumers would be deceived by an unqualified MUSA claim for a product where 70 percent of the cost was incurred in the United States.58 As Hanna explained during the workshop, ‘‘at least 25% of the consumers were skeptical that if there’s something introduced to that finished product other than something that originated in the US now, they didn’t think it should be made in the USA.’’ 59 Accordingly, the Commission has a reasonable basis to conclude the ‘‘all or virtually all’’ standard accurately represents current consumer perception regarding unqualified MUSA claims. Should future consumer research clearly establish the ‘‘all or virtually all’’ standard is inapplicable to a specific class of products, entities may petition the Commission for an exemption from the Rule’s requirements, as discussed in Section III of this document. While commenters proposed alternative standards that might promote certain policy goals, the Commission declines to adopt these alternative proposals for the reasons discussed below. Section 45a authorizes the Commission to issue rules to ensure products labeled as ‘‘Made in the U.S.A.,’’ or the equivalent thereof, comport with the requirements of Section 5 of the FTC Act that prohibit unfairness or deception. The ‘‘all or virtually all’’ standard is designed to prevent consumer deception and, therefore, the Commission declines to: (1) Adopt a bright-line, percentagebased standard; (2) include a broad carve-out for inputs not available in the United States; (3) incorporate CBP’s ‘‘substantial transformation’’ standard; or (4) provide a safe harbor for goodfaith efforts to comply. First, percentage-based, bright-line rules could allow deceptive unqualified claims in circumstances where the low cost of the foreign input does not correlate to the importance of that input to consumers. For example, the Commission’s enforcement experience has established unqualified U.S.-origin claims for watches that incorporate imported movements may mislead consumers because, although the cost of an imported movement is often low relative to the overall cost to manufacture a watch, consumers may place a premium on the origin and quality of a watch movement and consider the failure to disclose the foreign origin of this component to be material to their purchasing decision. Under those circumstances, the foreign movement likely is not a de minimis consideration for consumers, and an unqualified U.S.-origin claim for a watch containing an imported movement would likely deceive consumers.60 The Policy Statement has instructed marketers since the 1990s that the cost of foreign versus U.S. parts and labor is only one factor to consider in determining how material a part may be to consumers.61 Accordingly, the Commission declines to adopt a percentage-based standard because the ‘‘all or virtually all’’ standard is better tailored to prevent unqualified U.S.origin claims that will mislead consumers in making purchasing decisions. By maintaining this precedent, the rule accounts for the likelihood consumers interpret MUSA claims somewhat differently for different product categories. Second, the record similarly does not support excluding foreign content unavailable in the United States from the ‘‘all or virtually all’’ analysis. Specifically, as described above, consumer perception testing has consistently shown consumers expect products labeled as MUSA to contain no more than a de minimis amount of foreign content. There is no evidence this takeaway varies in scenarios where some parts or inputs are not available in the United States. Indeed, the Policy Statement explains unqualified claims for such products could be deceptive, for example, ‘‘if the [nonindigenous] imported material constitutes the whole or essence of the finished product (e.g., the rubber in a rubber ball or the coffee VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00026 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 189

37027 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 62 Id. at 63769 n.117.

63 The Policy Statement explains in some cases ‘‘where [a raw] material is not found or grown in the United States [and that raw material does not constitute the whole or essence of the finished product], consumers are likely to understand that a ‘Made in USA’ claim on a product that incorporates such materials (e.g., vanilla ice cream that uses vanilla beans, which, the Commission understands, are not grown in the United States) means that all or virtually all of the product, except for those materials not available here, originated in the United States.’’ Id. The Policy Statement provides that this guidance applies only to raw materials, not manufactured inputs. 64 See, e.g., FTC v. World Travel Vacation Brokers, Inc., 861 F.2d 1020, 1029 (7th Cir. 1988). 65 See FTC, ‘‘Complying with the Made in USA Standard,’’ at 7–8 (Dec. 1998), available at https:// www.ftc.gov/system/files/documents/plainlanguage/bus03-complying-made-usa-standard.pdf (also providing an example of a certification a marketer could request from a supplier that generally would constitute an acceptable basis for determining the appropriate country-of-origin designation for a product). 66 RILA (570).

67 E.g., AAEI (605) (advocating adoption of the ‘‘substantial transformation’’ standard). 68 See, e.g., Shirley Boyd (6); Pacific Coast Producers (27); RILA (570); Vietnam (577); AAEI (605); NFI (628); ACA (666); AAFA (675). 69 AAEI (605).

70 Deontae Lafayette (20); Jaymee Westover (358). 71 Shirley Boyd (6); Pacific Coast Producers (27); RILA (570).

72 Pacific Coast Producers (27). 73 LSA (404).

74 SSA (380) (further explaining menus should fall under this definition because they are used in the direct sale or offer for sale of a product, are disseminated in print or can be delivered by electronic means, and are solely disseminated to solicit the purchase of a product). 75 Frost Brown Todd LLC (522). beans in ground coffee).’’ 62 However, the flexibility inherent in the ‘‘all or virtually all’’ analysis accounts for the possibility a marketer could substantiate an unqualified claim for a product containing nonindigenous raw materials if the manufacturer has evidence demonstrating the specific claim in context does not deceive consumers.63 Third, the record also does not support adopting government standards developed for other purposes (e.g., the CBP substantial transformation standard developed for the imposition of tariffs) as part of the rule. Based on its enforcement experience, the Commission is concerned the standards adopted by CBP for purposes of calculating tariffs are not an appropriate fit for the Commission’s regulation of MUSA claims on product labels for purposes of consumer disclosure. For example, there is ample evidence consumers care deeply about the source of the components used to manufacture drywall for construction projects. Under a substantial transformation analysis, drywall made wholly of materials from one nation, but substantially transformed in a different country, would be labeled as originating from the country where those materials were ultimately transformed into a final product. Marketers would not need to disclose the origin of the inputs other than labor (information highly material to many consumers). Thus, employing such a standard would in some cases conflict with the Rule’s purpose of ensuring consumers have the material information necessary to make informed purchasing decisions.

Finally, the rule does not include an explicit carve-out for businesses that act in good faith. Courts have long held good faith is not a defense for a violation of Section 5 of the FTC Act,64 and the Commission intends to enforce the rule consistent with this precedent. Violative claims made in good faith can still deceive and cause significant harm to consumers. However, the FTC clarifies it will continue to: (1) Advise marketers that, if provided in good faith, marketers can rely on information from suppliers about the domestic content in the parts, components, and other elements they produce; 65 (2) generally conserve enforcement resources for intentional, repeated, or egregious offenders; and (3) provide informal staff counseling where appropriate. C. Requests for Additional Definitions and Other Clarifications The Commission received several comments arguing the proposed Rule was unclear or provided insufficient guidance for marketers. To remedy these asserted problems, several commenters urged the FTC to add definitions for particular terms, including ‘‘all or virtually all’’ and ‘‘significant processing.’’ Other commenters expressed concern the Rule was not sufficiently clear about the range of claims it would cover, suggesting the FTC list additional synonyms for ‘‘Made in USA’’ to which the rule would apply. Finally, others requested a delayed effective date to allow marketers to update materials and come into compliance.

1. Definitions More than twenty commenters recommended adding definitions or providing more information to clarify the rule. Without definitions, the commenters feared marketers would ‘‘lack clear guidance for verifying MUSA claims’’ and thus ‘‘may be deterred from’’ making them altogether.66 Some of these commenters offered clarifying edits or proposed definitions, often as fallback positions to their main arguments advocating alternative standards entirely.67 In particular, in addition to commenters who recommended specifying percentage thresholds for ‘‘all or virtually all,’’ several commenters requested the Commission generally define the phrase, without providing specific information on what that definition should include (e.g., factors considered, etc.).68 As AAEI elaborated: ‘‘One of the FTC’s stated reasons for this proposed rulemaking is to ‘provide more certainty to marketers about the standard for making unqualified claims on product labels.’ Yet, the proposed ‘all or virtually all’ standard does not provide that certainty . . . It simply codifies the FTC’s already existing ambiguous standards.’’ 69 Two commenters specifically asked the Commission to incorporate information on whether marketers should consider the origin of product packaging into such a definition.70 Similarly, three commenters requested the Commission define ‘‘significant processing.’’ 71 As Pacific Coast Producers explained, the ‘‘significant processing’’ and ‘‘all or virtually all’’ ‘‘terms have always been ambiguous, and the proposed rule does not help to remove the ambiguity or provide any meaningful guidance to industry.’’ 72 Finally, more than thirty commenters, primarily representing the domestic shrimp industry, argued the Commission should clarify that the definitions of ‘‘mail order catalog’’ and ‘‘mail order promotional material’’ include restaurant menus. As the Louisiana Shrimp Association (‘‘LSA’’) explained, ‘‘inappropriate practices by some restaurants in offering menu items that falsely indicate to customers that imported shrimp is domestic, such as ‘Gulf Shrimp’. . . not only confuse consumers, but fatally undermine the marketing efforts of restaurants that do carry domestic shrimp.’’ 73 To solve this problem, SSA urged the Commission to ‘‘exercise jurisdiction over ‘Made in U.S.A.’ statements on restaurant menus, as a form of ‘Mail order promotional material’ or ‘mail order catalog.’ ’’ 74 2. Covered Claims Several commenters suggested the Rule was not sufficiently clear about which U.S.-origin claims it covers. In particular, commenters requested a longer list of claims the Commission considers equivalent to ‘‘Made in USA,’’ as well as a specific statement that the Rule covers implied claims. One commenter suggested adding ‘‘constructed,’’ ‘‘fabricated,’’ and ‘‘assembled’’ to the list.75 Another VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00027 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 190

37028 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 76 R–CALF USA (588).

77 Salvatore J. Versaggi (496). 78 See, e.g., Shirley Boyd (6); Power Planter Inc. (325); AAM (611); American Shrimp Processors Association (‘‘ASPA’’) (633). 79 AAM (611).

80 ACA (666); McKenna Walsh (581). 81 As discussed in Section III, the Final Rule contains a provision clarifying that, in appropriate circumstances, covered entities may petition the Commission for an exemption from the Rule’s requirements.

82 See Policy Statement, 62 FR 63756, 63768 (Dec. 2, 1997).

83 16 CFR 323.1.

84 See generally https://www.ftc.gov/tips-advice/ business-center/advertising-and-marketing/madein-usa. The Commission has explained that prior to the 1990s, this standard was described as the ‘‘wholly domestic’’ standard, and both ‘‘wholly domestic’’ and ‘‘all or virtually all’’ refer to the concept that ‘‘unqualified claims of domestic origin have been treated as claims that the product was in all but de minimis amounts made in the United States.’’ 62 FR 63756 (Dec. 2, 1997). proposed ‘‘processed,’’ ‘‘fabricated,’’ and ‘‘packaged.’’ 76 Finally, one commenter suggested, to deter unscrupulous marketers effectively, the list should include claims that products are ‘‘Distributed by:’’ a company name followed by a U.S. address.77 Several commenters also asked the Commission to clarify that the Rule covers implied claims.78 As AAM explained, ‘‘the use of iconography, such as the American flag, used in the promotion of products should also be considered for its potential to evoke the positive qualities consumers associate with ’Made in USA,’ as well as the prospect of such iconography being used in a deceptive manner.’’ 79 3. Effective Date Finally, two commenters requested the FTC provide an extended compliance period before the rule’s effective date. Specifically, ACA and McKenna Walsh argued companies would need time to come into compliance with the Rule. In their view, the FTC should delay implementation to give companies the opportunity to generate new marketing materials and run out old stock.80 4. Analysis After analyzing the comments, the Commission finds the rule and its coverage clear on its face, with sufficient flexibility to address a changing marketplace. Therefore, as discussed further below, the Commission issues the rule without additional definitions or clarifications, or a delayed effective date.81 i. Definitions The Commission declines to adopt definitions of ‘‘all or virtually all’’ and ‘‘significant processing,’’ or to expand the existing definition of ‘‘mail order catalog’’ or ‘‘mail order promotional material.’’ The Commission has issued extensive guidance to help marketers understand the ‘‘all or virtually all’’ standard. As the Policy Statement explains, ‘‘A product that is all or virtually all made in the United States will ordinarily be one in which all significant parts and processing that go into the product are of U.S. origin.’’ In other words, where a product is labeled or otherwise advertised with an unqualified claim, it should contain only a de minimis, or negligible, amount of foreign content. Although there is no single ‘‘bright line’’ to establish when a product is or is not ‘‘all or virtually all’’ made in the United States, there are a number of factors to consider in making this determination. First, in order for a product to be considered ‘‘all or virtually all’’ made in the United States, the final assembly or processing of the product must take place in the United States. Beyond this minimum threshold, the Commission will consider other factors, including but not limited to the portion of the product’s total manufacturing costs attributable to U.S. parts and processing; how far removed from the finished product any foreign content is; and the importance of the foreign content to the form or function of the product. Accordingly, the Commission’s existing guidance and enforcement documents, including the Policy Statement, decisions and orders enforcing the ‘‘all or virtually all’’ standard, and staff closing letters, together provide ample guidance to marketers.

As discussed above in Section II.B.3., ‘‘all or virtually all’’ and ‘‘significant processing’’ intentionally incorporate flexibility to allow marketers to substantiate their claims consistent with consumer perception of their particular products. The Commission’s enforcement program has long recognized the need for such flexibility as described in the Policy Statement, which was based on the Commission’s decisions and orders. The Commission has continued to follow this flexible approach, and incorporated it into its post-Policy Statement decisions and orders. Adding specific definitions for these terms may increase clarity for marketers in the short term because the rule covers so many product categories across a range of circumstances, but the Commission has determined adding further specificity also increases the risk the rule would chill certain nondeceptive claims. Marketers seeking additional guidance may look to the Policy Statement, decisions and orders, and other Commission guidance to understand how the FTC has analyzed ‘‘all or virtually all’’ and ‘‘significant processing.’’ 82 The Commission also declines to adopt a definition of ‘‘mail order catalog’’ or ‘‘mail order promotional material’’ that specifically incorporates restaurant menus. The Commission has not reviewed perception evidence regarding consumer understanding of MUSA claims on restaurant menus, and therefore declines to define such claims as covered ‘‘labels’’ for purposes of Section 45a.

ii. Covered Claims The Commission also concludes it is unnecessary to revise the definitions to provide an expanded list of synonyms for the term ‘‘Made in U.S.A.,’’ or provide further clarification the rule covers implied claims. Section 323.1 as proposed already defines ‘‘Made in U.S.A.’’ as ‘‘any unqualified representation, express or implied, that a product or service, or a specified component thereof, is of U.S. origin, including, but not limited to, a representation that such product or service is ‘made,’ ’manufactured,’ ’built,’ ’produced,’ ’created,’ or ’crafted’ in the United States or in America, or any other unqualified U.S.-origin claim’’ (emphasis added).83 The list of equivalents to ‘‘Made in USA’’ set forth in Section 323.1 is not exhaustive because the means of communicating U.S. origin are too numerous to list. The Commission believes the non-exhaustive list of examples given provide sufficient guidance on the scope of covered express and implied claims. These examples are based on the Commission’s decades of enforcement experience addressing MUSA claims. For other claims, the Commission will analyze them in context, including the terms used, their prominence, and their proximity to images and other text. iii. Effective Date Lastly, the Commission declines to delay the rule’s effective date. As discussed above in Section I, the rule codifies the FTC’s longstanding guidance on MUSA claims. The FTC has incorporated the ‘‘all or virtually all’’ standard into decisions and orders and guidance for industry and the public since the 1990s.84 Because the rule merely codifies these longstanding enforcement principles and imposes no new requirements on marketers, the Commission concludes a delayed effective date is unnecessary. VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00028 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 191

37029 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 85 North Dakota Farmers Union (412). 86 The Commission also received more than 150 comments stating country-of-origin labeling should be mandatory for beef products. 87 See, e.g., Mexico’s National Confederation of Livestock Organizations (431); North American Meat Institute and Meat Importers’ Council of America (508); National Cattlemen’s Beef Association (589); Montana Stockgrowers Association (635); Embassy of Canada (637). Some of these stakeholders argued the FTC should specifically exempt meat labeling from the Rule’s coverage.

88 North American Meat Institute and the Meat Importers’ Council of America (508). See also National Cattlemen’s Beef Association (589) (‘‘remind[ing] FTC that the Federal Meat Inspection Act of 1906 (21 U.S.C. 601 et seq.) grants the U.S. Department of Agriculture (USDA) primary jurisdiction over all meat food product oversight activities, including the approval and verification of geographic and origin labeling claims.’’). 89 Montana Stockgrowers Association (635). 90 Mexico’s National Confederation of Livestock Organizations (431); National Cattlemen’s Beef Association (589); see also Embassy of Canada (637) (stating, in light of 2015 WTO proceedings, the Government of Canada ‘‘will continue to closely monitor the development of the proposed’’ Rule). 91 7 CFR part 60.

92 7 U.S.C. 1638(1).

93 7 CFR 60.128.

94 ASPA (633) (citing 7 CFR 60.119). 95 See, e.g., Southern Shrimp Alliance (380). 96 ASPA (633), at 2.

97 See Memorandum of Understanding between Federal Trade Commission and the Food and Drug Administration, 36 FR 18539 (Sept. 16, 1971). 98 15 U.S.C. 45a.

99 21 U.S.C. 601(n)(1); 9 CFR 317.8(a) (prohibiting labels that convey ‘‘any false indication of origin’’). 100 See R. Edelstein Letter to E. Drake (Mar. 26, 2020).

D. Guidance for Specific Industries Some commenters requested tailored guidance for specific industries. Specifically, representatives of the beef and shrimp industries requested guidance on whether the Rule would apply to their products, and specific guidance on how to apply ‘‘all or virtually all’’ in these contexts. 1. Beef The Commission received more than 450 comments urging the Commission to clarify that the rule applies to beef products. These stakeholders, primarily U.S. ranchers and industry groups representing domestic ranchers, generally supported the rule and argued it should supersede United States Department of Agriculture (‘‘USDA’’) guidance on using ‘‘Product of USA’’ claims on beef product labels. Although they acknowledged the USDA’s longstanding authority over beef labeling, they expressed concern USDA’s Food Safety Inspection Service (‘‘FSIS’’) Food Standards and Labeling Policy Book currently authorizes producers to place ‘‘Product of USA’’ labels on beef products processed in the USA but comprised of cattle born, raised, and slaughtered overseas. These commenters argued such labels deceive consumers, and ‘‘put U.S. family farmers and ranchers at an unfair disadvantage in the marketplace, because they are not able to differentiate their domestically produced meat and meat products from foreign produced meat and meat products.’’ 85 Accordingly, they argued the ‘‘all or virtually all’’ standard should apply to beef products, and beef products should only bear a ‘‘Product of USA’’ label if they derive from animals born, raised, slaughtered, and processed in the United States.86 In contrast, five commenters argued Congress granted the USDA generally, and the FSIS specifically, authority to address country-of-origin labeling for meat and meat food products. Therefore, they argued, the FTC should defer to the USDA on this issue.87 The North American Meat Institute and the Meat Importers’ Council of America submitted a joint comment stating beef commenters’ concerns ‘‘are misplaced because they fail to recognize that the [USDA’s FSIS] has primary jurisdiction over the meat and poultry labeling through the authority provided in the Federal Meat Inspection Act (FMIA) and the Poultry Products Inspection Act (PPIA).’’ 88 The Montana Stockgrowers Association agreed, explaining that even though it ‘‘supports USA beef as being defined as born, raised, harvested, and processed in the USA . . . [its members] think the [USDA] should be the lead agency to address enforcement of labels that include all meat products.’’ 89 Moreover, some commenters raised concerns applying the FTC’s rule to beef products could lead to challenges in, or even sanctions by, the WTO, given past proceedings relating to beef labeling.90 2. Shrimp The Commission also received dozens of comments from representatives of the domestic shrimp industry. Most of these expressed general support for the proposed rule, and recommended the FTC allow MUSA labels only for shrimp caught, harvested, and processed in the United States.

Although they expressed enthusiasm for the potential application of the proposed MUSA rule’s ‘‘all or virtually all’’ standard in shrimp labeling, commenters acknowledged that USDA’s Country of Origin Labeling (‘‘COOL’’) regulations 91 have primary authority in this space. The COOL regulations require ‘‘retail establishments’’ to provide country-of-origin information for wild and farm-raised fish and shellfish,92 and incorporate specific standards under which marketers can label shrimp as MUSA.93 However, commenters identified a possible gap in regulatory coverage, explaining that, pursuant to USDA Agricultural Marketing Service (‘‘AMS’’) regulations governing country-of-origin labeling for fish and shellfish, COOL does not apply to processed shrimp products, including breaded or marinated shrimp.94 In addition, as described above in Section II.C.1., these commenters noted that USDA COOL regulations do not apply to claims regarding shrimp or shrimp products on restaurant menus.95 Thus, these commenters urged the FTC to ‘‘us[e] its authority to enforce the MUSA rule [with respect to these categories of shrimp products, thereby] . . . filling a void in federal labeling accountability and providing certainty to the seafood market during this time of widespread economic instability.’’ 96 3. Analysis The FTC shares jurisdiction over country-of-origin claims for agricultural products with the USDA and, in some instances, the Food and Drug Administration (‘‘FDA’’). USDA and FDA have primary jurisdiction over labeling issues for the food products within their purview.97 Section 45a specifically provides that ‘‘Nothing in this section shall preclude the application of other provisions of law relating to labeling.’’ 98 Accordingly, Section 323.5(a) of this rule makes clear that the rule does not supersede, alter, or affect the application of any other federal statute or regulation relating to country-of-origin labeling requirements, including but not limited to regulations issued under the FMIA, 21 U.S.C. 601 et seq.; the Poultry Products Inspection Act, 21 U.S.C. 451 et seq.; or the Egg Products Inspection Act, 21 U.S.C. 1031 et seq.

Congress has granted the USDA’s FSIS specific authority to regulate agricultural products, including, among others, beef and chicken products. The USDA regulates labels on meat products sold at retail pursuant to the FMIA, which prohibits misleading labels.99 Although FSIS’s Policy Book has permitted voluntary claims of ‘‘Product of USA’’ for imported products under FSIS’s jurisdiction, including beef products, processed in the USA, FSIS recently explained this guidance ‘‘may be misleading to consumers and may not meet consumer expectations of what ‘Product of USA’ signifies.’’ 100 Accordingly, the USDA announced plans to initiate a rulemaking to alleviate any potential confusion in the VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00029 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 192

37030 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 101 Id.

102 7 U.S.C. 1638(1); 7 CFR 60.128. 103 The FTC notes deceptive claims on restaurant menus appear to be largely a regional issue, and therefore are being addressed through state legislation. See, e.g., La. R.S. § 40:5.5.4 (requiring food service establishments to provide notice to consumers if crawfish or shrimp is imported); La. R.S. § 56:578.14 (‘‘No owner or manager of a restaurant that sells imported crawfish or shrimp shall misrepresent to the public, either verbally, on a menu, or on signs displayed on the premises, that the crawfish or shrimp is domestic.’’). FTC staff will continue to monitor this issue. 104 BWC (622); AAFA (675). Additionally, PCPC (589) argued the Rule should specifically preempt a private right of action. However, two commenters agreed with the section as drafted as a means to ‘‘ensure regulatory certainty and consistency of product U.S. origin labels nationwide.’’ RILA (570). See also NAM (623) (recognizing the ‘‘value of utilizing preemption to create a uniform MUSA standard’’).

105 UIUC Accounting Group A13 (5); Shirley Boyd (6); UIUC—BADM 40—A02 (22); Senators (373); United Steelworkers (526); Women Involved in Farm Economics/Pam Potthoff Beef Chairman (672). 106 The Commission received 30 comments arguing country-of-origin labeling should be mandatory for all products. See, e.g., J R. Brookshire (9). Additionally, six commenters argued specifically in favor of mandatory country-of-origin labeling for all products sold online. See, e.g., Made in USA Foundation (2).

107 Twelve commenters requested coverage of qualified claims. See, e.g., Shirley Boyd (6); United Steelworkers (526); AAM (611); CPA (625). 108 Six commenters argued civil penalties should be linked to company size. See, e.g., Chris Posey (7). 109 See City of New York v. FCC, 486 U.S. 57, 64 (1988) (‘‘The statutorily authorized regulations of an agency will pre-empt any state or local law that conflicts with such regulations or frustrates the purposes thereof.’’).

110 See, e.g., Mozilla v. FCC, 940 F.3d 1, 74–75 (D.C. Cir. 2019).

111 See, e.g., Shirley Boyd (6) (‘‘The FTC’s final rules should apply to labeling, advertising and other promotional and marketing materials in addition to labels and mail order catalogs/ promotional materials.’’). 112 15 U.S.C. 45(a), 52. 113 Made in USA Foundation (2). 114 United Steelworkers (526). marketplace.101 As that proceeding unfolds, the Commission remains committed to engaging with the USDA to ensure American consumers receive truthful and accurate information about the beef products they buy. Under its COOL regulations, USDA’s AMS has primary authority over country-of-origin labels for most fish and shellfish products.102 Because Section 45a’s general grant of rulemaking authority does not authorize the Commission to issue regulations that would preclude the application of existing statutes and regulations addressing agricultural product labeling, the FTC defers to AMS’s regulatory scheme for COOL for fish and shellfish. Section 323.5 makes clear the rule does not supersede, alter, or affect any other federal statute or regulation relating to country-of-origin labeling requirements. However, to the extent certain, limited categories of agricultural products fall outside USDA’s jurisdiction, the Commission will analyze claims on a case-by-case basis and consult with other agencies as appropriate.103 E. Other Proposals Some commenters proposed a series of other amendments, arguing variously that the Rule should preempt state law entirely; 104 cover MUSA advertising generally; 105 make country-of-origin labeling mandatory for all products; 106 incorporate provisions relating to qualified U.S.-origin claims; 107 and include language specifically correlating penalties to firm sizes.108 The Commission declines to adopt these changes, which are inconsistent with its rulemaking mandate under Section 45a. As discussed above, Section 45a grants the Commission authority to issue rules to prevent unfair or deceptive acts or practices relating to MUSA labeling. Specifically, Section 45a authorizes the Commission to issue rules to require MUSA labeling to ‘‘be consistent with decisions and orders of the Federal Trade Commission issued pursuant to [Section 5 of the FTC Act].’’ The FTC may seek civil penalties for violations of such rules.

1. Preemption The Commission intends to preempt state statutes or regulations that are inconsistent with the Commission’s rules only to the extent of the inconsistency.109 When it enacted Section 45a, Congress declined to expressly preempt state regulation or otherwise demonstrate a clear intent for federal law to occupy the field of regulation in question.110 Accordingly, Section 323.5 of the Rule preempts a state statute, regulation, order, or interpretation ‘‘to the extent that such statute, regulation, order, or interpretation is inconsistent with the provisions of this part, and then only to the extent of the inconsistency.’’ Moreover, the rule makes clear that a state statute, regulation, order, or interpretation is not inconsistent with the rule if the protection such statute, regulation, order, or interpretation affords any consumer is greater than the protection provided by the rule. 2. MUSA Advertising Generally Some commenters encouraged the Commission to expand the proposed rule to cover all advertising that includes any U.S.-origin claim, rather than focusing as proposed on MUSA labeling.111 Section 45a, however, is directed at labels on products declaring that a product is ‘‘in whole or substantial part of domestic origin’’ and thus may be labeled ‘‘Made in the U.S.A.,’’ or the equivalent thereof. The statute does not explicitly address general advertising claims beyond the context of labeling. Accordingly, in enacting this rule, the Commission has not focused on advertising more generally, but retains the proposed rule’s focus on MUSA claims on labels or in mail order or catalog advertising, including in online marketplaces, that depict a product label. However, the FTC’s general authority under Sections 5 and 12 of the FTC Act covers advertising, including advertising of qualified and unqualified MUSA claims.112 3. Mandatory Country-of-Origin Labeling Other commenters recommended the Commission make country-of-origin labeling mandatory. For example, the Made in USA Foundation proposed that the Rule should require that all advertisements for specified categories of products, including all products advertised for sale on the internet, disclose the country of origin of the products in a clear and prominent manner.113 While the Commission acknowledges that many consumers may find such information to be valuable in many circumstances, Section 45a does not authorize the Commission to establish a mandatory country-of-origin labeling scheme. The statute grants the Commission authority to issue rules to ensure that Made in USA claims are not deceptive and are consistent with the Commission’s decisions and orders defining unfair or deceptive acts or practices under Section 5. Accordingly, the Commission lacks authority under Section 45a to enact this proposal.

4. Qualified U.S.-Origin Claims Some commenters also argued that the rule should also address qualified U.S.-origin claims. The United Steelworkers asserted that, ‘‘[a]s firms with global supply chains seek to benefit from the value consumers place in products with American content, we must ensure that qualified claims accurately represent the level of value creation in the United States.’’ 114 Section 45a, however, is directed to labels on products declaring that a product is ‘‘in whole or substantial part of domestic origin,’’ and therefore the Rule is directed to unqualified claims, rather than more varied qualified claims. Accordingly, the FTC will continue to address deceptive qualified U.S.-origin claims under its general VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00030 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 193

37031 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 115 15 U.S.C. 45(a).

116 Chris Posey (7).

117 See 15 U.S.C. 45(m)(1)(A) (establishing civil penalties for violations of Commission rules); see also 16 CFR 1.98 (stating currently applicable maximum civil penalty amounts). 118 15 U.S.C. 45(m)(1)(C). 119 See 16 CFR 1.25.

120 5 U.S.C. 603–605.

121 Anonymous (24) (commenter is unaware of small entities affected by the NPRM); UIUC—BADM 403—A02 (25) (commenter is unaware of small entities affected by the NPRM); Family Farm Action Alliance (543) (anticipating positive economic outcomes for small business entities as a result of the rule); Leo McDonnell (578) (anticipating benefits for small businesses, including ranchers and feeders); McKenna Walsh (581) (stating the Rule will be helpful for small businesses lacking resources to engage in MUSA litigation); Natural Continued authority in Section 5 of the FTC Act.115 Marketers should continue to consult the Policy Statement for guidance on the application of the Commission’s Section 5 analysis to such claims including, but not limited to, ‘‘Assembled in USA,’’ claims indicating the amount of U.S. content (e.g., ‘‘60% U.S. Content’’), claims indicating the parts or materials that are imported (e.g., ‘‘Made in USA from imported leather’’), or claims about specific processes or parts (e.g., claims a product is ‘‘designed,’’ ‘‘painted,’’ or ‘‘written’’ in the United States). 5. Civil Penalties Some commenters argued that larger businesses may not be sufficiently deterred by the current maximum civil penalty amounts for violations of Commission rules and recommended that civil penalties should be increased for larger firms.116 The Commission lacks authority, however, to establish civil penalty maximums that depart from the levels provided by statute. Civil penalty amounts for violations of the Commission’s rules are established by the FTC Act.117 Nonetheless, the Commission believes that its civil penalty authority generally provides an effective deterrent against rule violations, and notes that civil penalties for violations of a rule are assessed per violation. Moreover, the FTC Act establishes a series of factors for courts to consider in assessing appropriate civil penalty amounts in individual enforcement matters, including ‘‘the degree of culpability, any history of prior such conduct, ability to pay, effect on ability to continue to do business, and such other matters as justice may require.’’ 118 To the extent firm size is an appropriate consideration within one or more of these factors, the Commission will take that factor into account in seeking civil penalties. III. Final Rule For the reasons described above, the Commission has determined to adopt the substantive provisions of the rule as initially proposed. Specifically, the rule covers labels on products that make unqualified MUSA claims. It codifies the Commission’s previous MUSA Decisions and Orders and prohibits marketers from making unqualified MUSA claims on labels unless: (1) Final assembly or processing of the product occurs in the United States, (2) all significant processing that goes into the product occurs in the United States, and (3) all or virtually all ingredients or components of the product are made and sourced in the United States. The rule also covers labels making unqualified MUSA claims appearing in mail order catalogs or mail order advertising.

To avoid confusion or perceived conflict with other country-of-origin labeling laws and regulations, the rule specifies that it does not supersede, alter, or affect any other federal or state statute or regulation relating to countryof-origin labels, except to the extent that a state country-of-origin statute, regulation, order, or interpretation is inconsistent with the rule. Finally, the Commission has adopted a new Section, 323.6, to address commenter concerns about the applicability of the ‘‘all or virtually all’’ standard across product categories. This provision allows marketers and other covered persons to seek full or partial exemptions if they can demonstrate application of the rule’s requirements to a particular product or class of product is not necessary to prevent the acts or practices to which the rule relates. The Commission’s rules of practice governing petitions for rulemaking provide the procedures for submitting such petitions.119 Pursuant to this process, interested persons may file relevant consumer perception evidence and data with the Commission. If the Commission deems the petition sufficient to warrant further consideration, it will follow the procedures outlined in Section 1.25 of its rules.

IV. Paperwork Reduction Act The Paperwork Reduction Act (‘‘PRA’’), 44 U.S.C. 3501 et seq., requires federal agencies to seek and obtain Office of Management and Budget (‘‘OMB’’) approval before undertaking a collection of information directed to ten or more persons. The Commission has determined that there are no new requirements for information collection associated with this final rule. V. Regulatory Flexibility Act The Regulatory Flexibility Act (‘‘RFA’’), as amended by the Small Business Regulatory Enforcement Fairness Act of 1996, requires that the Commission provide an Initial Regulatory Flexibility Analysis with a proposed rule, and a Final Regulatory Flexibility Analysis with the final Rule, unless the Commission certifies that the proposed Rule will not have a significant impact on a substantial number of small entities.120 The Commission recognizes some affected entities may qualify as small businesses under the relevant thresholds. However, the Commission anticipates that the final Rule will not have the threshold impact on small entities. First, the rule includes no new barriers to making claims, such as reporting or approval requirements. Second, the rule merely codifies standards established in FTC enforcement Decisions and Orders for decades. Therefore, the Rule imposes no new burdens on law-abiding businesses. Accordingly, the Commission certifies that the final rule will not have a significant economic impact on a substantial number of small businesses. Although the Commission certifies under the RFA that the amendment will not have a significant impact on a substantial number of small entities, the Commission has determined, nonetheless, that it is appropriate to publish a Final Regulatory Flexibility Analysis in order to explain the impact of the amendments on small entities as follows:

A. Description of the Need for and Objectives of the Rule The Commission proposed the MUSA Labeling Rule for two primary reasons: To strengthen its enforcement program and make it easier for businesses to understand and comply with the law. Specifically, by codifying the existing standards applicable to MUSA claims in a rule as authorized by Congress, the FTC will be able to provide more certainty to marketers about the standard for making unqualified claims on product labels, without imposing any new obligations on market participants. In addition, enactment of the Rule will enhance deterrence by authorizing civil penalties against those making unlawful MUSA claims on product labels. B. Issues Raised by Comments in Response to the IRFA The Commission received six comments specifically related to the impact of the Rule on small businesses.121 Of those six, all VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00031 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 194

37032 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations Products Association (618) (stating the rule would require small dietary supplement businesses to relabel products).

122 Natural Products Association (618). 123 Id.

anticipated the rule would benefit small businesses, with the exception of the Natural Products Association, which argued that the Rule would impose costs on dietary supplement manufacturers that would have to relabel products.122 The FTC notes that the rule imposes no new requirements on dietary supplement manufacturers, and that products requiring relabeling as a result of the FTC’s rule were likely deceptively labeled prior to the Rule’s publication. The Chief Counsel for Advocacy of the Small Business Administration did not submit comments.

C. Estimate of Number of Small Entities to Which the Rule Will Apply The Small Business Administration estimates that in 2018 there were 30.2 million small businesses in the United States. The rule will apply to small businesses that make MUSA claims on product labels. The Commission estimates the rule will not have a significant impact on these small businesses because it does not impose any new obligations on law-abiding businesses; rather, it merely codifies standards established in FTC enforcement Decisions and Orders for decades.

D. Projected Reporting, Recordkeeping, and Other Compliance Requirements, Including Classes of Covered Small Entities and Professional Skills Needed To Comply The rule imposes no affirmative reporting or recordkeeping requirements. The rule’s compliance requirements, consistent with the Policy Statement and longstanding Commission case law, require that marketers may not make unqualified U.S.-origin claims on product labels unless final assembly or processing of the product occurs in the United States, all significant processing that goes into the product occurs in the United States, and all or virtually all ingredients or components of the product are made and sourced in the United States. The small entities potentially covered by the rule will include all such entities that make MUSA claims on product labels. The rule codifies the standard for MUSA claims established in Commission Decisions and Orders, and no new obligations are anticipated. E. Description of Steps Taken To Minimize Significant Economic Impact, if Any, on Small Entities, Including Alternatives The Commission sought comment and information on the need, if any, for alternative compliance methods that would reduce the economic impact of the rule on such small entities. Several commenters proposed alternatives to the proposed rule including: (1) Introducing a percentage-of-costs standard; (2) adopting a standard that makes allowances for imported parts or materials not available in the United States; (3) aligning with CBP’s substantial transformation standard; or (4) adding a safe harbor for ‘‘good faith’’ efforts to comply. Other commenters proposed that the Commission provide for a delayed effective date to allow businesses additional time to comply. As discussed above, the Commission has declined to adopt these alternatives because it believes they would undermine the effectiveness of the rule. In addition, the Natural Products Association recommended the FTC incorporate an example specific to dietary supplements.123 The Commission has declined to include examples specific to any particular industry in the Rule. The rule codifies the standards articulated in Commission enforcement decisions that have been applicable to MUSA claims for decades. FTC guidance and enforcement decisions provide numerous examples demonstrating how to apply the ‘‘all or virtually all’’ standard in a variety of industries. Accordingly, the Commission has concluded that it is unnecessary to provide industryspecific examples in the Rule. As described previously, the rule merely codifies standards already established in FTC enforcement Decisions and Orders. It does not impose new substantive obligations on businesses that have already been complying with their obligations to avoid deceptive claims under Section 5 of the FTC Act. Under these circumstances, the Commission does not believe a special exemption for small entities or significant compliance alternatives are necessary or appropriate to minimize the compliance burden, if any, on small entities while achieving the intended purposes of the rule. Nonetheless, the Commission has adopted a provision allowing covered persons to petition the Commission for an exemption from the Rule if application of the rule’s requirements is not necessary to prevent the acts or practices to which the rule relates. VI. Other Matters Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs has designated this rule as not a ‘‘major rule,’’ as defined by 5 U.S.C. 804(2). VII. Final Rule Language List of Subjects in 16 CFR Part 323 Labeling, U.S. origin.

■For the reasons stated in the preamble, the Federal Trade Commission adds part 323 to subchapter C of title 16 of the Code of Federal Regulations as follows: PART 323—MADE IN USA LABELING Sec.

323.1 Definitions.

323.2 Prohibited acts.

323.3 Applicability to mail order advertising.

323.4 Enforcement.

323.5 Relation to Federal and State laws. 323.6 Exemptions.

Authority: 15 U.S.C. 45a. § 323.1 Definitions.

As used in this part:

(a) The term Made in the United States means any unqualified representation, express or implied, that a product or service, or a specified component thereof, is of U.S. origin, including, but not limited to, a representation that such product or service is ‘‘made,’’ ‘‘manufactured,’’ ‘‘built,’’ ‘‘produced,’’ ‘‘created,’’ or ‘‘crafted’’ in the United States or in America, or any other unqualified U.S.origin claim.

(b) The terms mail order catalog and mail order promotional material mean any materials, used in the direct sale or direct offering for sale of any product or service, that are disseminated in print or by electronic means, and that solicit the purchase of such product or service by mail, telephone, electronic mail, or some other method without examining the actual product purchased. § 323.2 Prohibited acts.

In connection with promoting or offering for sale any good or service, in or affecting commerce as ‘‘commerce’’ is defined in section 4 of the Federal Trade Commission Act, 15 U.S.C. 44, it is an unfair or deceptive act or practice within the meaning of section 5(a)(1) of the Federal Trade Commission Act, 15 U.S.C. 45(a)(1), to label any product as Made in the United States unless the final assembly or processing of the product occurs in the United States, all significant processing that goes into the product occurs in the United States, and VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00032 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 195

37033 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 1 See 15 U.S.C. 45a.

2 See generally Statement of Commissioner Rohit Chopra Regarding Activating Civil Penalties for Made in USA Fraud (Apr. 17, 2019), https:// www.ftc.gov/public-statements/2019/04/statementcommissioner-rohit-chopra-regarding-activatingcivil-penalties.

3 Even without a final rule, Commissioners could have sought more in administrative settlements, given that much of the Made in USA fraud detected by Commission staff met the definition of ‘‘dishonest or fraudulent’’ in Section 19 of the FTC Act. 15 U.S.C. 57b. Instead, Commissioners routinely accepted settlements with no meaningful relief at all.

4 The Commission received over 700 comments in response to its Notice of Proposed Rulemaking on Made in USA labeling. See FTC Seeks Comments on MUSA Rulemaking, Matter No. P074204, Docket ID FTC–2020–0056 (July 16, 2020), https:// www.regulations.gov/docket/FTC-2020-0056. 5 See ‘‘Made in USA’’ and Other U.S. Origin Claims, 62 FR 63756 (Dec. 2, 1997). 6 See 16 CFR 323.3.

7 See 7 U.S.C. 227.

all or virtually all ingredients or components of the product are made and sourced in the United States. § 323.3 Applicability to mail order advertising.

To the extent that any mail order catalog or mail order promotional material includes a seal, mark, tag, or stamp labeling a product Made in the United States, such label must comply with § 323.2.

§ 323.4 Enforcement.

Any violation of this part shall be treated as a violation of a rule under section 18 of the Federal Trade Commission Act, 15 U.S.C. 57a, regarding unfair or deceptive acts or practices.

§ 323.5 Relation to Federal and State laws. (a) In general. This part shall not be construed as superseding, altering, or affecting the application of any other federal law or regulation relating to country-of-origin labeling requirements, including but not limited to the Federal Meat Inspection Act, 21 U.S.C. 601 et seq., the Poultry Products Inspection Act, 21 U.S.C. 451 et seq., and the Egg Products Inspection Act, 21 U.S.C. 1031 et seq. In addition, this part shall not be construed as superseding, altering, or affecting any other State statute, regulation, order, or interpretation relating to country-of-origin labeling requirements, except to the extent that such statute, regulation, order, or interpretation is inconsistent with the provisions of this part, and then only to the extent of the inconsistency. (b) Greater protection under State law. For purposes of this section, a State statute, regulation, order, or interpretation is not inconsistent with the provisions of this part if the protection such statute, regulation, order, or interpretation affords any consumer is greater than the protection provided under this part, as determined by the Commission on its own motion or upon the petition of any interested party.

§ 323.6 Exemptions.

Any person to whom this Rule applies may petition the Commission for a partial or full exemption. The Commission may, in response to petitions or on its own authority, issue partial or full exemptions from this part if the Commission finds application of the Rule’s requirements is not necessary to prevent the acts or practices to which the Rule relates. The Commission shall resolve petitions using the procedures provided in § 1.25 of this chapter. If appropriate, the Commission may condition such exemptions on compliance with alternative standards or requirements to be prescribed by the Commission.

By direction of the Commission. April J. Tabor, Secretary.

The following Appendices will not Appear in the Code of Federal Regulations.

Appendix I: Statement of Commissioner Rohit Chopra Joined by Chair Lina Khan and Commissioner Rebecca Kelly Slaughter Today, the Commission has voted to adopt a final Made in USA rule. The final rule reflects a substantial number of comments from the public, which overwhelmingly supported this policy change by the Commission. By formally codifying this rule, the Commission has activated a broader range of remedies, including the ability to seek redress, damages, penalties, and other relief from those who lie about a Made in USA label. The rule will especially benefit small businesses that rely on the Made in USA label, but lack the resources to defend themselves from imitators. Absent this rule, the Commission would be unable to seek this full set of sanctions. Importantly, this is a ‘‘restatement rule,’’ which affirms longstanding guidance and legal precedent with respect to Made in USA labels—thereby imposing no new obligations on manufacturers and sellers. Because of the stricter sanctions they trigger, restatement rules such as this one will increase fraud deterrence and ensure that victims can be made whole.

Background on the FTC’s Permissive Policy on Made in USA Fraud For decades, there has been a bipartisan consensus among Commissioners that Made in USA fraud should not be penalized. In my view, this policy posture was in direct contravention of both the letter and spirit of the law Congress enacted. In 1994, shortly after the North American Free Trade Agreement took effect, Congress enacted legislation to protect the integrity of our national brand by explicitly authorizing the FTC to trigger penalties and other relief for Made in USA fraud, but only after formally codifying a rule.1 However, the Commission never even proposed one.2 Instead, over the past quarter century, Commissioners implemented a highly permissive Made in USA fraud policy, where violators faced essentially no consequences whatsoever. Even in cases of blatant abuse of the Made in USA label, Commissioners routinely voted to allow wrongdoers to settle for no restitution, no forfeiture of ill-gotten gains, no admission or findings of liability, and no notice to victims.3 In adopting this rule, the Commission acknowledges that this longstanding policy was misguided and agrees that the codification of today’s final rule is long overdue.

Noteworthy Provisions of the Final Rule In 2019, TINA.org filed a petition with the Commission to promulgate a rule, given the rampant Made in USA fraud across sectors of the economy. In 2020, the Commission issued a Notice of Proposed Rulemaking and then analyzed a substantial number of comments from producers, consumers, foreign governments, and others.4 After considering these comments, the Commission has adopted a rule consistent with the authority granted by Congress in 1994. There are several aspects worthy of brief discussion.

First, the Commission has codified the ‘‘all or virtually all’’ standard, consistent with the FTC’s longstanding Enforcement Policy Statement on U.S. Origin Claims.5 This standard covers unqualified claims. The Commission must protect the public from deception, and the agency declines to adopt alternative approaches, as explained in the final rule.

Second, the Commission has outlined a definition of ‘‘label’’ consistent with the Commission’s expertise on labeling. While the Commission declines to adopt a definition that includes a list of specific examples, such as restaurant menus, the definition of label does extend beyond labels physically affixed to a product. As described in the rule, other depictions of labels are also covered; in some circumstances, labels appearing online may also be subject to the rule.6 The Commission declines to cover advertising more broadly, as this is inconsistent with the authority granted by Congress.

Third, there was considerable interest in the rulemaking from farmers, ranchers, and others in the meat and agricultural industry, with the majority of comments arguing in favor of stricter standards. The rule declines to grant an exemption sought by the meatpacking industry, as this would be inconsistent with the Commission’s authority prescribed by Congress under the Packers and Stockyards Act.7 However, contemporaneous with the FTC’s vote today, the U.S. Department of Agriculture has announced that it will be conducting a topto-bottom review of its labeling standard. USDA has previously acknowledged that its VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00033 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 196

37034 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 1 I have voted to support every MUSA enforcement action recommended to the Commission by staff since joining the Commission. See In the Matter of Gennex Media, LLC No. C–4741 (Apr. 2021), https://www.ftc.gov/system/files/ documents/cases/2023122gennexmediafinalorder. pdf; In the Matter of Chemence, Inc., et al., No. 4738 (Feb. 2021), https://www.ftc.gov/system/files/ documents/cases/2021-02-10_chemence_admin_ order.pdf; In the Matter of Williams-Sonoma, Inc., No. C–4724 (July 2020), https://www.ftc.gov/ system/files/documents/cases/2023025c4724 williamssonomaorder.pdf; U.S. v. iSpring Water Systems, LLC, et al., No. 1:16–cv–1620–AT (N.D. Ga. 2019); https://www.ftc.gov/system/files/ documents/cases/172_3033_ispring_water_systems_ -_stipulated_order.pdf; In the Matter of Sandpiper Gear of California, Inc. et al., No. 182–3095, https:// www.ftc.gov/enforcement/cases-proceedings/182- 3095/sandpiper-california-inc-et-al-matter; Underground Sports d/b/a Patriot Puck, et al., No. 182–3113 (April 2019), https://www.ftc.gov/ enforcement/cases-proceedings/182-3113/ underground-sports-inc-doing-business-patriotpuck-et-al; In the Matter of Nectar Sleep, LLC, No.182–3038 (Sept. 2018), https://www.ftc.gov/ enforcement/cases-proceedings/182-3038/nectarbrand-llc.

2 Conf. Rep. on H.R. 3355 (filed in House (8/21/1994)).

3 Several commenters echoed the concerns I raised in my statement when the Commission sought comment on this proposed Rule and those raised by Commissioner Phillips. See Council for Responsible Nutrition Comment; Personal Care Products Council Comment; National Association of Manufacturers Comment; Anonymous Comment 592.

4 See Part 323.1(b).

5 See Part 323.3.

6 Guidance on the definition of ‘‘label’’ can be found in analogous FTC rules and guides in a variety of contexts. There, ‘‘labels’’ repeatedly have been defined as a distinct subcategory of advertising (in other words, not coterminous with advertising)1 and have been described as objects attached to a product or its packaging.1 Given both the statutory guidance Congress provided when it drafted this statute, and precedent concerning the term ‘‘label’’ in FTC rules and guides, the Commission has ample landmarks to draft a Rule that falls within its jurisdictional boundaries.

7 Statement of Commissioner Christine S. Wilson Concurring in Part, Dissenting in Part, Notice of Proposed Rulemaking related to Made in USA Claims (June 22, 2020), https://www.ftc.gov/system/ files/documents/public_statements/1577099/ p074204musawilsonstatementrev.pdf. 8 Report: Americans Going Online . . . Explosive Growth, Uncertain Destinations, Pew Research Center (Oct. 16, 1995) (noting ‘‘most consumers are still feeling their way through cyberspace . . . [and] have yet to begin purchasing goods and services online’’), available at: https://www.peoplepress.org/1995/10/16/americans-going-onlineexplosive-growth-uncertain-destinations/. 9 U.S. Innovation and Competition Act, S. 1260, Section 2510, 117th Cong. (June 8, 2021), https:// www.democrats.senate.gov/imo/media/doc/ DAV21A48.pdf.

10 See UIUC Accounting Group Comment; Shirley Boyd Comment; UIUC—BADM Comment; Senators Comment; United Steelworkers Comment; Women Involved in Farm Economics/Pam Potthoff Beef Chairman Comment.

‘‘Product of USA’’ designation may be deceptive. I am extremely grateful to Secretary Tom Vilsack and USDA staff for the action they are taking.

I hope the USDA will study the FTC’s rulemaking record carefully and come to the same conclusion I have: The USDA’s Product of USA standard is misleading and distorts competition in the retail market for beef and other products. I also believe that unqualified ‘‘Product of USA’’ claims for meat products are only appropriate when the animal was born, raised, and slaughtered in the United States. Given our shared jurisdiction, I expect that the Commission will deepen its partnership with the USDA and closely coordinate on any enforcement proceeding with respect to retail sales of meat and other products.

Conclusion The Commission appreciates the substantial public interest in protecting the Made in USA brand. The final rule provides substantial benefits to the public by protecting businesses from losing sales to dishonest competitors, and protecting families seeking to purchase American-made goods. More broadly, this long-overdue rule is an important reminder that the Commission must do more to use the authorities explicitly authorized by Congress to protect market participants from fraud and abuse. I thank my fellow Commissioners and members of the Commission staff who contributed to the development of this final rule, as well as members of the public for their thoughtful contributions. Appendix II: Dissenting Statement of Commissioner Christine S. Wilson Today the Commission announces a Final Rule with respect to ‘‘Made in USA’’ (MUSA) labels. I support the FTC’s prosecution of MUSA fraud 1 and supported its consideration of a rule that addresses deceptive MUSA claims on labels, consistent with the authority granted to the FTC by Congress in Section 45a. The Rule announced today, however, exceeds that authority.

Section 45a of the FTC Act—the provision pursuant to which we advance this Rule— authorizes the Commission to issue rules governing MUSA claims on products ‘‘with a ‘Made in the U.S.A.’ or ‘Made in America’ label, or the equivalent thereof.’’ The provision is titled ‘‘Labels on products’’ and repeatedly references ‘‘labels.’’ The Commission nonetheless has chosen to promulgate a rule that could be read to cover all advertising, not just labeling. This Rule is not supported by the plain language of 45a. It is clear Congress intended to extend rulemaking authority over the many potential variations (or ‘‘equivalents’’) of ‘‘Made in the U.S.A.’’ or ‘‘Made in America’’ claims that may be found on labels, not labels and claims made in advertising or marketing. The legislative history for Section 45a supports this interpretation. Specifically, the Conference Report on H.R. 3355 discusses any label characterizing ‘‘a product as ‘Made in the U.S.A.’ or the equivalent thereof,’’ signaling Congress’ intent that the statute should cover not just literal invocations of ‘‘Made in the U.S.A.,’’ but also equivalents to that claim (i.e., Made in America, American Made, and so on).2 The Commission’s Rule defines the term far more broadly than any FTC precedent, and in a way that, in my view, exceeds our statutory grant of rulemaking authority.3 The Rule we issue today will cover not just labels, but all:

‘‘materials, used in the direct sale or direct offering for sale of any product or service, that are disseminated in print or by electronic means, and that solicit the purchase of such product or service by mail, telephone, electronic mail, or some other method without examining the actual product purchased’’ 4 that include ‘‘a seal, mark, tag, or stamp labeling a product Made in the United States.’’ 5 This language could bring within the scope of the Rule stylized marks in online advertising or paper catalogs and potentially other advertising marks, such as hashtags, that contain MUSA claims.6 In the statement I issued when the Commission sought comment on this proposed Rule, I noted that were Congress drafting this statute now, it might choose language to encompass those broader contexts, including online advertising.7 But there was no plausible argument to be made that the ordinary meaning of the text when enacted in 1994 encompassed online advertising—a period when online shopping was largely unfamiliar to most consumers.8 As it happens, the Senate recently passed the Country of Origin Labeling Online Act (COOL Act), which prohibits deceptive country-of-origin representations. There Congress did, in fact, specify its application to labeling as well as other forms of online advertising:

it shall be unlawful to make any false or deceptive representation that a product or its parts or processing are of United States origin in any labeling, advertising, or other promotional materials, or any other form of marketing, including marketing through digital or electronic means in the United States.9 This language, in contrast to Section 45a, leaves no doubt it applies to labeling and advertising and confirms Congress views ‘‘labeling’’ as distinct from ‘‘advertising or other promotional materials,’’ including in an online context.

To the extent the Commission seeks to issue a broader prohibition on Made in USA fraud, as Commissioner Chopra asserted when the Commission sought comment on this Rule, it has other options. The Commission can institute a rulemaking proceeding pursuant to Section 18 of the FTC Act. Several commenters suggested that rather than promulgate a limited rule for labeling claims, the Commission should conduct a full proceeding to address all advertising claims.10 The Commission has not taken this action. The Commission alternatively could work with Congress to effectuate the passage of the COOL Act, which would appear to moot this Rule if enacted.

Accordingly, because this Rule exceeds the scope of authority granted by Congress to the FTC, I dissent. I do not support creatively and expansively interpreting the agency’s jurisdiction with respect to rulemaking authority.

The Commission, for more than 80 years, built a comprehensive program to ensure VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00034 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 197

37035 Federal Register / Vol. 86, No. 132 / Wednesday, July 14, 2021 / Rules and Regulations 11 The FTC has issued over 150 closing letters to companies making misleading U.S.-origin claims. Made in USA Workshop Report at 3 (June 2020). Companies only receive closing letters if they demonstrate to staff they will come into compliance with the FTC’s Enforcement Policy Statement on ‘‘Made in the USA.’’ The staff’s workshop report explains ‘‘companies often produce substantiation for updated claims to the FTC staff, and then present a plan that includes training staff, updating online marketing materials (e.g., company websites and social media platforms), updating hardcopy marketing materials (e.g., product packaging, advertisements, tradeshow materials), and working with dealers, distributors, and third-party retailers to ensure downstream claims are in compliance.’’ Id. at 3 n.7. The FTC has also settled over 25 enforcement actions, charging that companies refused to come into compliance or engaged in outright fraud. Id.

12 I would note as well that seeking civil penalties for deceptive MUSA claims, as defined under the Commission’s Rule, could have adverse market effects. Excessive penalties, divorced from harm, can result in over-deterrence. Importantly, the costs associated with over-deterrence are likely to increase with the expansiveness of the definition of labelling.

13 AMG v. FTC, slip op No. 19–508 (Apr. 22, 2021), https://www.supremecourt.gov/opinions/ 20pdf/19-508_l6gn.pdf.

14 See Federal Trade Commission Improvements Act of 1980, Public Law 96–252, 94 Stat. 374 (1980) (reforming the ability of the FTC to promulgate rules by requiring a multi-step process with public comment and subject to Congressional review). This Act also authorized $255 million in funding for the Commission and was the first time since 1977 the agency was funded through the traditional funding process after the backlash from Congress over its rulemaking activities. See Kintner, Earl, et al., ‘‘The Effect of the Federal Trade Commission Improvements Act of 1980 on the FTC’s Rulemaking and Enforcement Authority,’’ 58 Wash. U. Law Rev. 847 (1980); see also J. Howard Beagles III and Timothy J. Muris, FTC Consumer Protection at 100: 1970s Redux or Protecting Markets to Protect Consumers?, 83 Geo. Wash. L. Rev. 2157 (2015) (describing the ‘‘disastrous failures’’ of the FTC in the 1970s and the 1980s from enforcement and regulatory overreach and quoting Jean Carper, The Backlash at the FTC, Wash. Post, C1 (Feb. 6, 1977) (describing the backlash from Congress at the FTC, after a period of intense rulemaking activity culminating in the agency’s being dubbed the ‘‘National Nanny’’)); see also Alex Propes, Privacy and FTC Rulemaking: A Historical Context, IAB (Nov. 6, 2018) (discussing how the FTC’s rulemaking history could be influencing Congressional comfort with vesting the FTC with additional privacy authority), https://www.iab.com/ news/privacy-ftc-rulemaking-authority-a-historicalcontext/.

15 See Transcript: Oversight of the Federal Trade Commission: Strengthening Protections for Americans’ Privacy and Data Security (May 8, 2019), available at: https://docs.house.gov/ meetings/IF/IF17/20190508/109415/HHRG-116- IF17-Transcript-20190508.pdf. At this Hearing, Rep. McMorris Rogers stated: ‘‘In various proposals, some groups have called for the FTC to have additional resources and authorities. I remain skeptical of Congress delegating broad authority to the FTC or any agency. However, we must be mindful of the complexities of this issue as well as the lessons learned from previous grants of rulemaking authority to the Commission.’’ Transcript at 8–9. Rep. Walden similarly stated: ‘‘it has been a few decades, but there was a time when the FTC, as we heard, was given broad rulemaking authority but stepped past the bounds of what Congress and the public supported. This required further congressional action and new restrictions on the Commission.’’ Transcript at 62. consumers can trust ‘‘Made in the USA’’ claims.11 My colleagues believe the Commission’s 80 year MUSA enforcement program was a failure and only a rule and the imposition of penalties will deter false MUSA claims. I believe administrative consents, which were an integral part of this program, can be an appropriate remedy to address deceptive MUSA claims, consistent with the views of bipartisan Commissions during the last 25 years. I support seeking monetary relief where appropriate but cannot support acting outside the constraints of our legislative authority.12 I fear as well this Commission’s desire to promulgate or utilize our regulatory authority in ways that exceed the boundaries of underlying statutes and corresponding Congressional intent will continue. The Supreme Court’s recent decision in AMG 13 has eliminated the FTC’s ability to seek equitable monetary relief under Section 13(b) of the FTC Act to compensate consumers. Thus, the temptation to test the limits of our remaining sources of authority is strong. I urge my colleagues to pause. Previous FTC forays into areas outside its jurisdictional authority have resulted in swift condemnation from the courts and Congress.14 Expansive interpretations of our rulemaking authority will not engender confidence among members of Congress who have in the past expressed qualms about the FTC’s history of frolics and detours.15 [FR Doc. 2021–14610 Filed 7–13–21; 8:45 am] BILLING CODE 6750–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration 21 CFR Part 573 [Docket No. FDA–2020–F–1289] Food Additives Permitted in Feed and Drinking Water of Animals; Selenomethionine Hydroxy Analogue AGENCY: Food and Drug Administration, HHS.

ACTION: Final rule.

SUMMARY: The Food and Drug Administration (FDA, we, or the Agency) is amending the regulations for food additives permitted in feed and drinking water of animals to provide for the safe use of selenomethionine hydroxy analogue as a source of selenium in feed for beef and dairy cattle. This action is in response to a food additive petition filed by Adisseo France S.A.S.

DATES: This rule is effective July 14, 2021. See section V of this document for further information on the filing of objections. Submit either electronic or written objections and requests for a hearing on the final rule by August 13, 2021.

ADDRESSES: You may submit objections and requests for a hearing as follows. Please note that late, untimely filed objections will not be considered. Electronic objections must be submitted on or before August 13, 2021. The https://www.regulations.gov electronic filing system will accept objections until 11:59 p.m. Eastern Time at the end of August 13, 2021. Objections received by mail/hand delivery/courier (for written/ paper submissions) will be considered timely if they are postmarked or the delivery service acceptance receipt is on or before that date.

Electronic Submissions Submit electronic objections in the following way:

• Federal eRulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting objections. Objections submitted electronically, including attachments, to https:// www.regulations.gov will be posted to the docket unchanged. Because your objection will be made public, you are solely responsible for ensuring that your objection does not include any confidential information that you or a third party may not wish to be posted, such as medical information, your or anyone else’s Social Security number, or confidential business information, such as a manufacturing process. Please note that if you include your name, contact information, or other information that identifies you in the body of your objection, that information will be posted on https://www.regulations.gov. • If you want to submit an objection with confidential information that you do not wish to be made available to the public, submit the objection as a written/paper submission and in the manner detailed (see ‘‘Written/Paper Submissions’’ and ‘‘Instructions’’). Written/Paper Submissions Submit written/paper submissions as follows:

• Mail/Hand delivery/Courier (for written/paper submissions): Dockets Management Staff (HFA–305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852. • For written/paper objections submitted to the Dockets Management Staff, FDA will post your objection, as well as any attachments, except for information submitted, marked and identified, as confidential, if submitted as detailed in ‘‘Instructions.’’ Instructions: All submissions received must include the Docket No. FDA– 2020–F–1289 for ‘‘Food Additives Permitted in Feed and Drinking Water VerDate Sep<11>2014 16:14 Jul 13, 2021 Jkt 253001 PO 00000 Frm 00035 Fmt 4700 Sfmt 4700 E:\FR\FM\14JYR1.SGM 14JYR1 lotter on DSK11XQN23PROD with RULES1

Page 198

70272 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 1 Pubic Law 106–102, 113 Stat. 1338 (1999). 2 See 15 U.S.C. 6801(b), 15 U.S.C. 6805(b)(2). 3 16 CFR 314.2(c).

4 16 CFR 314.3(a).

5 16 CFR 314.3(a), (b).

6 16 CFR 314.3(a), (b).

7 16 CFR 314.4(b).

8 16 CFR 314.4(c).

9 16 CFR 314.4(e).

10 16 CFR 314.4(a).

11 16 CFR 314.4(d).

12 Safeguards Rule, Request for Comment, 81 FR 61632 (Sept. 7, 2016).

13 The 28 public comments received prior to March 15, 2019, are posted at: https://www.ftc.gov/ policy/public-comments/initiative-674. 14 See, e.g., Mortgage Bankers Association (comment 39, NPRM); National Automobile Dealers Association (Comment 40, NPRM); Data & Marketing Association (comment 38, NPRM); Electronic Transactions Association (comment 24, NPRM); State Privacy & Security Coalition (comment 26, NPRM).

15 FTC Notice of Proposed Rulemaking, 84 FR 13158 (April 4, 2019).

FEDERAL TRADE COMMISSION 16 CFR Part 314 RIN 3084–AB35 Standards for Safeguarding Customer Information AGENCY: Federal Trade Commission. ACTION: Final rule.

SUMMARY: The Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) is issuing a final rule (‘‘Final Rule’’) to amend the Standards for Safeguarding Customer Information (‘‘Safeguards Rule’’ or ‘‘Rule’’). The Final Rule contains five main modifications to the existing Rule. First, it adds provisions designed to provide covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program, such as access controls, authentication, and encryption. Second, it adds provisions designed to improve the accountability of financial institutions’ information security programs, such as by requiring periodic reports to boards of directors or governing bodies. Third, it exempts financial institutions that collect less customer information from certain requirements. Fourth, it expands the definition of ‘‘financial institution’’ to include entities engaged in activities the Federal Reserve Board determines to be incidental to financial activities. This change adds ‘‘finders’’—companies that bring together buyers and sellers of a product or service—within the scope of the Rule. Finally, the Final Rule defines several terms and provides related examples in the Rule itself rather than incorporates them from the Privacy of Consumer Financial Information Rule (‘‘Privacy Rule’’).

DATES:

Effective date: This rule is effective January 10, 2022.

Applicability date: The provisions set forth in § 314.5 are applicable beginning December 9, 2022.

FOR FURTHER INFORMATION CONTACT: David Lincicum (202–326–2773), Katherine McCarron (202–326–2333), or Robin Wetherill (202–326–2220), Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: I. Background Congress enacted the Gramm Leach Bliley Act (‘‘GLB’’ or ‘‘GLBA’’) in 1999.1 The GLBA provides a framework for regulating the privacy and data security practices of a broad range of financial institutions. Among other things, the GLBA requires financial institutions to provide customers with information about the institutions’ privacy practices and about their opt-out rights, and to implement security safeguards for customer information.

Subtitle A of Title V of the GLBA required the Commission and other Federal agencies to establish standards for financial institutions relating to administrative, technical, and physical safeguards for certain information.2 Pursuant to the Act’s directive, the Commission promulgated the Safeguards Rule (16 CFR part 314) in 2002. The Safeguards Rule became effective on May 23, 2003. The current Safeguards Rule requires a financial institution to develop, implement, and maintain a comprehensive information security program that consists of the administrative, technical, and physical safeguards the financial institution uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.3 The information security program must be written in one or more readily accessible parts.4 The safeguards set forth in the program must be appropriate to the size and complexity of the financial institution, the nature and scope of its activities, and the sensitivity of any customer information at issue.5 The safeguards must also be reasonably designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.6 In order to develop, implement, and maintain its information security program, a financial institution must identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information.7 The financial institution must then design and implement safeguards to control the risks identified through the risk assessment, and must regularly test or otherwise monitor the effectiveness of the safeguards’ key controls, systems, and procedures.8 The Rule also requires the financial institution to evaluate and adjust its information security program in light of the results of this testing and monitoring, any material changes in its operations or business arrangements, or any other circumstances it knows or has reason to know may have a material impact on its information security program.9 The financial institution must also designate an employee or employees to coordinate the information security program.10 Finally, the current Safeguards Rule requires financial institutions to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for customer information and require those service providers by contract to implement and maintain such safeguards.11 II. Regulatory Review of the Safeguards Rule On September 7, 2016, the Commission solicited comments on the Safeguards Rule as part of its periodic review of its rules and guides.12 The Commission sought comment on a number of general issues, including the economic impact and benefits of the Rule; possible conflicts between the Rule and state, local, or other Federal laws or regulations; and the effect on the Rule of any technological, economic, or other industry changes. The Commission received 28 comments from individuals and entities representing a wide range of viewpoints.13 Most commenters agreed there is a continuing need for the Rule and it benefits consumers and competition.14 On April 4, 2019, the Commission issued a notice of proposed rulemaking (NPRM) setting forth proposed amendments to the Safeguards Rule (the ‘‘Proposed Rule’’).15 In response, the Commission received 49 comments from various interested parties VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 199

70273 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 16 The 49 relevant public comments received on or after March 15, 2019, can be found at Regulations.gov. See FTC Seeks Comment on Proposed Amendments to Safeguards and Privacy Rules, 16 CFR part 314, Project No. P145407, https://www.regulations.gov/docket/FTC-2019- 0019/document.

17 See FTC, Information Security and Financial Institutions: An FTC Workshop to Examine Safeguards Rule Tr. (July 13, 2020), https:// www.ftc.gov/system/files/documents/public_events/ 1567141/transcript-glb-safeguards-workshopfull.pdf [hereinafter Safeguards Workshop Tr.]. 18 The 11 relevant public comments relating to the subject matter of the July 13, 2020, workshop can be found at https://www.regulations.gov/ document/FTC-2020-0038-0001. This document cites comments using the last name of the individual submitter or the name of the organization, followed by the number based on the last two digits of the comment ID number. 19 See Encore Capital Group (comment 25, NPRM); Justine Bykowski (comment 12, NPRM); ‘‘Peggy from Bloomington, MN’’ (comment 13, NPRM); ‘‘Anonymous’’ (comment 20, NPRM). 20 ‘‘Jane Q. Citizen’’ (comment 14, NPRM). 21 In a separate final rule, published elsewhere in this issue of the Federal Register, the Commission is amending the Privacy Rule to reflect changes made by the Dodd-Frank Act, limiting that rule to certain auto dealers. Through that proceeding, the Commission is also removing examples of financial institutions from the Privacy Rule that are no longer covered under the rule in the wake of these changes.

including industry groups, consumer groups, and individual consumers.16 On July 13, 2020, the Commission held a workshop concerning the proposed changes and conducted panels with information security experts discussing subjects related to the Proposed Rule.17 The Commission received 11 comments following the workshop.18 After reviewing the initial comments to the Proposed Rule, conducting the workshop, and then reviewing the comments received following the workshop, the Commission now issues final amendments to the Safeguards Rule.

III. Overview of Final Rule As noted above, the Final Rule modifies the current Rule in five primary ways. First, the Final Rule amends the current Rule to include more detailed requirements for the development and establishment of the information security program required under the Rule. For example, while the current Rule requires financial institutions to undertake a risk assessment and develop and implement safeguards to address the identified risks, the Final Rule sets forth specific criteria for what the risk assessment must include, and requires the risk assessment be set forth in writing. As to particular safeguards, the Final Rule requires that they address access controls, data inventory and classification, encryption, secure development practices, authentication, information disposal procedures, change management, testing, and incident response. And while the Final Rule retains the requirement from the current Rule that financial institutions provide employee training and appropriate oversight of service providers, it adds mechanisms designed to ensure such training and oversight are effective. Although the Final Rule has more specific requirements than the current Rule, it still provides financial institutions the flexibility to design an information security program appropriate to the size and complexity of the financial institution, the nature and scope of its activities, and the sensitivity of any customer information at issue.

Second, the Final Rule adds requirements designed to improve accountability of financial institutions’ information security programs. For example, while the current Rule allows a financial institution to designate one or more employees to be responsible for the information security program, the Final Rule requires the designation of a single Qualified Individual. The Final Rule also requires periodic reports to boards of directors or governing bodies, which will provide senior management with better awareness of their financial institutions’ information security programs, making it more likely the programs will receive the required resources and be able to protect consumer information.

Third, recognizing the impact of the additional requirements on small businesses, the Final Rule exempts financial institutions that collect information on fewer than 5,000 consumers from the requirements of a written risk assessment, incident response plan, and annual reporting to the Board of Directors. Fourth, the Final Rule expands the definition of ‘‘financial institution’’ to include entities engaged in activities the Federal Reserve Board determines to be incidental to financial activities. This change brings ‘‘finders’’—companies that bring together buyers and sellers of a product or service—within the scope of the Rule. Finders often collect and maintain very sensitive consumer financial information, and this change will require them to comply with the Safeguards Rule’s requirements to protect that information. This change will also bring the Rule into harmony with other Federal agencies’ Safeguards Rules, which include activities incidental to financial activities in their definition of financial institution. Finally, the Final Rule includes several definitions and related examples, including of ‘‘financial institution,’’ in the Rule itself rather than incorporate them from a related FTC rule, the Privacy of Consumer Financial Information Rule, 16 CFR part 313. This will make the rule more selfcontained and will allow readers to understand its requirements without referencing the Privacy Rule. IV. Section-by-Section Analysis General Comments The Commission received 49 comments in response to the NPRM for the Proposed Rule, from a diverse set of stakeholders, including industry groups, individual businesses, consumer advocacy groups, academics, information security experts, government agencies, and individual consumers. It also hosted a workshop on the Proposed Rule, which included approximately 20 security experts. Some of the comments simply expressed general support 19 or general disapproval 20 of the Proposed Rule. Many, however, offered detailed responses to specific proposals in the NPRM. In general, industry groups were opposed to most or all of the Proposed Rule, and consumer advocacy groups, academics, and security experts were generally in favor of the amendments. The comments and workshop record are discussed in the following Section-by- Section analysis.

Sec. 314.1: Purpose and Scope The Purpose and Scope section of the current Rule generally states the Rule implements the Gramm-Leach-Bliley Act and applies to the handling of customer information by financial institutions over which the FTC has jurisdiction. In its NPRM, the Commission proposed adding a definition of ‘‘financial institution’’ modeled on the definition included in the Commission’s Privacy Rule (16 CFR part 313) and a series of examples providing guidance on what constitutes a financial institution under the Commission’s jurisdiction. Other than expanding the definition of ‘‘financial institution’’ as discussed below, the new language was not meant to reflect a substantive change to the Safeguards Rule; rather, it was meant to allow the Rule to be read on its own, without reference to the Privacy Rule.21 The Commission received no comments that addressed this section specifically, and VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 200

70274 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 22 Several commenters addressed the change to the definition of ‘‘financial institution.’’ Those comments are addressed in the discussion of the definition of ‘‘financial institution’’ below. 23 American Council on Education (comment 24, NPRM), at 7.

24 HITRUST, (comment 18, NPRM), at 2. 25 National Automobile Dealers Association (comment 46, NPRM), at 11–12. 26 National Automobile Dealers Association (comment 46, NPRM), at 11–12. 27 Money Services Round Table (comment 53, NPRM), at 5 n.14.

28 National Independent Automobile Dealers Association (comment 48, NPRM), at 4; National the Commission adopts the language of the Proposed Rule in the Final Rule.22 Sec. 314.2: Definitions The Proposed Rule added a number of definitions to § 314.2. The Proposed Rule also retained paragraph (a), which states terms used in the Safeguards Rule have the same meaning as set forth in the Privacy Rule.

The American Council on Education (ACE) suggested all terms from the Privacy Rule, such as ‘‘consumer,’’ ‘‘customer,’’ and ‘‘customer information,’’ be included in the Final Rule in order to make the Final Rule easier for regulated entities to understand.23 On the other hand, HITRUST recommended no definitions from the Privacy Rule be duplicated in the Safeguards Rule, reasoning that in the event of a need to amend the terms, it would require the amendment of two rules rather than one.24 The Commission is persuaded including all terms from the Privacy Rule within the Safeguards Rule will improve clarity and ease of use. Accordingly, the Commission has determined to delete paragraph (a), since it is no longer necessary to state all terms in the Safeguards Rule have the same meaning as in the Privacy Rule. It also adds the Privacy Rule definitions of ‘‘consumer,’’ ‘‘customer,’’ ‘‘customer relationship,’’ ‘‘financial product or service,’’ ‘‘nonpublic personal information,’’ ‘‘personally identifiable financial information,’’ ‘‘publicly available information,’’ and ‘‘you’’ to the definitions in the Final Rule. No substantive change to these definitions is intended. Authorized User The Proposed Rule added a definition for the term ‘‘authorized user’’ as paragraph (b). Proposed paragraph (b) defined an authorized user of an information system as any employee, contractor, agent or other person that participates in your business operations and is authorized to access and use any of your information systems and data. This term was used in § 314.4(c)(10) of the Proposed Rule, which required financial institutions to implement policies to monitor the activity of ‘‘authorized users’’ and detect unauthorized access to customer information.

The Commission received one comment on this proposed definition from the National Automobile Dealers Association (NADA), which suggested the term ‘‘authorized user’’ was used inconsistently and was too vague.25 NADA pointed out while ‘‘authorized user’’ is a defined term, the term ‘‘authorized individual’’ was used in proposed § 313.4(c)(1) (addressing access controls for information systems) and (c)(3) (addressing access controls for physical data). NADA also argued the inclusion of ‘‘other person that participates in the business operations of an entity’’ within the definition of ‘‘authorized user’’ was unclear and created ambiguity in its application.26 The Commission agrees with NADA’s points, and, in response, modifies the Final Rule in two ways. First, the Final Rule replaces the term ‘‘authorized individual’’ with ‘‘authorized user’’ in § 313.4(c)(1). As described further below, because the Final Rule combines § 313.4(c)(3) with § 313.4(c)(1), there is no need to make a corresponding change to that section. Second, because the Commission agrees the ambiguities in the definition of ‘‘authorized user’’ from the Proposed Rule could create confusion, it makes several changes to the definition. It deletes the phrase ‘‘other person that participates in the business operations of an entity.’’ The Commission agrees this phrase was vague. The Commission had intended it to cover any person the financial institution allows to access information systems or data, including, for example, ‘‘customers’’ of the financial institutions. For the purpose of controlling authorized access and detecting unauthorized access (which is where the definition of ‘‘authorized user’’ appears), financial institutions should monitor anomalous patterns of usage of their systems, not only by employees and agents, but also by customers and other persons authorized to access systems or data. To clarify this point, the Commission adds ‘‘customer or other person’’ to the definition of ‘‘authorized users.’’ The Commission intends that the definition of ‘‘authorized users’’ should include anyone who the financial institution authorizes to access an information system or data, regardless of whether that user actually uses the data. Thus, for clarity, the Commission has deleted the requirement that the authorized user be authorized to use the information system or data. Finally, the definition of authorized user should include users who can access both ‘‘information systems and data’’ and users authorized to access either information systems or data. Accordingly, for clarification purposes, the Commission modifies the definition of authorized user in the Final Rule as any employee, contractor, agent, customer or other person that is authorized to access any of your information systems or data. Security Event In proposed paragraph (c), the Commission defined security event as an event resulting in unauthorized access to, or disruption or misuse of, an information system or information stored on such information system. This term was used in provisions requiring financial institutions to establish a written incident response plan designed to respond to security events. It also appeared in the provision requiring the coordinator of a financial institution’s information security program to provide an annual report to the financial institution’s governing body; the required report must identify all security events that took place that year. Commenters expressed three main concerns with this definition. The first relates to whether the term ‘‘security event’’ should be expanded to instances in which there is unauthorized access to, or disruption or misuse of, information in physical form, as opposed to electronic form. The Proposed Rule used the term ‘‘security event’’ instead of ‘‘cybersecurity event’’ to clarify that an information security program encompasses information in both digital and physical forms and that unauthorized access to paper files, for example, would also be a security event under the Rule. The Money Services Round Table (MSRT), however, noted despite the use of the more general ‘‘security’’ in the defined term, the definition itself is limited to events involving information systems.27 The Commission agrees this creates a contradiction. Accordingly, the Final Rule includes the compromise of customer information in physical form in the definition of ‘‘security event.’’ Second, some industry groups argued a ‘‘security event’’ should occur only when there is ‘‘unauthorized access’’ to an information system, not in cases in which there has been a ‘‘disruption or misuse’’ of such systems (e.g., a ransomware attack).28 These VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 201

70275 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations Automobile Dealers Association (comment 46, NPRM), at 12–13; Consumer Data Industry Association (comment 36, NPRM), at 3–4. 29 National Independent Automobile Dealers Association (comment 48, NPRM), at 4; National Automobile Dealers Association (comment 46, NPRM), at 12–13.

30 HITRUST (comment 18, NPRM), at 3; American Council on Education (comment 24, NPRM), at 7; Mortgage Bankers Association (comment 26, NPRM), at 4–5; Consumer Data Industry Association (comment 36, NPRM), at 3–4; National Automobile Dealers Association (comment 46, NPRM), at 12–13; National Independent Automobile Dealers Association (comment 48, NPRM), at 4.

31 Mortgage Bankers Association (comment 48, NPRM), at 4–5; National Automobile Dealers Association (comment 46, NPRM), at 12–13; National Independent Automobile Dealers Association (comment 48, NPRM) at 4; American Council on Education (comment 24, NPRM), at 7. 32 National Automobile Dealers Association (comment 46, NPRM), at 13. 33 American Council on Education (comment 24, NPRM), at 7; Princeton University Center for Information Technology Policy (comment 54, NPRM), at 4.

34 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 4. 35 American Council on Education (comment 24, NPRM), at 7.

commenters argued the disruption or misuse of information systems is not directly related to the protection of customer information and is, therefore, outside the Commission’s statutory authority.29 The Commission disagrees. Requiring a financial institution to protect against disruption and misuse of its information system is within the Commission’s authority under the GLBA, which directed the Commission to promulgate a rule that required financial institutions to ‘‘to protect against any anticipated threats or hazards to the security or integrity’’ of customer information. A disruption or misuse of an information system will be, in many cases, a threat to the ‘‘integrity’’ of customer information. In addition, disruption or misuse may also indicate the existence of a security weakness that could be exploited to gain unauthorized access to customer information. For example, an event in which ransomware placed on a system is used to encrypt customer information, rendering it useless, raises the possibility similar software could have been used to exfiltrate customer information. Accordingly, the Final Rule retains the inclusion of ‘‘misuse or disruption’’ within the definition of ‘‘security event.’’ Third, several commenters suggested the definition of ‘‘security event’’ be limited to events in which there is a risk of consumer harm or some other negative effect.30 Similarly, some commenters argued the definition should exclude events that involve encrypted information in which the encryption key was not compromised or when there is evidence the information accessed has not been misused.31 The Commission declines to narrow the provision in this manner. It believes a financial institution should still engage in its incident response procedures to determine whether the event indicates a weakness that could endanger customer information and to respond accordingly. The financial institution can then take the appropriate steps in response. Further, § 314.4(h) of the Final Rule, which sets forth the requirement for an incident response plan, requires the incident response plan be designed to respond only to security events ‘‘materially affecting the confidentiality, integrity, or availability of customer information,’’ limiting the impact of the definition of ‘‘security event.’’ Accordingly, the Final Rule defines security event as an event resulting in unauthorized access to, or disruption or misuse of, an information system, information stored on such information system, or customer information held in physical form. The Proposed Rule placed this definition as paragraph (c), out of alphabetical order. The Final Rule adopts it as paragraph (p), placing it in alphabetical order with the other definitions in § 314.2.

Encryption Proposed paragraph (e) defined encryption as the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key. This term was used in proposed § 314.4(c)(4), which generally required financial institutions to encrypt customer information. This definition was intended to define the process of encryption while not requiring any particular technology or technique for achieving the protection provided by encryption.

NADA argued this definition should be made more flexible by adding an alternative so it would read ‘‘the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key or securing information by another method that renders the data elements unreadable or unusable’’ (emphasis added).32 On the other hand, others argued the Proposed Rule’s definition did not sufficiently protect customer information.33 For example, the Princeton University Center for Information Technology Policy (‘‘Princeton Center’’) suggested the Rule should be changed ‘‘to clarify that encryption must be consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material.’’ 34 Similarly, ACE argued the definition should include ‘‘the transformation of data in accordance with industry standards.’’ 35 The Commission agrees the proposed definition should be tethered to some technical standard, without being too prescriptive about what that standard is. Under the proposed definition, as well as NADA’s proposed definition, financial institutions could have claimed they were ‘‘encrypting’’ data if they were aggregating it, scrambling it, or redacting it in a way that made it possible to re-identify the data through, for example, the application of common algorithms or programs. The Commission does not believe this would have provided consumers with sufficient protection. The Commission also agrees with the commenters who stated the definition should signal that encryption should be cryptographically based.

Accordingly, the Final Rule defines encryption as the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material. This definition does not require any specific process or technology to perform the encryption but does require that whatever process is used be sufficiently robust to prevent the deciphering of the information in most circumstances. Financial Institution Incidental Activity The Proposed Rule made one substantive change to the definition of ‘‘financial institution’’ it incorporated from the Privacy Rule. The change was designed to include entities ‘‘significantly engaged in activities that are incidental to [] financial activity’’ as defined by the Bank Holding Company Act. This proposed change brought only one activity into the definition that was not covered before: the act of ‘‘finding’’ as defined in 12 CFR 225.86(d)(1). The proposed revision to paragraph (f) added an example of a financial institution acting as a finder by ‘‘bringing together one or more buyers and sellers of any product or service for transactions that the parties themselves negotiate and consummate.’’ This example used the language set forth in 12 CFR 225.86(d)(1), which defines ‘‘finding’’ as an activity incidental to a financial activity under the Bank Holding Company Act. The Commission VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 202

70276 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 36 See 12 CFR 1016.3(l) (defining ‘‘financial institution’’ for entities regulated by agencies other than the FTC). See also 17 CFR 248.3(n) (defining ‘‘financial institution’’ to include ‘‘any institution the business of which is . . . incidental to . . . financial activities’’ for Security and Exchange Commission’s rule implementing GLBA’s safeguard provisions.).

37 15 U.S.C. 6801 et seq. 38 15 U.S.C. 6809(3).

39 12 U.S.C. 1843(k).

40 12 CFR 225.86.

41 Electronic Privacy Information Center (comment 55, NPRM), at 9; Independent Community Bankers of America (comment 35, NPRM), at 3; National Automobile Dealers Association (comment 46, NPRM), at 13–16. 42 Association of National Advertisers (comment, Workshop), at 4–5; internet Association (comment, Workshop), at 4–5; see also Anonymous (comment 15, NPRM) (questioning whether any governing body would oversee any future determinations by the Federal Reserve Board that activities are incidental to financial activity). 43 Association of National Advertisers (comment 5, Workshop), at 5.

44 12 CFR 225.86 (d).

45 12 CFR 225.86 (d)(1)(i). 46 See Final Rule 16 CFR 314.2(b)(1). 47 16 CFR 314.1; Final Rule 16 CFR 314.2(c). 48 National Pawnbrokers Association (comment 32, NPRM), at 5–6 (arguing that transactionreporting vendors be included in definition); National Consumer Law Center and others (comment 58, NPRM), at 5 (arguing that consumer reporting agencies be included explicitly in the definition); see also American Escrow Association (comment, Workshop), at 2–3 (requesting that the Rule specifically set out the duties of real estate settlement operations and other businesses that handle but do not maintain sensitive information); Beverly Enterprises, LLC (comment 3, NPRM), at 3– 4 (requesting that the Rule specifically set out duties related to online notarizations); Yangxue Li (comment 5, NPRM) (asking whether Rule would set forth specific guidelines for different industries); Slobadon Raybolka (comment 17, NPRM) (suggesting that companies that perform online background checks be covered by the rule); The Clearing House (comment 49, NPRM) (suggesting a separate set of more stringent rules for fintech companies).

49 Electronic Privacy Information Center (comment 55, NPRM), at 9. 50 See 15 U.S.C. 6801 (requiring agencies to promulgate Rule establishing standards for financial institutions); 15 U.S.C. 6809(3) (defining ‘‘financial institutions’’ as an ‘‘institution the business of which is engaging in financial activities as described’’ in the Bank Holding Company Act). 51 In the Matter of Facebook, Inc., Docket No. C– 4365 (Apr. 28, 2020); FTC v. Wyndham Worldwide Corporation, 799 F.3d 236 (3d Cir. 2015); FTC v. D- Link Systems, Inc., Case No. 3:17–cv–00039–JD (N.D. Cal. July 2, 2019); In the Matter of Twitter, Inc., Docket No. C–4316 (Mar. 11, 2011). 52 National Federation of Independent Business (comment 16, NPRM), at 2–3. 53 Privacy Rule, Final Rule, 65 FR 33645 (May 24, 2000) at 33656.

adopts this proposal without modification.

The change to the definition of ‘‘financial institution’’ brings it into harmony with other agencies’ GLB rules.36 The change is supported by the language of the Gramm-Leach-Bliley Act.37 The Act defines a ‘‘financial institution’’ as any institution ‘‘the business of which is engaging in financial activities as described in section 1843(k) of title 12.’’ 38 That section, in turn, describes activities that are financial in nature as those the Board has determined ‘‘to be financial in nature or incidental to such financial activity.’’ 39 The Final Rule’s definition mirrors this language. The change will not lead to a significant expansion of the Rule coverage as it expands the definition only to include entities engaged in activity incidental to financial activity, as determined by the Federal Reserve Board. The Board has determined only one activity to be incidental to financial activity—‘‘acting as a finder.’’ 40 Several commenters who addressed this issue supported the inclusion of activities incidental to financial activities.41 Other commenters expressed concern the proposed change in the definition would expand the Rule’s coverage to businesses that should not be considered financial institutions.42 They argued the definition of the term ‘‘finder’’ is too broad and companies that connect buyers and sellers in non-financial contexts would be swept inappropriately into the definition of ‘‘financial institution.’’ The Association of National Advertisers argued advertising agencies could be considered ‘‘finders’’ because they play a role in connecting buyers and sellers.43 In response, the Commission notes the Federal Reserve Board describes acting as a finder as ‘‘bringing together one or more buyers and sellers of any product or service for transactions that the parties themselves negotiate and consummate.’’ 44 The Board sets forth several activities within the scope of acting as a finder, such as ‘‘[i]dentifying potential parties, making inquiries as to interest, introducing and referring potential parties to each other, [] arranging contacts between and meetings of interested parties’’ and ‘‘[c]onveying between interested parties expressions of interest, bids, offers, orders and confirmations relating to a transaction.’’ 45 Although this language is somewhat broad, its scope is significantly limited in the context of the Safeguards Rule. First, the Safeguards Rule applies only to transactions ‘‘for personal, family, or household purposes.’’ 46 Therefore, only finding services involving consumer transactions will be covered. Second, the Safeguards Rule applies only to the information of customers, which are consumers with which a financial institution has a continuing relationship.47 Therefore, it will not apply to finders that have only isolated interactions with consumers and do not receive information from other financial institutions about those institutions’ customers. This significantly narrows the types of finders that will have obligations under the Rule, excluding, the Commission believes, most advertising agencies and similar businesses that generally do not have continuing relationships with consumers who are using their services for personal or household purposes. The Commission believes entities that perform finding services for consumers with whom they have an ongoing relationship are properly considered ‘‘financial institutions’’ for purposes of the Rule. Accordingly, the Commission adopts the changes to the definition of ‘‘financial institution’’ as proposed. Other Changes to Definition of ‘‘Financial Institutions’’ Other commenters suggested modifying the definition of ‘‘financial institution’’ 48 in different ways. The Electronic Privacy Information Center (EPIC) argued the definition should be expanded by treating more activities as financial activities.49 EPIC pointed out information shared with social media companies, retailers, apps, and devices generally is not covered under the Safeguards Rule. The Commission understands the concern that many businesses fall outside the coverage of the Safeguards Rule, despite handling sensitive consumer information, but the Commission’s authority to regulate activity under the Safeguards and Privacy Rules is established by the GLBA. The Rule’s application is limited to financial institutions as defined by that statute and cannot be extended beyond that definition.50 The institutions discussed by EPIC, however, are still covered by the FTC Act’s prohibition against deceptive or unfair conduct, including with respect to their use and protection of consumer information.51 The National Federation of Independent Business (NFIB) argued individuals and sole proprietors should be excluded from the definition of ‘‘financial institution’’ because an individual cannot be an ‘‘institution.’’ 52 When the Privacy Rule was promulgated in 2000, commenters also suggested the definition should exclude sole proprietors.53 The Commission noted there was no basis to exclude sole proprietors and ‘‘[w]hether or not a VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 203

70277 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 54 Money Services Round Table (comment 53, NPRM), at 5–6.

55 Id. at 5.

56 Final Rule § 314.2(j). 57 Indeed, Workshop participant Scott Wallace noted, in conducting penetration testing, ‘‘the first thing [he does]’’ is generally to ‘‘prepare for the phishing campaign.’’ Remarks of Scott Wallace, Safeguards Workshop Tr., supra note 17, at 131–32. 58 Money Services Round Table (comment 53, NPRM), at 5; Consumer Data Industry Association (comment 36, NPRM), at 4; American Council on Education (comment 24, NPRM), at 7–8. 59 See Remarks of Serge Jorgensen, Safeguards Workshop Tr., supra note 17, at 58–59 (noting cybersecurity attacks can take advantage of systems that are connected to the systems in which sensitive information is stored); Remarks of Tom Dugas, Safeguards Workshop Tr., supra note 17, at 138 (noting a vulnerability in one system can result in the exposure of information maintained in another system); see also Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 106–07 (noting the heightened importance of encryption in a context where numerous systems are connected); Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 107–08 (same). 60 Section 314.4(c)(5) in the Final Rule. 61 Electronic Transactions Association (comment 27, NPRM), at 4; U.S. Chamber of Commerce (comment 33, NPRM), at 9; CTIA (comment 34, NPRM), at 7–9; Global Privacy Alliance (comment 38, NPRM), at 9; National Automobile Dealers Association (comment 46, NPRM), at 29; National Independent Automobile Dealers Association (comment 48, NPRM), at 6. 62 See, e.g., NIST Special Publication 800–63B, Digital Identity Guidelines, 5.1.3.3 (restricting use of verification using the Public Switched Telephone Network (SMS or voice) as an ‘‘out-of-band’’ factor for multi-factor authentication). 63 See, e.g., Remarks of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 231–32. commercial enterprise is operated by a single individual is not determinative’’ of whether the enterprise is a financial institution. The Commission has not changed its position on this matter and declines to make this change to the definition of ‘‘financial institution.’’ The Final Rule adopts this definition as proposed without change. Information Security Program Paragraph (i) of the Final Rule adopts the existing Rule’s paragraph (c) and does not alter the definition of ‘‘information security program.’’ The Commission received no comments on this definition, and accordingly, adopts the current definition in the Final Rule. Information System Proposed paragraph (h) defined information system as a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/ process controls systems, telephone switching and private branch exchange systems, and environmental control systems. The term ‘‘information system’’ was used throughout the proposed amendments to designate the systems that must be covered by the information security program.

The MSRT suggested this definition was too narrow in some respects and too broad in others.54 It argued the definition of ‘‘information system’’ was too narrow because it did not include physical systems or employees and would exclude them from some of the provisions of the Rule. Specifically, the MSRT argued that based on this definition, the penetration tests required by § 314.4(d)(2) would not be required to test ‘‘potential human vulnerabilities’’ such as social engineering or phishing.55 The Commission does not agree. Penetration testing, as defined by the Final Rule, is a process through which testers ‘‘attempt to circumvent or defeat the security features of an information system.’’ 56 One way such security features are tested is through social engineering and phishing.57 The fact that the testing involves employees with access to the information system, rather than just the system itself, does not exclude such tests from the definition of ‘‘penetration testing.’’ Attempted social engineering and phishing are important parts of testing the security of information systems and would not be excluded by this definition. The MSRT also argued the definition was too broad, and was joined by other commenters in this concern.58 These commenters shared a concern the proposed definition would include systems that are in no way connected to customer information and would require financial institutions to include all systems in their possession, regardless of their involvement with customer information. The Commission agrees the definition should be limited to those systems that either contain customer information or are connected to systems that contain customer information, and adds that limitation to the Final Rule. The Rule does not limit the definition to only those systems that contain customer information, because a common source of data breaches is a vulnerability in a connected system that an attacker exploits to gain access to the company’s network and move within the network to obtain access to the system containing sensitive information.59 Accordingly, the definition of information system in the Final Rule is modified to a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information containing customer information or any such system connected to a system containing customer information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental controls systems, that contains customer information or that is connected to a system that contains customer information.

Multi-Factor Authentication Proposed paragraph (i) defined multifactor authentication as authentication through verification of at least two of the following types of authentication factors: Knowledge factors, such as a password; possession factors, such as a token; or inherence factors, such as biometric characteristics. This term was used in proposed § 314.4(c)(6),60 which required financial institutions to implement multi-factor authentication for individuals accessing networks that contain customer information. Several commenters argued the definition should explicitly include SMS text messages as an acceptable example of a possession factor or otherwise to be explicitly allowed.61 The Proposed Rule did not include SMS text messages as an example of a possession factor.62 Most commenters who addressed this issue interpreted this exclusion from the examples as forbidding financial institutions from using SMS text messages as a possession factor for multi-factor authentication. That is not the effect of this exclusion, however. The language of the definition neither prohibits nor recommends use of SMS text messages. Indeed, SMS text messages are not addressed at all. In some cases, use of SMS text messages as a factor may be the best solution because of its low cost and easy use, if its risks do not outweigh those benefits under the circumstances.63 In other instances, however, the use of SMS text messages may not be a reasonable solution, such as when extremely sensitive information can be obtained through the access method being controlled, or when a more secure method can be used for a comparable price. A financial institution will need to evaluate the balance of risks for its situation. If, however, the Commission were to explicitly allow use of SMS text messages, this could be considered a safe harbor that would not require the company to consider risks associated with use of SMS text as a factor in a particular use case. Accordingly, the Final Rule does not include SMS text VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 204

70278 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 64 Princeton University Center for Information Technology Policy (comment 54, NPRM) at 9–10. 65 See 16 CFR 313.3(o)(1). 66 16 CFR 313.3(o)(2)(i)(F). 67 See, e.g., New York Department of Financial Service (comment 40, NPRM), at 1 (arguing the Proposed Rule would ‘‘further advance efforts to protect financial institutions and consumers from cybercriminals.’’); Princeton University Center for Information Technology Policy (comment 54, NPRM), at 1 (stating the Proposed Rule ‘‘would significantly reduce data security risks for the customers of financial institutions.’’); National Consumer Law Center and others (comment 58, NPRM), at 2 (stating requirements of Proposed Rule are ‘‘reasonable and common-sense measures that any company dealing with large amounts of consumer personal information should take.’’). 68 See, e.g., HITRUST (comment 18, NPRM), at 1– 2; American Council on Education (comment 24, NPRM), at 2–4; Cristian Munarriz (comment 21, NPRM); Electronic Transactions Association (comment 27, NPRM), at 1–2; National Pawnbrokers Association (comment 32, NPRM), at 3; CTIA (comment 34, NPRM), at 5; Consumer Data Industry Association (comment 36, NPRM), at 2; Wisconsin Bankers Association (comment 37, NPRM), at 1–2; Global Privacy Alliance (comment 38, NPRM), at 5– 6; Bank Policy Institute (comment 39, NPRM), at 2; American Financial Services Association (comment 41, NPRM), at 4; National Association of Dealer Counsel (comment 44, NPRM), at 1; ACA International, (comment 45, NPRM), at 4; National Automobile Dealers Association (comment 46, NPRM), at 11; National Independent Automobile Dealers Association (comment 48, NPRM), at 2–3; Money Services Round Table (comment 53, NPRM), at 1–4; Software & Information Industry Association (comment 56, NPRM), at 1–3; Gusto and others (comment 11, Workshop), at 2; Association of National Advertisers (comment 5, Workshop), at 1– 3; internet Association (comment 9, Workshop), at 2–3.

69 Electronic Transactions Association (comment 27, NPRM), at 1–2.

70 CTIA (comment 34, NPRM), at 5. messages in the examples of possession factors.

The final Rule adopts the proposed definition of ‘‘multi-factor authentication’’ without change as paragraph (k) of this section. Penetration Testing Proposed paragraph (j) defined penetration testing as a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems. This term was used in proposed § 314.4(d)(2), which required financial institutions to continually monitor the effectiveness of their safeguards or to engage in annual penetration testing. The Commission received no comments concerning this definition. The Final Rule adopts the definition from the Proposed Rule as paragraph (m) of this section. Personally Identifiable Financial Information To minimize cross-referencing to the Privacy Rule, as noted above, the Commission is adding several definitions to the Final Rule. One of these definitions is ‘‘personally identifiable financial information,’’ which is identical to the definition currently contained in the Privacy Rule. This term is included within the ambit of ‘‘customer information,’’ in both the existing Rule and the Final Rule. The Princeton Center suggested expanding the definition of ‘‘personally identifiable financial information’’ from the Privacy Rule to include ‘‘aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.’’ 64 The Princeton Center further suggested clarifying that, for information to not be considered ‘‘personally identifiable financial information,’’ the financial institution must be required to demonstrate the information is not ‘‘reasonably linkable’’ to individuals.

The Commission does not believe this amendment is necessary. The definition of ‘‘personally identifiable financial information’’ is already a broad one.65 It includes not just information associated with types of personal information such as a name or address or account number, but also information linked to a persistent identifier (‘‘any information you collect through an Internet ‘cookie’ (an information collecting device from a web server’’)).66 While there may be some merit to limiting the exception for aggregate information or blind data to data that cannot be reasonably linkable to an individual, for purposes of a rule that can be periodically updated to keep up with changing technology, the current approach is more concrete and enforceable, and less subject to differences in interpretation. Service Provider Proposed paragraph (k) adopted the existing Rule’s definition and does not alter the definition of ‘‘service provider.’’ The Commission received no comments on this definition and adopts it as paragraph (q) of the Final Rule. Sec. 314.3: Standards for Safeguarding Customer Information Proposed § 314.3, which required financial institutions to develop an information security program (paragraph (a)) and set forth the objectives of the Rule (paragraph (b)), was largely identical to the existing Rule. It changed only the requirement that ‘‘safeguards’’ be based on the elements set forth in § 314.4, by replacing ‘‘safeguards’’ with ‘‘information security program.’’ The Commission received no comments on this proposal and adopts it without change in the Final Rule. Sec. 314.4: Elements Proposed § 314.4 altered the current Rule’s required elements of an information security program and added several new elements.

General Comments The Commission received many comments addressing the new elements, both in favor of the changes and opposed to them. The comments in favor of the changes generally argued these changes would protect consumers by improving the data security of institutions that hold their information.67 Most of the comments opposed to the proposed elements fell into several categories, objecting: (1) The proposed changes were too prescriptive and did not allow financial institutions sufficient flexibility in managing their information security; (2) the proposed amendments would be too expensive for financial institutions, particularly smaller institutions, to adopt; and (3) some of the requirements should not apply to all customer information but should be limited to some subset of especially ‘‘sensitive’’ customer information. The Commission does not agree with these comments for the reasons discussed below, and accordingly, retains the general approach of the Proposed Rule in the Final Rule.

Flexibility Many industry groups argued the new proposed elements were too prescriptive, lacked flexibility, would quickly become outdated, and would force financial institutions to engage in activities that would not enhance security.68 For example, the Electronics Transactions Association argued the Proposed Rule would ‘‘limit the ability of industry to develop new and innovative approaches to information security.’’ 69 Similarly, CTIA commented the Proposed Rule would create a ‘‘prescriptive core of requirements that covered businesses must follow, irrespective of whether risk assessments show they are necessary.’’ 70 The Commission, however, believes the elements provide sufficient flexibility for financial institutions to adopt information security programs suited to the size, nature, and complexity of their organization and information systems. The elements for the information security programs set forth in this section are high-level principles that set forth basic issues the VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00008 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 205

70279 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 71 American Council on Education (comment 24, NPRM), at 13–14; Wisconsin Bankers Association (comment 37, NPRM), at 1–2; American Financial Services Association (comment 41, NPRM), at 4; National Association of Dealer Counsel (comment 44, NPRM), at 1; National Automobile Dealers Association (comment 46, NPRM), at 11; National Independent Automobile Dealers Association, (comment 48, NPRM), at 3; Gusto and others (comment 11, Workshop), at 2–4; National Pawnbrokers Association (comment 3, NPRM), at 2; see also Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 72–74 (describing study that found compliance would be expensive for automobile dealers).

72 See, e.g., Slides Accompanying Remarks of James Crifasi, FTC, ‘‘NADA Cost Study: Average Cost Per U.S. Franchised Dealership,’’ Event Materials, Information Security and Financial Institutions: An FTC Workshop to Examine Safeguards Rule (July 13, 2020) https://www.ftc.gov/ system/files/documents/public_events/1567141/ slides-glb-workshop.pdf (hereinafter Safeguards Workshop Slides), at 25 (estimating an upfront cost of $293,975 per dealership, and an recurring annual cost of $276,925); see also Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 72–75; Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 78 (estimating the average annual salary of a CISO can range from $180,000 to upwards of $400,000); Slides Accompanying Remarks of Lee Waters, ‘‘Estimated Costs of Proposed Changes,’’ Safeguards Workshop Slides, at 26 (estimating the annual costs of a security program to include: Multi-factor authentication, $50 for smart card readers, and $10 each for smart cards; a CISO, either an in-house CISO, $180,000, an in-house cybersecurity analyst, $76,000, or an outsourced cybersecurity contractor, between $120,000 and $240,000; penetration testing, average cost $4,800; and physical security, $215,000 for construction, and $10,000 to $20,000 for new or upgraded locks); see also Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 75–76.

73 See, e.g., Slides Accompanying Remarks of Lee Waters, ‘‘Estimated Costs of Proposed Changes,’’ Safeguards Workshop Slides, supra note 72, at 26 (estimating costs of an in-house CISO to be $180,000 annually, and an in-house cybersecurity analyst to be $76,000 annually; and estimating an outsourced cybersecurity contractor would cost between $120,000 to $240,000 annually); see also Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 75–76; Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 78 (estimating that the average annual salary of a CISO can range from $180,000 to upwards of $400,000).

74 See Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 119–20 (noting when small businesses have to spend money to hire third-party vendors and security experts to comply with regulations, that affects consumer prices and small business profit margins); Slides Accompanying Remarks of James Crifasi, ‘‘NADA Cost Study: Average Cost Per U.S. Franchised Dealership,’’ Safeguards Workshop Slides, supra note 72, at 25; see also Remarks of James Crifasi, supra note 17, at 73 (noting the requirements ‘‘start becoming a little bit unaffordable here.’’). 75 The Small Business Administration’s Office of Advocacy commented it was concerned the FTC had not gathered sufficient data as to either the costs or benefits of the proposed changes for small financial institutions. Office of Advocacy, U.S. Small Business Administration (comment 28, NPRM), at 3–4. The FTC shares the Office of Advocacy’s interest in ensuring that regulatory changes have an evidentiary basis. Many of the questions on which the FTC sought public comment, both in the regulatory review and in the proposed Rule context, specifically related to the costs and benefits of existing and proposed Rule requirements. Following the initial round of commenting, the Commission conducted the FTC Safeguards Workshop and solicited additional public comments with the explicit goal of gathering additional data relating to the costs and benefits of the proposed changes. See Public Workshop Examining Information Security for Financial Institutions and Information Related to Changes to the Safeguards Rule, 85 FR 13082 (Mar. 6, 2020). As detailed throughout this document, the Commission believes there is a strong evidentiary basis for the issuance of the final Rule. 76 16 CFR 314.3.

77 16 CFR 314.4.

78 Several speakers at the Safeguards Workshop also raised this concern. See, e.g., Slides Accompanying Remarks of James Crifasi, ‘‘NADA Cost Study: Average Cost Per U.S. Franchised Dealership,’’ in Safeguards Workshop Slides, supra note 72, at 25 (estimating appointing a CISO to increase program accountability would be a onetime, up-front cost of $27,500, with a recurring annual cost of $51,000); Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 72–75; Slides Accompanying Remarks of Lee Waters, ‘‘Estimated Costs of Proposed Changes,’’ in Safeguards Workshop Slides, supra note 72, at 26 (estimating costs of an in-house CISO to be $180,000 annually, and an in-house cybersecurity analyst to be $76,000 annually; and estimating that an outsourced cybersecurity contractor would cost between $120,000 to $240,000 annually); Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 75–76; Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 78 (estimating that the average annual salary of a CISO can range from $180,000 to upwards of $400,000). programs must address, and do not prescribe how they will be addressed. For example, the requirement that the information security program be based on a risk assessment sets forth only three general items the assessment must address: (1) Criteria for evaluating risks faced by the financial institution; (2) criteria for assessing the security of its information systems; and (3) how the identified risks will be addressed. Other than meeting these basic requirements, financial institutions are free to perform their risk assessments in whatever way they choose, using whatever method or approach works best for them, as long as the method identifies reasonably foreseeable risks. The other elements are similarly flexible. The two elements that are more prescriptive, encryption and multi-factor authentication, allow financial institutions to adopt alternative solutions when necessary. Comments concerning individual elements are addressed separately in the more detailed analysis below. Cost Another common theme among the comments from industry groups was the proposed information security program elements would be prohibitively expensive, especially for smaller businesses.71 Commenters argued the Proposed Rule would have required financial institutions to implement expensive changes to their systems and hire highly-compensated professionals to do so.72 Industry groups were particularly concerned about the requirement that financial institutions designate a single qualified individual to coordinate their information security programs, arguing this would require hiring professionals that were both expensive, with salaries of more than $100,000 suggested by some, and in limited supply.73 Overall, several commenters argued some financial institutions would be unable to afford to bring themselves into compliance with the Proposed Rule.74 The Commission recognizes properly securing information systems can be an expensive and technically difficult task. However, the Commission believes the additional costs imposed by the Proposed Rule are mitigated for several reasons and, ultimately, those costs are justified in order to protect customer information as required by the GLBA.75 First, for almost 20 years, financial institutions have been required under the current Safeguards Rule to have information security programs in place. The current Safeguards Rule requires financial institutions to ‘‘develop, implement, and maintain a comprehensive [written] information security program . . . appropriate to [the financial institutions’] size and complexity, the nature and scope of [their] activities, and the sensitivity of any customer information at issue.’’ 76 This comprehensive program must be coordinated by one or more individuals and based on a risk assessment.77 As such, financial institutions complying with the current Rule will not be required to establish an information security program from scratch. Instead, they can compare their existing programs to the revised Rule, and address any gaps. The Commission believes many of the requirements set forth in the Final Rule are so fundamental to any information security program that the information security programs of many financial institutions will already include them if those programs are in compliance with the current Safeguards Rule.

Second, a number of commenters who raised concerns about the costs imposed by the Rule believed the Proposed Rule would have required the hiring of a highly-compensated expert to serve as a Chief Information Security Officer (CISO).78 It is correct the Proposed Rule would have modified the current requirement of designating an ‘‘employee or employees to coordinate your information security program’’ by requiring the designation of a single qualified individual responsible for VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00009 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 206

70280 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 79 See, e.g., Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 89–90 (noting the size of a financial institution and the amount and nature of the information it holds factor into an appropriate information security program); see also Slides Accompanying Remarks of Rocio Baeza, ‘‘Models for Complying to the Safeguards Rule Changes,’’ in Safeguards Workshop Slides, supra note 72, at 27–28 (describing three different compliance models: In-house, outsource, and hybrid, with costs ranging from $199 per month to more than $15,000 per month); Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 81–83 (describing three compliance models in more detail).

80 See Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 78 (describing virtual CISO services). 81 See, e.g., Electronic Transactions Association (comment 27, NPRM), at 2–4; CTIA (comment 34, NPRM), at 10; Global Privacy Alliance (comment 38, NPRM), at 7–8; American Financial Services Association (comment 41, NPRM), at 5; ACA International (comment 45, NPRM), at 13; Money Services Round Table (comment 53, NPRM), at 6– 7.

82 See, e.g., Electronic Transactions Association (comment 27, NPRM), at 2; Global Privacy Alliance (comment 38, NPRM), at 7. 83 16 CFR 314.2(b).

overseeing and implementing the security program. This individual was referred to in the Proposed Rule as a Chief Information Security Officer or ‘‘CISO.’’ As discussed in detail below, the Final Rule does not use this term, though the concept is the same: The person designated to coordinate the information security program need only be ‘‘qualified.’’ No particular level of education, experience, or certification is prescribed by the Rule. Accordingly, financial institutions may designate any qualified individual who is appropriate for their business. Only if the complexity or size of their information systems require the services of an expert will the financial institution need to hire such an individual.79 Finally, the Commission believes while large financial institutions may well incur substantial costs to implement complex information security programs, there are much more affordable solutions available for financial institutions with smaller and simpler information systems. For example, there are very low-cost or even free vulnerability assessment programs available: ‘‘virtual CISO’’ services enable a third party to provide security support for many companies, splitting the cost of information security professionals among them; many applications and hardware have built-in encryption requirements; 80 and there are affordable multi-factor authentication solutions aimed at businesses of various sizes. Considering these points, although there will undoubtedly be expenses involved for some, or even many, financial institutions to update their programs, the Commission believes these expenses are justified because of the vital importance of protecting customer information collected, maintained, and processed by financial institutions. Congress recognized the importance of securing consumers’ sensitive financial information when it passed the GLBA, which required the FTC to promulgate the Safeguards Rule. The importance, as well as the difficulty, of protecting customer information has only increased in the more than twenty years since the passage of the GLBA. The Commission believes the amendments to the Safeguards Rule are necessary to ensure the purposes of the GLBA are satisfied, and so consumers can have confidence financial institutions are providing reasonable safeguards to protect their information.

‘‘Sensitive’’ Customer Information Several industry groups also suggested significant portions of the Proposed Rule should not apply to all customer information, but rather only to some subset of particularly ‘‘sensitive’’ customer information, such as account numbers or social security numbers.81 These commenters generally argued the definition of ‘‘customer information’’ is too broad, as it will include information the commenters felt is not particularly sensitive, such as name and address, and does not justify extensive safeguards.82 The Commission does not agree that some portion of customer information is not entitled to the protections required by the Final Rule. The Safeguards Rule defines ‘‘customer information’’ as ‘‘any record containing nonpublic personal information’’ about a customer handled or maintained by or on behalf of a financial institution.83 The Final Rule defines ‘‘nonpublic personal information’’ as ‘‘personally identifiable financial information,’’ but does not include information that is ‘‘publicly available.’’ Although this definition is broad, the Commission believes information covered by it is rightfully considered sensitive and should be protected accordingly. The businesses regulated by the Safeguards Rule are not just any businesses, but are financial institutions and are responsible for handling and maintaining financial information that is both important to consumers and valuable to attackers who try to obtain the information for financial gain. Even the fact that a consumer is a customer of a particular financial institution is generally nonpublic and can be sensitive. For example, the revelation of a customer relationship between a consumer and a particular type of financial institution, such as debt collectors or payday lenders, may make those customers’ information more vulnerable to compromise by facilitating social engineering or similar attacks. The nature of the relationship between customers and their financial institutions makes all nonpublic information held by the financial institution inherently sensitive and worthy of the level of protection set forth in the Rule.

Although the Commission believes all customer information should be safeguarded by financial institutions and declines to exclude any portion of that information from protection under any of the provisions of the Rule, it notes the Rule does contemplate financial institutions will consider the sensitivity of particular information in designing their information security programs and safeguards. The elements required by this section are generally flexible enough to allow financial institutions to treat various pieces of information differently. For example, paragraph (c)(1) requires information security programs to include safeguards that address access control of customer information. The paragraph requires financial institutions to develop measures to ensure only authorized users access customer information, but does not prescribe any particular measures that must be adopted. When designing these measures, a financial institution may design a system in which more sensitive information is protected by more stringent access controls. Even in the more specific provisions of the Rule, there is flexibility to address the relative sensitivity of information. For example, in § 313.4(c)(5)’s requirement that customer information be protected by multi-factor authentication, financial institutions have flexibility to implement the multi-factor authentication depending on the sensitivity of the information. The financial institution may select factors such as SMS text messages to access less sensitive information, but determine more sensitive information should be protected by other, more secure, factors for authentication.

Third-Party Standards and Frameworks In addition, in the NPRM, the Commission asked whether the Safeguards Rule should incorporate outside standards, such as the National Institute of Standards and Technology (‘‘NIST’’) framework, either as required elements of an information security program or as a safe harbor that would VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 207

70281 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 84 Cisco Systems, Inc. (comment 51, NPRM), at 4; National Consumer Law Center and others (comment 58), at 2; Anonymous (comment 2, Workshop).

85 Cisco Systems, Inc. (Comment 51, NPRM), at 4. 86 Anonymous (comment 2, Workshop). The ISO/ IEC 27001 standard is an information security standard issued by the International Organization for Standardization. See ISO/IEC 27001 Information Security Management, ISO, https://www.iso.org/ isoiec-27001-information-security.html (last accessed 15 Dec. 2020).

87 National Consumer Law Center and others (comment 58, NPRM), at 2. 88 HITRUST (comment 18, NPRM), at 2; see also Consumer Reports (comment 52, NPRM), at 6–7 (discouraging the adoption of outside standards as a safe harbor for companies). 89 Mortgage Bankers Association (comment 26, NPRM), at 2 (suggesting Rule be modified so financial institutions that use the NIST Cybersecurity Framework would be in de facto compliance with the Rule); see also National Pawnbrokers Association (comment 32, NPRM), at 6–7 (advocating for the adoption of safe harbors for small financial institutions without detailing what should be required to qualify for the safe harbor). 90 Consumer Reports (comment 52, NPRM), at 6– 7.

91 Section 314.4(a).

92 84 FR 13165.

93 U.S. Chamber of Commerce (comment 33, NPRM), at 10; National Automobile Dealers Association (comment 46), at 17–19; National Independent Automobile Dealers Association (comment 48, NPRM), at 5; ACA International (Comment 45, NPRM), at 8. 94 See. e.g., Brian McManamon, Safeguards Workshop Tr., supra note 17, at 78 (estimating the average annual salary of a CISO can range from $180,000 to upwards of $400,000). 95 National Automobile Dealers Association (comment 46, NPRM), at 17–19; National Independent Automobile Dealers Association (comment 48, NPRM), at 5; U.S. Chamber of Commerce (comment 33, NPRM), at 10; ACA International (comment 45, NPRM), at 8. 96 National Automobile Dealers Association (comment 46, NPRM), at 18–19; U.S. Chamber of Commerce (comment 33, NPRM), at 10; ACA International (comment 45, NPRM), at 8. 97 84 FR 13175.

treat compliance with such a standard as compliance with the Safeguards Rule. Some commenters advocated for the adoption of an outside standard into the Safeguards Rule.84 Cisco Systems, Inc. suggested the Safeguards Rule should be connected to NIST guidance, arguing this would allow the Rule to evolve as NIST’s guidance evolves.85 An anonymous commenter suggested the Rule should comply with ‘‘international standard ISO/IEC 27001.’’ 86 The National Consumer Law Center argued certain financial institutions with particularly sensitive customer information should be required to comply with guidelines issued by NIST and the Federal Financial Institutions Examination Council (FFIEC).87 Other commenters acknowledged the value of outside standards but were opposed to the Rule requiring compliance with them.88 Some commenters suggested while compliance with outside standards should not be required, compliance should serve as a ‘‘safe harbor’’ for compliance with the Rule.89 On the other hand, Consumer Reports noted while such standards can be helpful guidance, they should not be a safe harbor for compliance with the Rule because financial institutions must take steps to ensure they are responding to changing information security threats regardless of the requirements of an outside framework.90 The Commission declines to change the Rule to incorporate or reference a particular security standard or framework for a variety of reasons. First, it is not clear the more detailed frameworks would apply well to financial institutions of various sizes and industries. In addition, mandating companies follow a particular security standard or framework would reduce the flexibility built into the Rule. Similarly, the Commission declines to make compliance with an outside standard a safe harbor for the Rule. In such a scenario, the use of safe harbors would not greatly enhance regulatory stability or predictability for financial institutions because the Commission would be required to actively monitor whether those standards continued to provide equivalent protections for Safeguards compliance and modify the Rule if a standard became inadequate. In addition, in investigating possible violations of the Rule, the Commission would be required to independently verify whether the financial institution had in fact complied with the outside framework, which would require substantial effort and expense on the part of the Commission and the target of the investigation.

Specific Elements In addition to these generally applicable comments, commenters addressed many of the individual elements set forth by this section. These elements are discussed in more detail below.

Paragraph (a)—Designation of a Single Qualified Individual Proposed paragraph (a) changed the current requirement that institutions designate an ‘‘employee or employees to coordinate your information security program’’ to instead require the financial institution to designate ‘‘a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.’’ 91 This individual was referenced in the Proposed Rule as a Chief Information Security Officer or ‘‘CISO.’’ The notice of proposed rulemaking for the Proposed Rule emphasized the use of the term ‘‘CISO’’ was for clarity in the Proposed Rule.92 Despite the use of the term ‘‘CISO,’’ the Proposed Rule did not require financial institutions to actually grant that title to the designated individual. Commenters that responded to this proposal, however, generally assumed the person designated to coordinate and oversee a financial institution’s information security program would be required to have the qualifications, duties, responsibilities, and accompanying pay of a CISO as that position is generally understood in the information security field.93 The position of CISO is generally limited to large companies with fairly complex information security systems, so the salary of this position is often very high.94 Accordingly, many commenters argued hiring a CISO would be prohibitively expensive for many financial institutions.95 Additionally, commenters argued the hiring of such an in-demand professional would be difficult because of a general shortage of such professionals available for hiring.96 By using the term ‘‘CISO,’’ the Commission did not intend to require all financial institutions hire a highly qualified professional with an extremely high salary, regardless of the financial institutions’ size or complexity. The Proposed Rule required only that financial institutions designate a ‘‘qualified individual’’ to oversee and enforce their information security program, without specifying any particular level of experience, education, or compensation, or requiring any particular duties outside of overseeing the financial institution’s information security program and other requirements specifically set forth in the Rule.97 The use of the term ‘‘CISO’’ in the Proposed Rule, however, caused confusion about the requirements of this section. Accordingly, the Final Rule replaces the term ‘‘CISO’’ with ‘‘Qualified Individual’’ to refer to the individual designated under this section of the Rule.

The use of the term ‘‘Qualified Individual’’ is meant to clarify the only requirement for this designated individual is that he or she be qualified to oversee and enforce the financial institution’s information security program. What qualifications are necessary will depend upon the size and complexity of a financial institution’s information system and the volume and sensitivity of the customer information the financial institution VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00011 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 208

70282 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 98 Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 74 (stating car dealerships can rely on existing staff for this role); Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 78–79 (stating any dealership with any IT staff at all would have someone who could assume the role of ‘‘qualified individual,’’ perhaps requiring some additional research or outside help); Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 81–82 (stating companies may use an existing employee for the role and ‘‘for any areas where there may be skill gaps, that can be supplemented with either certifications or some type of education.’’).

99 16 CFR 314.4.

100 National Independent Automobile Dealers Association (comment 48, NPRM), at 5; Consumer Data Industry Association (comment 36, NPRM), at 5; National Association of Dealer Counsel (comment 44, NPRM), at 2; ACA International (comment 45, NPRM), at 7–8; Money Services Round Table (comment 53, NPRM), at 10; Gusto and others (Comment 11, Workshop), at 2; see also Remarks of James Crifasi, Safeguards Workshop TR, supra note 17, at 74 (stating ‘‘when we’re talking about a small and medium business [. . .] we really need to see that ‘qualified individual’ be a mix of folks’’). 101 Consumer Data Industry Association (comment 36, NPRM), at 5. 102 ACA International (comment 45, NPRM), at 7– 8. NPA raised similar concerns. National Pawnbrokers Association (comment 3, Workshop), at 2.

103 Consumer Data Industry Association (comment 36, NPRM), at 5; National Automobile Dealers Association (comment 46, NPRM), at 19; ACA International (comment 45, NPRM), at 8. 104 National Automobile Dealers Association (comment 46, NPRM), at 19. 105 National Consumer Law Center and others (comment 58, NPRM), at 3 (arguing that a clear line of reporting with a single responsible individual could have prevented the Equifax consumer data breach).

106 Remarks of Adrienne Allen, Safeguards Workshop Tr., supra note 17, at 182–84 (stating that without a single responsible individual, information security staff ‘‘can fall into traps of each relying on someone else to make a hard call . . . [In a program without a single coordinator] issues can sometimes fall through the cracks.’’); Remarks of Michele Norin, Safeguards Workshop Tr., supra note 17, at 184–85 (‘‘I think it’s extremely important to have a person in front of the information security program. I think that there are so many components to understand, to manage, to keep an eye on. I think it’s difficult to do that if it’s part of someone else’s job. And so I found that it’s extremely helpful to have a person in charge of that program just from a pure basic management perspective and understanding perspective.’’). 107 See, e.g., Federal Trade Commission Staff Comment on the Preliminary Draft for the NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (Oct. 24, 2019), at 12–14 (suggesting NIST clarify that one person should be in charge of the program). https:// www.ftc.gov/system/files/documents/advocacy_ documents/ftc-staff-comment-preliminary-draftnist-privacy-framework/p205400nistprivacy frameworkcomment.pdf.

108 U.S. House, Committee on Oversight and Government Reform, Majority Staff Report, The Equifax Data Breach, at 55–62, 115th Congress (Dec. 2018).

109 Id.

possesses or processes. The Qualified Individual of a financial institution with a very small and simple information system will need less training and expertise than a Qualified Individual for a financial institution with a large, complex information system. The exact qualifications will depend on the nature of the financial institution’s information system. Each financial institution will need to evaluate its own information security needs and designate an individual with appropriate qualifications to meet those needs. The Commission believes, in many cases, financial institutions’ current coordinators, whether their own employees or third-party contractors, may be qualified for this role.98 Because the current Safeguards Rule requires financial institutions to designate an ‘‘employee or employees to coordinate your information security program,’’ financial institutions in compliance with that Rule will already have one or more information security coordinators. Although the current Rule does not expressly require that these coordinators be qualified for that position, the current Rule requires a financial institution to maintain ‘‘appropriate’’ safeguards, regularly test those safeguards, and evaluate and adjust the information security program in light of that testing.99 In order to effectively comply with these ongoing requirements, a financial institution’s coordinator must have some level of information security training and knowledge and, therefore, will likely be an appropriate Qualified Individual under the Final Rule. Accordingly, in many cases this amendment to the Rule will not require any additional hiring expenses.

In addition to explicitly requiring that the information security program coordinator be qualified for the role, the Commission proposed to require the designation of a single employee, as opposed to the multiple coordinators allowed by the existing Rule. Some commenters objected to this proposal on the grounds that it would interfere with financial institutions’ flexibility in organizing their information security personnel.100 For example, the Consumer Data Industry Association (‘‘CDIA’’) commented the designation of a single coordinator would interfere with financial institutions’ ability to organize their program ‘‘to share responsibilities among different personnel with different strengths.’’ 101 Similarly, ACA International argued this requirement would prevent financial institutions from having multiple staff members share responsibilities for information security programs.102 Other commenters argued the designation of a single individual as the coordinator of the information security program provides no proven benefits over the use of multiple coordinators.103 Similarly, NADA argued that, while the appointment of a single qualified individual might improve accountability, improving accountability does not improve security.104 On the other hand, a group of consumer and advocacy groups including the National Consumer Law Center (‘‘NCLC’’) argued appointing a single individual as the coordinator of the information security program can increase security and prevent security events based on lack of accountability and poor coordination.105 The Commission retains the requirement to designate a single qualified individual, because it believes there are clear benefits to the designation of a single coordinator. Designating a single coordinator to oversee an information security program clarifies lines of reporting in enforcing the program, can avoid gaps in responsibility in managing data security, and improve communication.106 The Commission disagrees with the commenter who stated improved accountability does not lead to improved security. The goal of improving accountability is to ensure information security staff and financial institution management give the necessary attention and resources to information security. In addition, an individual that has clear responsibility for the strength of a financial institution’s information security program will be accountable to improve the program and ensure it protects customer information.107 The major breach that occurred at national consumer reporting agency Equifax in 2017 demonstrates the importance of clear lines of reporting and accountability in management of information security programs. The U.S. House Committee on Oversight and Government Reform issued a report on the breach that identified Equifax’s organization as one of the major causes of the breach.108 The report indicated Equifax’s division of responsibility for information security between two individuals that reported to two different company officers contributed to failures of communication, oversight, and enforcement that led to millions of consumers’ data being compromised.109 Increasing accountability for individuals and organizations can directly lead to improved security for customer information.

Finally, the Commission does not believe the requirement to designate a single Qualified Individual would VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00012 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 209

70283 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 110 See Remarks of Adrienne Allen, Safeguards Workshop Tr., supra note 17, at 189–90 (noting that, even where there is a single point person, decision makers rarely operate ‘‘in a vacuum.’’). 111 National Automobile Dealers Association (comment 46, NPRM), at 18. 112 See Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 79–80 (stating that, in his work as a third-party information security service provider, he is often overseen by executives without technical backgrounds); see also Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 105–06 (noting distinction in how executives and technical staff may understand their organizations’ use of encryption); Remarks of Karthik Rangarajan, Safeguards Workshop Tr., supra note 17, at 196 (discussing challenges inherent in discussing technical issues with board members who lack a technical background)and at 211 (noting organizations can successfully manage their relationships with third-party service providers without ‘‘becom[ing] experts’’ in the services provided).

113 Proposed 16 CFR 314.4(b). 114 Proposed 16 CFR 314.4(b)(1), (2), and (3). 115 See, e.g., Proposed 16 CFR 314.4(c)(2) and (10) and (e).

116 ACA International (comment 45, NPRM), at 12; U.S. Chamber of Commerce (comment 33, NPRM), at 10.

117 U.S. Chamber of Commerce (comment 33, NPRM), at 10.

118 Consumer Data Industry Association (comment 36, NPRM), at 5. 119 Inpher, Inc. (comment 50, NPRM), at 4. prevent the approach of having multiple people responsible for different aspects of the program, as some commenters asserted. While the Qualified Individual appointed as the coordinator of the information security program would have ultimate responsibility for overseeing and managing the information security program, financial institutions may still assign particular duties and responsibilities to other staff members.110 A financial institution may organize its personnel in teams or share decision making between individuals. Moreover, the Rule does not require this be the Qualified Individual’s sole job— he or she may have other duties. The Rule requires only that one individual assume the ultimate responsibility for overseeing and enforcing the program. Accordingly, the Final Rule requires designation of a single Qualified Individual, as proposed, but no longer uses the term ‘‘CISO.’’ Third-Party Coordinators The Proposed Rule stated that the Qualified Individual would not need to be an employee of the financial institution, but could be an employee of an affiliate or a service provider. This change was intended to accommodate financial institutions that may prefer to retain an outside expert, lack the resources to employ a qualified person to oversee a program, or decide to pool resources with affiliates to share staff to manage information security. The Proposed Rule required, however, that to the extent a financial institution used a service provider or affiliate, the financial institution must still: (1) Retain responsibility for compliance with the Rule; (2) designate a senior member of its personnel to be responsible for direction and oversight of the Qualified Individual; and (3) require the service provider or affiliate to maintain an information security program that protects the financial institution in accordance with the Rule. The Commission received one comment on this aspect of the provision. NADA argued that, because a senior member of a financial institution’s personnel must be responsible for the oversight of a thirdparty Qualified Individual, the supervising individual would need to be an expert in information security, and the financial institution would still be required to hire an expensive employee to supervise the third-party Qualified Individual.111 The Rule, however, does not require individuals responsible for overseeing third-party Qualified Individuals to be information security experts themselves. The senior personnel that oversees the third-party Qualified Individual is charged with supervising and monitoring the thirdparty so the financial institution is aware of its data security needs and the safeguards being used to protect its information systems. This person does not need to be qualified to coordinate the information security program him or herself. Technical staff are frequently supervised by employees or officers with limited technical expertise.112 The Rule requires only the same responsibilities a supervisor would have in overseeing an in-house information security coordinator of a financial institution. Accordingly, the Commission adopts the proposed paragraph without modification. Proposed Paragraph (b) The NPRM proposed amending paragraph (b) to clarify a financial institution must base its information security program on the findings of its risk assessment by adding an explicit statement that financial institutions’ ‘‘information security program [shall be based] on a risk assessment.’’ 113 In addition, the Proposed Rule removed existing § 314.4(b)’s requirement that the risk assessment must include consideration of specific risks 114 because these specific risks are set forth elsewhere in the Proposed Rule.115 The Commission received no comments on this paragraph and adopts paragraph (b) as proposed.

Written Risk Assessment Paragraph (b)(1) of the Proposed Rule required the risk assessment be written and include: (1) Criteria for the evaluation and categorization of identified security risks or threats the financial institution faces; (2) criteria for the assessment of the confidentiality, integrity, and availability of the financial institution’s information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats to the financial institution; and (3) requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the financial institution’s risks. Commenters raised several concerns about the Proposed Rule’s provisions on risk assessment, none of which merit changes to the Proposed Rule. First, some commenters objected to the level of specificity of the Proposed Rule, with some arguing the requirements were too specific, and others arguing the requirements were not specific enough. With respect to the Proposed Rule being too specific, commenters such as ACA and U.S. Chamber of Commerce argued it removed financial institutions’ flexibility in performing risk assessments.116 The U.S. Chamber of Commerce contended, because the criteria are too specific, a risk assessment performed using them would not be ‘‘sufficiently risk based.’’ 117 CDIA expressed concern it was unclear ‘‘what level of specificity is required’’ in the written risk assessment and if detailed risk assessments are required, they ‘‘could themselves become a roadmap for a security breach.’’ 118 In contrast, several other commenters recommended the Rule set forth more specific criteria for risk assessments. Inpher suggested the Commission add a requirement that risk assessments require financial institutions to examine ‘‘technologies that are deployed by [financial institutions’] information security systems, and evaluate the feasibility’’ of adopting ‘‘privacy enhancing technologies’’ that would better address vulnerabilities and thwart threats.119 Inpher also recommended the Rule require financial institutions to conduct privacy impact assessments with ‘‘specific guidelines to review internal data protection standards and adherence to fair information VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00013 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 210

70284 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 120 Id.

121 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 2. 122 HALOCK Security Labs (comment 4, Workshop) at 2. See Rocio Baeza (comment 12, Workshop) at 2–3 (suggesting a detailed list of requirements for the risk assessment). 123 See, e.g., Remarks of Chris Cronin, Safeguards Workshop Tr., supra note 17, at 25 (stating that evaluating the likelihoods and impacts of potential security risks and evaluating existing controls is an important component of a risk assessment); Remarks of Serge Jorgensen, Safeguards Workshop Tr., supra note 17, at 29–30 (emphasizing the importance of risk assessments as tools for adjusting existing security measures to account for both current and future security threats); Nat. Inst. of Sci. & Tech., U.S. Dept. of Com., Special Publication 800–30 Rev. 1, Guide for Conducting Risk Assessments 1 (2012) (describing the purpose of risk assessments as the identification of and prioritization of risk in order to inform decision making and risk response). 124 ACA International further argued because risk assessment criteria are generally understood, they do not need to be included in the Final Rule. ACA International (comment 45, NPRM). The Commission believes it is helpful to be clear about the criteria the risk assessment must contain, even if those criteria are commonly understood. 125 National Association of Dealer Counsel (comment 44, NPRM), at 3; National Automobile Dealers Association (comment 46, NPRM), at 20. 126 National Automobile Dealers Association (comment 46, NPRM), at 20. 127 See, e.g., Slides Accompanying Remarks of Rocio Baeza, in Safeguards Workshop Slides, supra note 72, at 27–28 (describing three different compliance models: In-house, outsource, and hybrid, with costs ranging from $199 per month to more than $15,000 per month); Slides Accompanying the Remarks of Brian McManamon, ‘‘Sample Pricing,’’ in Safeguards Workshop Slides, supra note 72, at 29 (estimating the cost of cybersecurity services based on number of endpoints: $2K–$5K per month for 25–250 endpoints; $5K–$15K for 250–750 endpoints; $15K–$30K for 750–1,000 endpoints; and $30K– $50K for 1,500–2,500 endpoints); see also Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 83–85. 128 See Remarks of Chris Cronin, Safeguards Workshop Tr., supra note 17, at 48–49 (noting all information security frameworks and guidelines are based on risk analysis). 129 National Automobile Dealers Association (comment 46, NPRM) at 20. 130 Id.

principles.’’ 120 The Princeton Center suggested the Rule require risk assessments to include threat modeling and adopt the concept of defense in depth.121 HALOCK Security Labs recommended the Rule specifically require ‘‘a) That risk assessments should evaluate the likelihood of magnitudes of harm that result from threats and errors, b) That risk assessments should explicitly estimate foreseeable harm to consumers as well as to the covered financial institutions, c) That risk mitigating controls are commensurate with the risks they address, [and] d) That risk assessments estimate likelihoods and impacts using available data.’’ 122 The Commission believes the Proposed Rule’s provisions on risk assessment strike the right balance between specificity and flexibility. The amendments provide only a high-level list of criteria the risk assessment must address. They essentially require that the financial institution identify and evaluate risks to its systems, evaluate the adequacy of its existing controls for addressing these risks, and identify how these risks can be mitigated. These are core requirements of any riskassessment.123 The Rule does not require any specific methodology or approach for performing the assessment. Financial institutions are free to perform the risk assessment using the method most suitable for their organization as long as that method meets the general requirements set forth in the Rule. 124 And while the Commission agrees the additional requirements suggested by some commenters may be beneficial in many, or even most, risk assessments, it believes a more flexible requirement will better allow financial institutions to find the risk assessment method that best fits their organization and will better accommodate changes in recommended approaches in the future. In response to CDIA’s concern about the risk assessment providing a roadmap for bad actors, certainly, the written risk assessment will include details about a financial institution’s systems that could assist an attacker if obtained by the attacker. Accordingly, the risk assessment should be protected as any other sensitive information would be. The Commission does not view this concern as a reason not to create such a document. Indeed, the concern would apply to any written document that provides information regarding a financial institution’s information security procedures, from a network diagram to written security code.

Second, some commenters argued implementing the risk-assessment provision as proposed would be too expensive and difficult for financial institutions.125 For example, NADA argued the contemplated risk assessment would be very costly because the criteria set out in paragraph (b)(1) are ‘‘well outside the scope of expertise of anyone but the most sophisticated IT professionals.’’ 126 In response, although the Commission declines to modify the provision, it addresses NADA’s concern in § 314.6 by exempting financial institutions that maintain information concerning fewer than 5,000 consumers from the specific requirements of paragraph (b)(1), and from the requirement to memorialize the risk assessment in writing. For those financial institutions that do not qualify for this exemption, the Commission believes they will be able to perform the required risk assessment in a manner that is practical and affordable for their institution. There are many resources available to financial institutions to aid in risk assessment, including service providers that can assist institutions of various sizes.127 While acknowledging there will be some cost to conducting a risk assessment, the Commission believes a properly conducted risk assessment is an essential part of a financial institution’s information security program. The entire Safeguards Rule, both as it currently exists and as amended, requires that the information security program be based on a risk assessment. An information security program cannot properly guard against risks to customer information if those risks have not been identified and assessed.128 The Commission believes this requirement properly emphasizes the importance of robust risk assessments, while providing financial institutions sufficient flexibility in performing these assessments. Finally, the Commission notes, because the current Rule also requires that a risk assessment be performed, financial institutions that have complied with the current Rule have already conducted a risk assessment. And, even if that risk assessment was not memorialized in writing, the work conducted for that risk assessment should be useful in performing future risk assessments. Third, NADA objected to the requirement that the risk assessment describe how each identified risk will be ‘‘mitigated or accepted,’’ arguing it is not clear when it is appropriate to ‘‘accept a risk.’’ 129 NADA argued that documenting a decision to accept a risk would ‘‘create a record that can be distorted and second guessed after the fact,’’ and ‘‘context is lost when it is written and reviewed after an incident has occurred.’’ 130 The Rule does not require a financial institution to mitigate every risk identified, no matter how remote or insignificant. Instead, the Rule allows a financial institution to accept a risk, if its assessment of the risk reveals that the chance it will produce a security event is very small, if the consequences of the risk are minimal, or the cost of mitigating the risk far outweighs the benefit. In those cases, the financial institution may choose to accept the risk. A financial institution concerned that its decision to accept a risk will later be questioned may choose to set forth whatever context or VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00014 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 211

70285 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 131 Inpher, Inc. (comment 50, NPRM), at 3; Global Privacy Alliance (comment 38, NPRM), at 11. 132 National Automobile Dealers Association (comment 46, NPRM), at 20. 133 NADA disagreed with the Commission’s statement in the NPRM for the Proposed Rule that ‘‘most financial institutions already implement’’ the specific requirements in paragraph (c), stating that many financial institutions ‘‘do not currently implement some or all of these measures.’’ National Automobile Dealers Association (comment 46, NPRM), at 20. The Commission continues to believe most financial institutions institute some form of most of these measures, such as access control, secure disposal, and monitoring authorized users, based on its enforcement and business outreach experience. While NADA’s statement that some financial institutions implement none of the measures may be true, this underlines the necessity of making these elements explicit requirements under the Rule, as these elements are necessary for a reasonable information security program for all financial institutions. Indeed, a financial institution that utilizes none of these elements and exercises no access control, no secure disposal procedures, and does not monitor users of its systems is unlikely to be in compliance with the current Rule. 134 Global Privacy Alliance (comment 38, NPRM), at 6.

135 Global Privacy Alliance (comment 38, NPRM), at 9–10.

136 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 4–5. 137 Reynolds and Reynolds Company (comment 7, Workshop), at 7.

138 Consumer Reports (comment 52, NPRM), at 7. 139 American Council on Education (comment 24, NPRM), at 10.

140 National Automobile Dealers Association (comment 46, NPRM), at 23; National Independent Automobile Dealers Association (comment 48, NPRM), at 5; American Council on Education (comment 24, NPRM), at 10; 141 National Independent Automobile Dealers Association (comment 48, NPRM), at 5; American Council on Education (comment 24, NPRM), at 10. 142 NIADA suggested instituting physical access controls would cost a dealership $215,000 because each computer would need to have its own lockable cubicle and there would need to be lockable offices for all desks. See Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 76. As originally promulgated, the Rule already requires financial institutions implement ‘‘physical safeguards that are appropriate to your size and complexity.’’ 16 CFR 314.3. The Final Rule’s requirement is consistent with that longstanding requirement. If computers have technical safeguards preventing unauthorized users from accessing customer information, they usually will not need to be in a lockable area, particularly if they are not generally left unattended and are not likely to be stolen. Similarly, desks would need to be in lockable offices only if they contain accessible paper records. A lockable file cabinet may be a more economical solution.

explanation it sees fit in the written assessment.

Finally, while several commenters supported the idea of conducting ‘‘periodic’’ risk assessments as required by the Proposed Rule,131 NADA objected it is unclear how often financial institutions need to conduct risk assessments under this section. 132 In order to be effective, a risk assessment must be subject to periodic reevaluation to adapt to changes in both financial institutions’ information systems and changes in threats to the security of those systems. The Commission declines, however, to set forth a specific schedule for risk assessments. The Commission believes it would not be appropriate to set forth an inflexible schedule for periodic risk assessments because each financial institution must set its own schedule based on the needs and resources of its institution.

The Final Rule adopts § 314.4(b) as proposed.

Paragraph (c) Proposed paragraph (c) retained the existing Rule’s requirement for financial institutions to design and implement safeguards to control the risks identified in the risk assessment. In addition, it added more detailed requirements for what the safeguards must address (e.g., access controls, data inventory, disposal, change management, monitoring). These specific requirements represent elements of an information security program that the Commission views as essential and should be addressed by all financial institutions.133 As a preliminary matter, Global Privacy Alliance (GPA) argued all of these elements should be made optional and financial institutions should be required only to take these elements ‘‘into consideration’’ when designing their information security programs.134 While the Commission agrees it is important that the Rule allow financial institutions flexibility in designing their information security programs, these elements are such important parts of information security that each program must address them. For example, an information security program that has no access controls or does not contain any measures to monitor the activities of users on the systems cannot be said to be protecting the financial institution’s systems. The Final Rule, therefore, continues to require each information security program to contain safeguards that address these elements, with modifications described below. Access Controls Proposed paragraph (c)(1) required financial institutions to ‘‘place access controls on information systems, including controls to authenticate and permit access only to authorized individuals to protect against the unauthorized acquisition of customer information and to periodically review such access controls.’’ Commenters suggested a number of modifications to this provision. First, GPA argued this provision should require controls on access to information, rather than on information systems.135 Second, several commenters suggested adding further safeguards to the ‘‘access control’’ requirement. For example, the Princeton Center argued the Rule should adopt the ‘‘Principle of Least Privilege,’’ a principle that no user should have access greater than is necessary for legitimate business purposes.136 Reynolds and Reynolds Company (Reynolds) suggested the Rule clarify that financial institutions must ‘‘vet, control, and monitor user access to sensitive information.’’ 137 Consumer Reports argued paragraph (c)(1) should be amended to control access not just to authorized users, but to further limit access to when such access is reasonably necessary.138 ACE argued that any requirement for physical access control allow financial institutions to determine which locations should have restricted access, rather than limiting physical access to every building and office within, say, a college campus.139 Finally, some commenters argued the proposed language was too vague,140 particularly as it applied to vendorsupplied services.141 In response to the comments, the Commission makes a number of changes to this provision in the Final Rule. First, the Commission clarifies that the Rule requires access controls, not just for information systems, but for all customer information, whether it is housed in information systems or in physical locations. To streamline the Rule, the Final Rule combines the separate physical access controls requirement found in proposed paragraph (c)(3) with this paragraph. Physical access controls will generally be most important in situations in which sensitive customer information is kept in physical form (such as hardcopy loan applications, or printed consumer reports). It may also require physical restrictions to access machines that contain customer information (e.g., locked doors and/or key card access to a computer lab).142 The Commission declines to make any changes in response to ACE’s concern that every physical location will need to be protected—as the Rule states, physical controls must be implemented to protect unauthorized access to customer information. Where no customer information exists, the Rule would not require physical controls. Second, the Commission agrees with the commenters who advocated that the Rule implement the principle of least privilege. The Commission does not believe it is appropriate, for example, for larger companies to give all VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00015 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 212

70286 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 143 NPA expressed concern about the effect of the Rule on pawnbrokers who the commenter stated are required by law to allow law enforcement access to their physical records. National Pawnbrokers Association (comment 32, NPRM), at 7. Nothing in the Rule conflicts with any such requirements. Law enforcement appropriately accessing customer information under a law that requires that access would be considered authorized use under those circumstances.

144 As noted above, the Commission is also changing the term ‘‘authorized individuals’’ to ‘‘authorized users.’’ 145 Proposed 16 CFR 314.4(c)(2). 146 See, e.g., Complaint at 11, FTC v. Wyndham Worldwide Corp., No. CV 2:12–cv–01365–SPL (D. Ariz. June 26, 2012) (alleging company failed to provide reasonable security by, among other things, failing to inventory computers connected to its network).

147 National Automobile Dealers Association (comment 46, NPRM), at 23–24; American Financial Services Association (comment 41, NPRM), at 5; American Council on Education (comment 24, NPRM), at 10.

148 American Council on Education (comment 24, NPRM), at 10.

149 Another commenter criticized proposed paragraph (c)(2) because some financial institutions ‘‘have no control’’ over which networks they transmit customer information. National Pawnbrokers Association (comment 32, NPRM), at 7. Paragraph (c)(2) does not require a financial system to identify all networks over which it may transmit customer information. See also, infra, this document’s discussion of NPA’s comments on § 314.4(f) of the Final Rule, noting financial institutions are generally not required to oversee other entities’ service providers over which they have no control.

150 Inpher, Inc. (comment 50, NPRM), at 4; Princeton University Center for Information Technology Policy (comment 54, NPRM), at 3; Electronic Privacy Information Center (comment 55, NPRM), at 8; National Consumer Law Center and others (comment 58, NPRM), at 3. employees and service providers access to all customer information. Such overbroad access could create additional harm in the event of an intruder gaining access to a system by impersonating an employee or service provider. Accordingly, the Commission clarifies this in the Final Rule by adding a requirement that not only must a financial institution implement access controls, but it should also restrict access only to customer information needed to perform a specific function. As to the suggestion the Commission impose monitoring requirements for access, that requirement exists in paragraph (c)(8). And as to the suggestion the requirement is too vague as to service providers, the Commission believes the Final Rule is clear: When a vendor accesses the financial institution’s data or information systems, the financial institution must ensure appropriate access controls are in place. Separately, under paragraph (f), the financial institution must reasonably oversee the vendor’s safeguards, which would necessarily include access controls for the vendor’s system.

Finally, as to the suggestion the provision is vague generally, as discussed above, the Final Rule seeks to preserve flexibility in its provisions, both so that financial institutions can design programs appropriate for their systems and so that changes in technology or security practices will not render the Rule obsolete. The Commission believes maintaining less prescriptive requirements is the best way to achieve the goal of flexibility and protecting customer information.143 Accordingly, the Commission combines paragraphs (c)(1) and (3) from the Proposed Rule into revised paragraph (c)(1) of the Final Rule, which requires implementing and periodically reviewing access controls on customer information, including technical and, as appropriate, physical controls to (1) authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information and (2) limit authorized users’ access only to customer information that they need to perform their duties and functions, or, in the case of customers, to access their own information.144 System Inventory In the NPRM, the Commission proposed to require the financial institution to ‘‘[i]dentify and manage the data, personnel, devices, systems, and facilities that enable [the financial institution] to achieve business purposes in accordance with their relative importance to business objectives and [the financial institution’s] risk strategy.’’ 145 This requirement was designed to ensure the financial institution inventoried the data in its possession, inventoried the systems on which that data is collected, stored, or transmitted, and had a full understanding of the relevant portions of its information systems and their relative importance.146 The Commission retains this provision in the Final Rule without modification.

Commenters raised two general objections to this provision. First, some commenters argued it was too vague and that it was not clear how such an inventory should be conducted or what systems should be included.147 The Commission believes the language provides effective guidance while still allowing a variety of approaches by financial institutions in identifying systems involved in their businesses. This provision requires a financial institution to identify all ‘‘data, personnel, devices, systems, and facilities’’ that are a part of its business and to determine their importance to the financial institution. This inventory of systems must include all systems that are a part of the business so the financial institution can locate all customer information it controls, the systems connected to that information, and how they are connected. This inventory forms the basis of an information security program because a system cannot be protected if the financial institution does not understand its structure or know what data is stored in its systems. Second, ACE suggested the scope of this provision should be limited to systems ‘‘directly related to the privacy and security of ‘customer information.’ ’’ 148 The Commission declines to make this change because the purpose of this provision is to allow financial institutions to obtain a clear picture of their systems and to identify where customer information is kept and how it can be accessed. An inventory must examine all systems in order to identify all systems that contain customer information or are connected to systems that do. If a financial institution does not first examine all systems and instead limits the inventory to systems it considers to be directly related to security, it could give an incomplete picture of the financial institution’s systems and could result in some customer information or ways to connect to that information being overlooked.149 The Commission adopts paragraph (c)(2) of the Proposed Rule as final, without modifications.

Access to Physical Location Proposed paragraph (c)(3) would have required that financial institutions restrict access to physical locations containing customer information only to authorized individuals. The Final Rule combines this section with proposed paragraph (c)(1) in order to eliminate redundancy and clarify that access controls must consider both electronic and physical access.

Encryption Proposed paragraph (c)(4) required financial institutions to encrypt all customer information, both in transit over external networks and at rest. The Proposed Rule allowed financial institutions to use alternative means to protect customer information, subject to review and approval by the financial institution’s Qualified Individual. Several commenters supported the inclusion of an encryption requirement.150 In fact, some suggested VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00016 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 213

70287 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 151 Inpher, Inc. (comment 50, NPRM), at 4. 152 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 3. 153 National Pawnbrokers Association (comment 32, NPRM), at 3; U.S. Chamber of Commerce (comment 33, NPRM), at 11; CTIA (comment 34, NPRM) at 10; Wisconsin Bankers Association (comment 37, NPRM), at 2. 154 Global Privacy Alliance (comment 38, NPRM), at 7–8.

155 Bank Policy Institute (comment 39, NPRM), at 14; Mortgage Bankers Association (comment 26, NPRM), at 6; Global Privacy Alliance (comment 38, NPRM), at 7–8.

156 Bank Policy Institute (comment 39, NPRM), at 14.

157 U.S. Chamber of Commerce (comment 33, NPRM), at 11; American Financial Services Association (comment 41, NPRM), at 5; ACA International (comment 45, NPRM), at 13; CTIA (comment 34, NPRM), at 10. 158 Mortgage Bankers Association (comment 26, NPRM), at 6; Wisconsin Bankers Association (comment 37, NPRM), at 2; American Financial Services Association (comment 41, NPRM), at 5; Ken Shaurette (comment 19, NPRM), (suggesting the Commission consider whether ‘‘databases, applications and operating systems are prepared to fully support full encryption without significant performance impact or ability to continue to function.’’); National Automobile Dealers Association (comment 46, NPRM), at 25–26 (arguing the terms ‘‘at rest’’ and ‘‘in transit’’ are unclear).

159 Mortgage Bankers Association (comment 26, NPRM), at 6.

160 Wisconsin Bankers Association (comment 37, NPRM), at 2 (discussing FFIEC Information Technology Booklet); American Financial Services Association (comment 41, NPRM), at 5 (discussing FFIEC Cybersecurity Assessment Tool). 161 See Remarks of Matthew Green, Safeguards Workshop Tr, supra note 17, at 225 (noting website usage of encryption is above 80 percent; ‘‘Let’s Encrypt’’ provides free TLS certificates; and costs have gone down to the point that if a financial institution is not using TLS encryption for data in motion, it is making an unusual decision outside the norm); Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 106 (‘‘[T]he encryption of data in transit has been standard. There’s no pushback with that.’’); see also National Pawnbrokers Association (comment 3, Workshop), at 2 (‘‘[I]n states that allow us to use technology for the receipt of information from consumer customers and software to print our pawn tickets and store information, we believe our members have access through their software providers to protections that comply with the Safeguards Rule.’’). 162 See Remarks of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 267 (‘‘we have a lot more options, a lot more technologies today than we did before that are making both of these solutions, both encryption and MFA, easier to use, more flexible, in some cases cheaper, and we should be encouraging their adoption wherever possible.’’); Remarks of Matthew Green, Safeguards Workshop Tr., supra note 17, at 265–66 (‘‘I think that we’re in a great time when we’ve reached the point where we can actually mandate that encryption be used. I mean, years ago—I’ve been in this field for 15, you know, 20 years now, I guess. And, you know, encryption used to be this exotic thing that was very, very difficult to use, very expensive and not really feasible for securing information security systems. And we’ve reached the point where now it is something that’s come to be and we can actually build well. So I’m really happy about that.’’).

163 See Remarks of Randy Marchany, Safeguards Workshop Tr., supra note 17, at 229–30 (noting encryption is already built into the Microsoft Office environment and a number of Microsoft products, such as Spreadsheets, Excel, Docs, and PowerPoint, support that encryption feature). Other applications that have encryption built in include database applications; app platforms iOS and Android; and development frameworks for web applications on banking sites.

the Proposed Rule did not go far enough in requiring encryption. Inpher suggested the Rule should require encryption of customer information when in use, in addition to when in transit or at rest.151 The Princeton Center suggested requiring encryption of data while in transit over internal networks, in addition to requiring it for external networks, noting the blurring of the distinction between internal and external networks.152 In contrast, others argued encryption could be too expensive and technically challenging for some financial institutions and should not be required in all cases.153 Indeed, GPA argued the Rule should not require encryption at all, financial institutions should be free to adopt other protective measures for customer information, and the Rule should allow financial institutions to ‘‘determine the controls that are most appropriate for protecting the sensitive information that they handle.’’ 154 Similarly, some commenters argued financial institutions should be required to encrypt customer information only when the risk to the customer information justifies it.155 Others suggested encryption in more limited circumstances, such as on systems ‘‘to which unauthorized individuals may have access,’’ 156 for sensitive data,157 or for data in transit.158 The Mortgage Bankers Association argued encryption at rest is unnecessary because customer information at rest in a financial institution’s system is sufficiently protected by controlling access to the system.159 Two commenters stated guidelines issued by the Federal Financial Institutions Examination Council (FFIEC) do not require most banks to encrypt data at rest, unless the institution’s risk assessment indicates such encryption is necessary.160 The Commission declines to modify the encryption requirement from the Proposed Rule. As to the comments that suggest the requirement should be relaxed, the Commission notes there are numerous free or low cost encryption solutions available to financial institutions, particularly for data in transit,161 that make encryption a feasible solution in most situations. For data at rest, encryption is now cheaper, more flexible, and easier than ever before.162 In many cases, widely used software and hardware have built-in encryption capabilities.163 In response to the argument that the Rule should not require encryption at rest because FFIEC guidelines do not require it, the Commission notes the Safeguards Rule is very different from the guidelines issued by the FFIEC. The depository financial institutions regulated by the banking agencies are subject to regular examinations by their regulator. The guidelines created by the FFIEC are designed to be used by the examiner, as part of those examinations, to evaluate the security of the financial institution; the examiner thus has a direct role in regularly verifying the financial institution has taken appropriate steps to protect its customer information. In contrast, the Safeguards Rule regulates covered financial institutions directly and must be usable by those entities to determine appropriate information security without any interaction between the financial institution and the Commission. The Commission does not have the ability to examine each financial institution and work with that institution to ensure their information security is appropriate. Therefore, a requirement that institutions encrypt information by default is appropriate for the Safeguards Rule, as the Commission believes encryption of customer information at rest is appropriate in most cases.

Finally, while some commenters suggested eliminating the encryption requirement for certain types of data (e.g., non-sensitive) or certain categories of data (e.g., data at rest), the Commission notes, as discussed in more detail above, the fact that an individual is a customer of a financial institution alone may be sensitive. In any event, the Rule provides financial institutions with flexibility to adopt alternatives to encryption with the approval of the Qualified Individual.

Similarly, the Commission declines to extend the encryption requirement to data in use or to data transmitted over internal networks, as some commenters suggested. The Commission does not believe the technology that would encrypt data while in use (as opposed to in transit or at rest) has been adopted widely enough at this time to justify mandating its use by all financial institutions under the FTC’s jurisdiction. As to encryption of data transmitted over internal networks, the Commission acknowledges, due to changes in network design and the growth of cloud and mobile computing, the distinction between internal and external networks is less clear than it once was. However, the Commission believes requiring all financial institutions to encrypt all communications over internal networks would be unduly burdensome at this VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00017 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 214

70288 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 164 The Commission believes transmissions of customer information to remote users or to cloud service providers should be treated as external transmissions, as those transmissions are sent out of the financial institution’s systems. 165 Bank Policy Institute (comment 39, NPRM), at 13–14.

166 See, e.g., Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 3.2.1, PCI Security Standards Council (May 2018), https:// www.pcisecuritystandards.org/document_library (last accessed 30 Nov. 2020) (Requirement 4 encrypt transmission of cardholder data across open, public networks).

167 See, e.g., Encrypted Traffic Management, Broadcom Inc., https://www.broadcom.com/ products/cyber-security/network/encrypted-trafficmanagement (last accessed 30 Nov. 2020); SSL Visibility, F5, Inc., https://www.f5.com/solutions/ application-security/ssl-visibility (last accessed 30 Nov. 2020).

168 Bank Policy Institute (comment 39, NPRM), at 14; New York Insurance Association (comment 31, NPRM), at 1.

169 New York Insurance Association (comment 31, NPRM) at 1.

170 National Pawnbrokers Association (comment 3, Workshop), at 2–3.

171 Id. at 2.

172 NADA suggested it is not clear how the encryption requirement will apply to customer information held on a service provider’s system or on the systems of the subcontractors of the service provider. National Automobile Dealers Association (comment 46, NPRM), at 21–22. The Commission believes the Final Rule lays out a financial institution’s obligations in this situation: It requires customer information be encrypted unless infeasible. Section 314.4(e), in turn, requires financial institutions to require service providers to implement and maintain appropriate safeguards by contract and to periodically assess the continued adequacy of those measures. A financial institution that uses a service provider to store and process customer information must require that service provider to encrypt that information and periodically determine whether it continues to do so. If it is infeasible for the service provider to meet these requirements then the financial institution’s Qualified Individual must work with the service provider to develop compensating controls or cease doing business with the service provider. 173 See, e.g., Complaint, FTC v. D-Link Systems, Inc., No. 3:17–CV–00039–JD (N.D. Cal. March 20, 2017) (alleging company failed to provide reasonable security when it failed to adequately test the software on its devices). 174 See, e.g., Complaint, Lenovo, FTC No. 152– 3134 (January 2, 2018) (alleging company failed to provide reasonable security by failing to properly assess and address security risks caused by thirdparty software).

175 American Council on Education (comment 24, NPRM), at 11; National Automobile Dealers Association (comment 46, NPRM), at 26–27. time. There remain significant costs and technical hurdles to encrypting transmissions on internal networks that would not be reasonable to impose on all financial institutions, especially smaller institutions with simpler systems that might realize less benefit from this approach. While the Commission encourages financial institutions to consider whether it would be appropriate for them to encrypt the transmission of customer information over internal networks, it declines to require this for all financial institutions.164 Commenters pointed to three additional concerns about encryption, none of which the Commission finds persuasive. First, the Bank Policy Institute commented the encryption requirement would in fact weaken security by blocking surveillance of the information by the financial institution and requiring the ‘‘broad distribution’’ of encryption keys.165 The Commission does not believe an encryption requirement would weaken security. Encryption is almost universally recommended by security experts and included in most security standards.166 Further, new tools have been developed to address the issue the Bank Policy Institute has raised. Many financial institutions have monitoring tools on the edge of their networks to monitor data leaving the network. It used to be the case these network monitoring tools could not see the content of encrypted data as it left the corporate network and was transmitted to the internet. However, there are now tools available that can see the data as it departs the network, even if the data is encrypted.167 Any marginal security costs of encryption are far outweighed by the benefits of rendering customer information unreadable.

Second, some commenters argued financial institutions should be able to implement alternatives to encryption without obtaining approval from the Qualified Individual.168 The New York Insurance Association expressed concern financial institutions might feel they need to encrypt all customer information because of the risk that the alternative controls approved by the Qualified Individual would be ‘‘second guessed’’ in the event unencrypted data is compromised.169 The Commission, however, believes this concern is a core element of information security based on risk assessment. Every aspect of an information security program is based on the judgment of the financial institution and its staff. The Qualified Individual’s decision concerning alternate controls, like other decisions by the financial institution and its staff, will be subject to review in any enforcement action to determine whether the decision was appropriate. If the Qualified Individual is not required to make a formal decision, it is much more likely a decision not to encrypt information will be made even if there is no compensating control, or even made without the Qualified Individual’s knowledge.

Third, the National Pawnbrokers Association (‘‘NPA’’) expressed concern that if pawnbrokers are required to encrypt customer information they may fall out of compliance with state and local regulations concerning transaction reporting.170 NPA stated pawnbrokers are often required by state or local law to report every pawn transaction, along with nonpublic personally identifiable consumer information, to law enforcement, and the agencies that receive this information ‘‘prefer to take this information electronically and in unencrypted forms.’’ 171 The Commission believes if transmitting the information in unencrypted form is a preference of the agencies and not a requirement, then pawnbrokers can comply with both the Safeguards Rule and these laws by encrypting any transmissions that include customer information. If there are cases where a required transmission of customer information cannot be encrypted for technical reasons, then the pawnbroker’s Qualified Individual will need to work with the law enforcement agency to implement alternative compensating controls to ensure the customer information remains secure during these transmissions.172 The Final Rule adopts this paragraph as paragraph (c)(3) without revision. Secure Development Practices Proposed paragraph (c)(5) required financial institutions to ‘‘[a]dopt secure development practices for in-house developed applications utilized’’ for ‘‘transmitting, accessing, or storing customer information.’’ In this paragraph, the Commission proposed requiring financial institutions to address the security of software they develop to handle customer information, as distinct from the security of their networks that contain customer information.173 In addition, the Proposed Rule required ‘‘procedures for evaluating, assessing, or testing the security of externally developed applications [financial institutions] utilize to transmit, access, or store customer information.’’ This provision required financial institutions to take steps to verify that applications they use to handle customer information are secure.174 Some commenters argued evaluating the security of externally developed software would be too expensive or impractical for some financial institutions,175 while others raised different concerns. The American Council on Education suggested, in cases in which a financial institution cannot obtain access to a software provider’s code or technical VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00018 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 215

70289 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 176 American Council on Education (comment 24, NPRM), at 11.

177 National Automobile Dealers Association (comment 46, NPRM), at 26–27. 178 Proposed 16 CFR 314.4(c)(6). 179 Justine Bykowski (comment 12, NPRM); Princeton University Center for Information Technology Policy (comment 54, NPRM), at 6–7; Electronic Privacy Information Center (comment 55, NPRM), at 8; National Consumer Law Center and others (comment 58, NPRM), at 2; see also Remarks of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 240–41 (discussing the security poverty line).

180 American Council on Education (comment 24, NPRM), at 11–12.

181 National Independent Automobile Dealers Association (comment 48, NPRM), at 6; see also Ken Shaurette (comment 19, NPRM) (questioning whether multi-factor authentication is appropriate for all financial institutions). 182 National Independent Automobile Dealers Association (comment 48, NPRM), at 6. 183 Cisco Systems, Inc. (comment 51, NPRM), at 2–4.

184 Bank Policy Institute (comment 39, NPRM), at 11–13; Global Privacy Alliance (comment 38, NPRM), at 8.

185 Electronic Transactions Association (comment 27, NPRM), at 3 n.1; U.S. Chamber of Commerce (comment 33, NPRM), at 11; CTIA (comment 34, NPRM), at 11; Global Privacy Alliance (comment 38, NPRM), at 8; Bank Policy Institute (comment 39, NPRM), at 12; National Automobile Dealers Association (comment 46, NPRM), at 28; National Independent Automobile Dealers Association (comment 48, NPRM), at 6; New York Insurance Association (comment 31, NPRM), at 1. 186 CTIA (comment 34, NPRM), at 11; Electronic Transactions Association (comment 27, NPRM), at 3 n.1; U.S. Chamber of Commerce (comment 33, NPRM), at 11.

187 American Council on Education (comment 24, NPRM), at 11.

188 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 6–7; see also Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 102 (stating his company TECH LOCK supports requiring multifactor authentication for users connecting from internal networks).

189 CTIA (comment 34, NPRM), at 11–12; see also Electronic Transactions Association (comment 27, NPRM) at 3 (suggesting use of the term ‘‘alternative compensating controls’’). 190 See, e.g., Slides Accompanying Remarks of Brian McManamon, ‘‘MFA/2FA Pricing (Duo),’’ in Safeguards Workshop Slides, supra note 72, at 30 (setting forth prices for multi-factor/two-factor services from Duo, including free services for up to ten users); Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 102–03; Slides Accompanying Remarks of Lee Waters, ‘‘Estimated Costs of Proposed Changes,’’ in Safeguards Workshop Slides, supra note 72, at 26 estimating costs of MFA to be $50 for smartcard or fingerprint readers, and $10 each per smartcard); Slides Accompanying Remarks of Wendy Nather, ‘‘Authentication Methods by Industry,’’ in Safeguards Workshop Slides, supra note 72, at 37 (chart showing the use of MFA solutions such as Duo Push, phone call, mobile passcode, SMS passcode, hardware token, Yubikey passcode, and U2F token in industries such as financial services and higher education); Remarks of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 233–34. infrastructure, then evaluating the security of its software is infeasible.176 NADA further suggested in order to evaluate the security of software, financial institutions would need to hire an expensive IT professional.177 The Commission does not agree with these assertions. Evaluating the security of software does not require access to the source code of that software or access to the provider’s infrastructure. For example, a provider can supply the steps it took to ensure the software was secure, whether it uses encryption to transmit information, and the results of any testing it conducted. In addition, there are third party services that assess software. An institution can also set up automated searches regarding vulnerabilities, patches, and updates to software listed on the financial institution’s inventory. The exact nature of the evaluation required will depend on the size of the financial institution and the amount and sensitivity of customer information associated with the software. If the software will be used to handle large amounts of extremely sensitive information, then a more thorough evaluation will be warranted. Likewise, the nature of the software used will also affect the evaluation. Software that has been thoroughly tested by third parties may need little more than a review of the test results, while software that has not been widely used and tested will require closer examination.

The Commission adopts proposed paragraph (c)(5) as paragraph (c)(4) of the Final Rule.

Multi-Factor Authentication Proposed paragraph (c)(6) required financial institutions to ‘‘implement multi-factor authentication for any individual accessing customer information’’ or ‘‘internal networks that contain customer information.’’ 178 The Proposed Rule would have allowed financial institutions to adopt a method other than multi-factor authentication that offers reasonably equivalent or more secure access controls with the written permission of its Qualified Individual. In the Final Rule, the Commission retains the general requirements of proposed paragraph (c)(6) as paragraph (c)(5), with some modifications described below. Although several commenters expressed support for including a multifactor authentication requirement in the Final Rule,179 others opposed such a requirement. For example, ACE argued a blanket requirement mandating multifactor authentication for all institutions of all sizes and complexities is not the best solution.180 The National Independent Automobile Dealers Association (NIADA) commented the costs of multi-factor authentication would be too high for some financial institutions because it would need to be built into their information systems from scratch.181 NIADA also argued adopting multi-factor authentication would disrupt a financial institution’s activities as employees had to ‘‘jump through multiple hoops to log in.’’ 182 Cisco Systems, Inc. argued that while multi-factor authentication is an effective safeguard, it should not be specifically required by the Rule because, while it is currently good security practice, in the future multifactor authentication may become outdated, and that allowing financial institutions to satisfy the Rule in this way could result in inadequate protection.183 Other commenters did not dispute the benefits of multi-factor authentication generally, but argued the Rule should limit the multi-factor authentication requirement. Some of these commenters stated the Rule should only require multi-factor authentication when the financial institution’s risk assessment justifies it.184 Others argued there should be a distinction between internal access and external access. For example, some commenters argued the Rule should not require multi-factor authentication when a user accesses customer information from an internal network,185 because there are other controls on internal access that make multi-factor authentication unnecessary.186 Another commenter stated requiring multi-factor authentication when a customer accesses their information from an external network could create problems for some institutions.187 Finally, the Princeton Center argued the Rule should be amended to clarify that multi-factor authentication should be required for internal and external networks.188 Finally, CTIA took issue with the proposed requirement that the Qualified Individual be permitted to approve ‘‘reasonably equivalent or more secure’’ controls if multi-factor authentication is not feasible, suggesting instead that Qualified Individuals be permitted to approve ‘‘effective alternative compensating controls.’’ 189 The Commission disagrees with the commenters who stated the Rule should not include a multi-factor authentication requirement. As to costs, many affordable multi-factor authentication solutions are available in the marketplace.190 Most financial institutions will be able to find a solution that is both affordable and workable for their organization. In the cases when that it is not possible, the VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00019 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 216

70290 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 191 See also Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 103–04 (noting even where legacy systems do not support multifactor authentication, alternative measures can be used and ‘‘it’s things that can easily be done.’’) 192 See, e.g., Remarks of Randy Marchany, Safeguards Workshop Tr., supra note 17, at 236–38 (describing how Virginia Tech implemented multifactor authentication in 2016 for its more than 156,000 users); Slides Accompanying Remarks of Wendy Nather, ‘‘Authentication Methods by Industry,’’ in Safeguards Workshop Slides, supra note 72, at 37 demonstrating the types of multifactor authentication used by health care, financial services, higher education and the Federal Government); Remarks of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 233–35. 193 See Remarks of Wendy Nather, Safeguards Workshop Tr., supra note 17, at 234 (describing how a phone call to a landline is popular in some segments).

194 See, e.g., Remarks of Matthew Green, Safeguards Workshop Tr., supra note 17, at 266 (explaining passwords are not enough of an authentication feature but when MFA is used and deployed, the defenders can win against attackers); id. at 239 (describing how because smart phones have modern secure hardware processors, biometric sensors and readers built in, increasingly consumers can get the security they need through the devices they already have by storing cryptographic authentication keys on the devices and then using the phone to activate them). 195 The Mortgage Bankers Association expressed concern the Proposed Rule would not allow the use of a single-sign on process, where a user is given access to multiple applications with the use of one set of credentials. Mortgage Bankers Association (comment 26, NPRM), at 7. The Commission does not view the Rule as preventing such a system, if the user has used multi-factor authentication to access the system and the system is designed to ensure any user of a given application has been subjected to multi-factor authentication. 196 See Remarks of Pablo Molina, Safeguards Workshop Tr., supra note 17, at 30 (mentioning ‘‘phishing,’’ or social engineering, as a common type of cybersecurity attack); Remarks of Lee Waters, Safeguards Workshop, supra note 17, at 91 (same); Remarks of Michele Norin, Safeguards Workshop Tr., supra note 17, at 179 (same); see also Cyber Div., Fed. Bureau of Investigation, Private Industry Notification No. 20200303–001, Cyber Criminals Conduct Business Email Compromise through Exploitation of Cloud-Based Email Services, Costing U.S. Businesses Over Two Billion Dollars, (March 2020), https://www.ic3.gov/media/ news/2020/200707-4.pdf, at 1–2, (last accessed 1 Dec. 2020) (‘‘Between January 2014 and October 2019, the Internet Crime Complaint Center (IC3) received complaints totaling over $2.1 billion in actual losses from [Business Email Compromise (‘‘BEC’’)] scams targeting the largest [cloud-based email] platforms. Losses from BEC scams overall have increased every year since IC3 began tracking the scam in 2013 and have been reported in all 50 states and in 177 countries.’’). 197 Consumer Data Industry Association (comment 36, NPRM), at 6–7; Cisco Systems, Inc. (comment 51, NPRM), at 3–4. 198 Bank Policy Institute (comment 39, NPRM), at 11.

199 NADA argued, for financial institutions that have appointed a third party to act as their information security coordinator, this provision would require the institution to turn over decisionmaking to someone ‘‘with no stake in the business outcome.’’ National Automobile Dealers Association (comment 46, NPRM), at 29–30. This concern misinterprets the role of the Qualified Individual. Whether the Qualified Individual is inside the company or at a third-party company, that individual will report to and be supervised by senior management of a financial institution (unless the Qualified Individual is the head of the financial institution). If a Qualified Individual recommends a safeguard that would not be practical for the business, the financial institution is not required to adopt this safeguard but can use an alternative adequate safeguard that will be functional. Indeed, when it comes to third parties, the Rule specifically requires someone in the financial institution direct and oversee the third party. 200 Proposed 16 CFR 314.4(c)(7). 201 See Information Technology Laboratory Computer Security Resource Center, Glossary, National Institute of Standards and Technology, https://csrc.nist.gov/glossary/term/audit-trail (last accessed Dec. 2, 2020).

202 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 8; Electronic Privacy Information Center (comment 55, NPRM), at 8.

Rule allows financial institutions to adopt reasonably equivalent controls.191 As to potential disruptions requiring multi-factor authentication may cause, the Commission notes that many organizations, both financial institutions and otherwise, currently require employees to use multi-factor authentication without major disruption.192 Many multi-factor authentication systems are available that do not materially increase the time it takes to log into a system as compared to the use of only a password.193 In short, multi-factor authentication is an extremely effective way to prevent unauthorized access to a financial institution’s information system,194 and its benefits generally outweigh any increased time it takes to log into a system. In those situations when the need for quick access outweighs the security benefits of multi-factor authentication, the Rule allows the use of reasonably equivalent controls. Finally, although the Commission agrees the Rule should not lock financial institutions into using outmoded or obsolete technologies, the basic structure of using multiple factors to identify a user is unlikely to be rendered obsolete in the near future. The Rule’s definition of multi-factor authentication addresses only this principle and does not require any particular technology or technique to achieve it. This should allow it to accommodate most changes in information security practices. In the event of an unforeseen change to the information security environment that would discount the value of multi-factor authentication, the Commission will adjust the Rule accordingly.195 The Commission agrees with the commenter who stated multi-factor authentication is justified both when external users, such as customers, and internal users, such as employees, access an information system. Multifactor authentication can prevent many attacks focused on using stolen passwords from both employees and customers to access customer information. Other common attacks on information systems, such as social engineering or brute force password attacks, target employee credentials and use those credentials to get access to an information system.196 These attacks can usually be stopped through the use of multi-factor authentication. Accordingly, the Final Rule requires multi-factor authentication whenever any individual—employee, customer or otherwise—accesses an information system. If a financial institution determines it is not the best solution for its information system, it may adopt reasonably equivalent controls with the approval of the Qualified Individual. The Commission recognizes the language of the Proposed Rule may have created some confusion by its use of the term ‘‘internal networks’’ to define the systems affected by the multi-factor authentication requirement, instead of the term ‘‘information systems’’ as used other places in the Rule.197 In addition, the Commission agrees with commenters that argued separating the multi-factor authentication into two sentences created confusion.198 Accordingly, the Commission modifies paragraph (c)(5) of the Final Rule, which was proposed as paragraph (c)(6), to require financial institutions to ‘‘[i]mplement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls.’’ Finally, the Commission declines to adopt CTIA’s proposed alternative that would allow Qualified Individuals to approve ‘‘effective alternative compensating controls,’’ even if they are not ‘‘reasonably equivalent or more secure’’ than multi-factor authentication. Given the important role multi-factor authentication has in access control, any alternative measure should provide at least as much protection as multi-factor authentication.199 Audit Trails Proposed paragraph (c)(7) required information security programs to include audit trails designed to detect and respond to security events.200 Audit trails are chronological logs that show who has accessed an information system and what activities the user engaged in during a given period.201 Some commenters supported this requirement.202 The Princeton Center noted audit trails are ‘‘crucial to designing effective security measures VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00020 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 217

70291 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 203 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 8. 204 Id.

205 National Automobile Dealers Association (comment 46, NPRM), at 30–31; National Independent Automobile Dealers Association (comment 48, NPRM), at 6; American Financial Services Association (comment 41, NPRM), at 6; Global Privacy Alliance (comment 38, NPRM), at 11.

206 Global Privacy Alliance (comment 38, NPRM), at 11.

207 American Financial Services Association (comment 41, NPRM), at 6. 208 American Council of Education (comment 24, NPRM), at 12.

209 National Automobile Dealers Association (comment 46, NPRM), at 30–31. 210 See Final Rule, 16 CFR 314.4(c)(8). 211 Proposed 16 CFR 314.4(c)(8). 212 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 8; Electronic Privacy Information Center (comment 55, NPRM), at 8; Consumer Reports (comment 52, NPRM), at 7.

213 Consumer Reports (comment 52, NPRM), at 7– 8.

214 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 8–9. 215 National Automobile Dealers Association (comment 46, NPRM), at 31; National Independent Automobile Dealers Association (comment 48, NPRM), at 6.

216 National Automobile Dealers Association (comment 46, NPRM), at 31–32. 217 American Financial Service Association (comment 41, NPRM), at 6. 218 Cybersecurity Assessment Tool, FFIEC, https://www.ffiec.gov/pdf/cybersecurity/FFIEC_ CAT_May_2017_Cybersecurity_Maturity_June2.pdf at 37 (last visited December 3, 2020). 219 National Automobile Dealers Association (comment 46, NPRM), at 32. 220 American Council on Education (comment 24, NPRM), at 12.

221 Id.

222 See, e.g., Complaint, Rite Aid Corp., FTC No. 072–3121 (November 22, 2010) (alleging company failed to provide reasonable data security when it failed to implement policies and procedures to dispose securely of personal information). 223 As to the Princeton Center’s suggestion financial institutions periodically review their disposal practices (Princeton University Center for Information Technology Policy (comment 54, NPRM), at 8–9), the Commission believes this Continued that allow institutions to detect and respond to security incidents.’’ 203 It also stated audit trails ‘‘help understand who has accessed the system and what activities the user has engaged in.’’ 204 Other commenters argued this requirement imposed unclear obligations or would not improve security.205 For example, GPA commented the Proposed Rule conflated the use of logs to reconstruct past events and the active use of logs to monitor user activity.206 The American Financial Services Association argued adding logging capabilities to some legacy systems would be expensive and difficult.207 Another commenter argued the increased use of cloud storage would mean that financial institutions might not have access to any audit trails.208 In addition, NADA argued it did not believe maintenance of logs would increase security but would instead create records that could be sought by parties ‘‘seeking to place blame’’ for breaches.209 The Commission believes logging user activity is a crucial component of information security because in the event of a security event it allows financial institutions to understand what was accessed and when. However, the term ‘‘audit trails’’ may have been unclear in this context. In order to clarify that logging user activity is a part of the user monitoring process, the Final Rule does not include paragraph (c)(7) of the Proposed Rule and instead modifies the user monitoring provision to include a requirement to log user activity.210 By putting the ‘‘monitoring’’ and ‘‘logging’’ requirements together, the Final Rule provides greater clarity on the comment raised by the GPA: Financial institutions are expected to use logging to ‘‘monitor’’ active users and reconstruct past events. Disposal Procedures Proposed paragraph (c)(8) required financial institutions to develop procedures for the secure disposal of customer information that is no longer necessary for their business operations or other legitimate business purposes.211 The Proposed Rule allowed the retention of information when retaining the information is required by law or where targeted disposal is not feasible. Some commenters supported the inclusion of a disposal requirement as proposed or suggested that the disposal requirements should be strengthened.212 Consumer Reports argued financial institutions should be required to dispose of customer information when it is no longer needed for the business purpose for which it was gathered.213 The Princeton Center suggested the Rule require disposal after a set period unless the company can demonstrate a current need for the data and that financial institutions periodically review their data practices to minimize their data retention.214 Several other commenters opposed the disposal requirement as set forth in the Proposed Rule. Some argued the requirement to dispose of information goes beyond the Commission’s authority under the GLB Act.215 NADA argued the GLB Act does not ‘‘contain[ ] any authority to require financial institutions to delete any information’’ and a requirement to have procedures to delete information for which a company has no legitimate business purpose would constitute a ‘‘new privacy regime.’’ 216 The American Financial Services Association (AFSA) stated the requirement was too prescriptive and the Rule should allow financial institutions to retain information as long as that retention complies with the retention policy created by the financial institution.217 AFSA further argued the proposed requirement exceeds the Federal banking standards, pointing to the FFIEC Cybersecurity Assessment Tool, which sets disposal of records ‘‘according to documented requirements and within expected time frames’’ as a baseline requirement for access and data management.218 Yet other commenters suggested modifying the requirement. NADA argued that if there was to be a disposal requirement, then it should be modeled after the Disposal Rule, which requires businesses to properly dispose of consumer reports, but does not have an explicit requirement to dispose of information on any particular schedule.219 ACE suggested modifying the Proposed Rule to require disposal of information only where there is no longer any ‘‘legitimate purpose’’ rather than any ‘‘legitimate business purpose.’’ 220 It argued in some cases a financial institution may have legitimate purposes for retaining information that are not readily defined as ‘‘business’’ purposes, such as the retention of data by educational institutions for institutional research or student analytics.221 The Commission believes requiring the disposal of customer information for which the financial information has no legitimate business purpose is within the authority granted by the GLB Act to protect the security of customer information. The disposal of records, both physical and digital, can result in exposure of customer information if not performed properly.222 Similarly, if records are retained when they are no longer necessary, there is a risk those records will be subject to unauthorized access. The risk of unauthorized access may be reasonable where the retention of data provides some benefit. In situations where the information is no longer needed for a legitimate business purpose, though, the risk to the customer information becomes unreasonable because the retention is no longer benefiting the customer or financial institution. Disposing of unneeded customer information, therefore, is a vital part of protecting customer information and serves the purpose of the GLB Act.223 VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00021 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 218

70292 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations requirement is already encompassed in the requirement contained in § 314.4(g) to periodically review their safeguards overall. 224 Proposed 16 CFR 314.4(c)(9). 225 See, e.g., Change Management, Rutgers OIT Information Security Office, https://rusecure. rutgers.edu/content/change-management (last accessed 1 Dec. 2020).

226 Electronic Privacy Information Center (comment 55, NPRM), at 8; National Consumer Law Center and others, (comment 58, NPRM) at 3. 227 American Council on Education (comment 24, NPRM), at 12–13; National Automobile Dealers Association (comment 46, NPRM), at 33. 228 National Automobile Dealers Association (comment 46, NPRM), at 32–33. 229 American Council on Education (comment 24, NPRM), at 12.

230 See Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 95 (‘‘[E]very time there is a change to any of these [network] environments, that is creating additional risk.’’); Remarks of Scott Wallace, Safeguards Workshop Tr., supra note 17, at 147–48 (giving an example of an incident in which network changes led to the exposure of sensitive information); Remarks of Matthew Green, Safeguards Workshop Tr., supra note 17, at 252 (noting it is ‘‘a little dangerous’’ to make ‘‘major changes’’ to an information system at a time of heightened stress). 231 National Automobile Dealers Association (comment 46, NPRM), at 33 n.96. 232 Proposed 16 CFR 314.4(c)(10). 233 National Automobile Dealer Association (comment 46, NPRM), at 33. 234 See Remarks of Nicholas Weaver, Safeguards Workshop Tr., supra note 17, at 124–25. 235 American Financial Services Association (comment 41, NPRM), at 6. The Commission disagrees with commenters who suggested narrowing the disposal requirement or doing away with it altogether. As noted above, although no disposal requirement appears in FFIEC guidelines, those guidelines represent a different regulatory approach and are not an appropriate model for the Safeguards Rule.

Finally, as to setting retention periods or narrowing the legitimate business purposes for which financial institutions may retain customer information, the Commission recognizes financial institutions need some flexibility. Whereas customers may want to, for example, access and transfer older data in some circumstances, in other circumstances, retaining such data would not be consistent with any legitimate business purpose. The Commission believes the Princeton Center’s recommendation that companies be required to delete information after a set period unless the information is still needed for a legitimate business purpose properly balances the needs of financial institutions with the need to protect customer information. Thus, the Commission modifies proposed paragraph (c)(6) to require the deletion of customer information two years after the last time the information is used in connection with providing a product or service to the customer unless the information is required for a legitimate business purpose as paragraph (c)(6)(i) of the Final Rule. In addition, paragraph (c)(6)(ii) of the Final Rule requires financial institutions to periodically review their policies to minimize the unnecessary retention of information. Change Management Proposed paragraph (c)(9) required financial institutions to adopt procedures for change management.224 Change management procedures govern the addition, removal, or modification of elements of an information system.225 This paragraph required financial institutions to develop procedures to assess the security of devices, networks, and other items to be added to their information system, or the effect of removing such items or otherwise modifying the information system. For example, a financial institution that adds additional servers or other machines to its information system would need to evaluate the security of the new devices and the effect of adding them to the existing network. Some commenters supported this requirement,226 while others stated it was too broad and would impose unnecessary burdens on financial institutions.227 In particular, NADA argued financial institutions that have not made changes in their systems ‘‘for some time’’ should not be required to create procedures for change management.228 ACE argued including a change management requirement is unnecessary because such a requirement is ‘‘generally incorporated into an organization’s IT operations’’ for nonsecurity purposes and the security considerations of those changes will be considered as part of those procedures.229 Alterations to an information system or network introduce heightened risk of cybersecurity incidents; 230 thus, it is important to expressly require change management to be a part of an information security program. The Commission agrees with ACE that many financial institutions will already have change management procedures in place. If those procedures adequately consider security issues involved in the change, then they may satisfy this requirement.

As to the comment a financial institution that has not made changes to its environment in some time should not be required to have change management processes, the Commission disagrees. Few information systems can remain unchanged for a significant period of time, given the changing technical requirements for business and security. Indeed, NADA acknowledges financial institutions will need to ‘‘adapt[] their programs to keep up with changes in data security.’’ 231 For this reason, all financial institutions must have procedures for when the changes occur. As with all of the requirements of the Rule, though, the exact nature of these procedures will vary depending on the size, complexity and nature of the information system. A simple system may have equally simple change management procedures.

The Commission adopts this proposed paragraph as paragraph (c)(7) of the Final Rule without change. System Monitoring Proposed paragraph (c)(10) required financial institutions to implement policies and procedures designed ‘‘to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users.’’ 232 The Proposed Rule required financial institutions to take steps to monitor those users and their activities related to customer information in a manner adapted to the financial institution’s particular operations and needs. NADA stated this requirement would create unnecessary expense because it would require financial institutions to ‘‘continually monitor all authorized use’’ and would mean ‘‘yet more new employees or third-party IT consultants.’’ 233 The Commission disagrees, however, noting that monitoring of system use can be automated.234 There is no requirement a separate staff member would be required to exclusively monitor system use.

In addition, one commenter stated monitoring the use of paper files is impossible and should be excluded from this provision.235 The Commission acknowledges monitoring of paper records is qualitatively different than the monitoring of electronic records. This requirement goes hand in hand with limiting access to documents, whether electronic or paper. For example, if an institution has a file room and access to the room is limited to particular employees (e.g., the payroll office), the institution should have measures in place to ensure those access controls are in fact being utilized (e.g., sign in with front desk, logging of key card access, security camera). As discussed above, this paragraph is amended to also require the logging of user activity, but is otherwise adopted as proposed as paragraph (c)(8). VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00022 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 219

70293 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 236 Financial institutions that choose the option of continuous monitoring would also be satisfying § 314.4(c)(8).

237 Proposed 16 CFR 314.4(d)(1) and (2). 238 American Council on Education (comment 24, NPRM), at 13–14.

239 American Council on Education (comment 24, NPRM), at 13.

240 American Council on Education (comment 24, NPRM), at 14.

241 National Pawnbrokers Association (comment 3, Workshop), at 2.

242 Global Privacy Alliance (comment 38, NPRM), at 10–11.

243 National Independent Automobile Dealers Association (comment 48, NPRM), at 6; American Financial Services Association (comment 41, NPRM), at 6.

244 American Financial Services Association (comment 41, NPRM), at 6. 245 CTIA (comment 34, NPRM) at 12–13 (arguing penetration testing should be required only once every two years and vulnerability testing be required only once a year). 246 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 5. 247 Money Services Round Table (comment 53, NPRM), at 9; see also Gusto and others (Comment 11, Workshop), at 2 (arguing penetration testing and vulnerability assessments both have their weaknesses and financial institutions should develop a testing program that it is appropriate for them).

248 The Commission believes a system for continuous monitoring will include some form of vulnerability assessment as part of monitoring the information system.

249 Remarks of Frederick Lee, Safeguards Workshop Tr., supra note 17, at 139–40. 250 See id. at 129–30 (noting the cost of a penetration test can increase significantly depending on the complexity of the system to be tested and the scope of the test). Proposed Paragraph (d) Proposed paragraph (d)(1) retained the current Rule’s requirement that financial institutions ‘‘[r]egularly test or otherwise monitor the effectiveness of the safeguards’ key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems.’’ Proposed paragraph (d)(2) provided further detail to this requirement by stating the monitoring must take the form of either ‘‘continuous monitoring’’ or ‘‘periodic penetration testing and vulnerability assessments.’’ The proposal explained continuous monitoring is any system that allows real-time, ongoing monitoring of an information system’s security, including monitoring for security threats, misconfigured systems, and other vulnerabilities.236 For those who elected to engage in periodic penetration testing and vulnerability assessment, the proposal required penetration testing at least once annually (or more frequently if called for in the financial institution’s risk assessment) and vulnerability assessments at least twice a year.237 Some commenters thought the proposal went too far in requiring continuous monitoring or penetration and vulnerability testing, while others thought the proposal did not go far enough. On one hand, ACE argued continuous monitoring is too burdensome and difficult for some financial institutions,238 particularly those with ‘‘highly decentralized systems,’’ such as colleges and universities, which could be required to monitor their entire system.239 ACE further suggested the Rule should not prescribe any particular testing methodology or schedule and should allow financial institutions to develop a testing approach appropriate for the financial institution.240 The NPA commented penetration and vulnerability testing would be too expensive for small pawnbrokers with small staffs and a small customer base, where their members would be ‘‘likely to notice a penetration of our records.’’ 241 One commenter stated the requirements for monitoring and testing were ‘‘overlapping and confusing’’ and suggested the Commission avoid confusion by including continuous monitoring, penetration testing, vulnerability scanning, periodic risk assessment reviews, and logging as optional components of an information security program to be included on an as-needed basis.242 Some commenters recommended the testing requirement be limited to electronic data and exclude monitoring of physical data.243 The American Financial Services Association argued the testing of physical safeguards required by paragraph (d)(1) ‘‘would be impossible.’’ 244 Finally, CTIA argued, for entities that choose the approach of penetration and vulnerability testing, these tests should be required less regularly.245 On the other hand, the Princeton Center suggested, rather than requiring either continuous monitoring or penetration testing, the Rule should require both. It noted continuous monitoring is very effective at detecting problems with, and threats to, ‘‘off-theshelf systems’’ but penetration testing is better at ‘‘for checking the interaction between systems, proprietary systems, or subtle security issues.’’ 246 Similarly, the MSRT was concerned that the Proposed Rule suggested annual penetration testing alone could protect financial institutions, rather than serve as a supplement to proper monitoring.247 The Commission agrees with commenters who pointed out the difficulty of applying certain testing requirements to physical safeguards. Although the general testing requirement set forth in paragraph (d)(1) should apply to physical safeguards (e.g., testing effectiveness of physical locks), the continuous monitoring, vulnerability assessment, and penetration testing in paragraph (d)(2) is not relevant to information in physical form. Accordingly, the final version of paragraph (d)(2) is limited to safeguards on information systems.

The Commission also agrees biannual vulnerability testing may not be sufficient to detect new threats. Thus, given the relative ease with which vulnerability assessments can be performed, it modifies the Final Rule to require financial institutions to perform assessments when there is an elevated risk of new vulnerabilities having been introduced into their information systems, in addition to the required biannual assessments.

Beyond these modifications, the Commission believes the proposal struck the right balance between flexibility and protection of customer information, and adopts the proposed provision as final. For commenters concerned about costs of testing and continuous monitoring, the Commission notes the Rule requires one, not both. Although many financial institutions may choose to use both, the Commission agrees the costs of requiring both for all financial institutions may not be justified. 248 As to arguments that the testing required by the Rule is too frequent and will therefore be too costly, the Commission does not agree vulnerability assessments will be costly. Indeed, there are resources for free and automated vulnerability assessments.249 And although the Commission acknowledges penetration testing can be a somewhat lengthy and costly process for large or complex systems,250 a longer period between penetration tests will leave information systems vulnerable to attacks that exploit weaknesses normally revealed by penetration testing.

Two other portions of the Final Rule should help financial institutions concerned about the costs of monitoring and testing. First, because the Commission is limiting the definition of ‘‘information system’’ in the Final Rule, financial institutions will be able to limit this provision’s application by segmenting their network and conducting monitoring or testing only of systems that contain customer information or that are connected to such systems. Second, this requirement does not apply to those institutions that VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00023 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 220

70294 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 251 Proposed 16 CFR 314.4(e)(1). 252 Electronic Privacy Information Center (comment 55, NPRM), at 8. 253 U.S. Chamber of Commerce (comment 33, NPRM), at 12; see also American Financial Services Association (comment 41, NPRM), at 6 (stating the Commission should acknowledge that a training program for a small financial institution will be different than a program for a larger program). 254 National Automobile Dealers Association (comment 46, NPRM), at 34. 255 Proposed 16 CFR 314.4(e)(2). 256 National Automobile Dealers Association (comment 46, NPRM), at 35; National Independent Automobile Dealers Association (comment 48, NPRM), at 7.

257 National Automobile Dealers Association (comment 46, NPRM), at 35. 258 NADA also asks whether this provision would require financial institutions to hire more personnel if they do not have enough qualified staff. Id. The Final Rule does require the hiring of additional personnel if existing personnel are not enough to maintain the financial institution’s information security program.

259 One commenter, on the other hand, approved of the decision not to define ‘‘qualified’’ in the Proposed Rule, but argued the requirement in its totality was unclear because it did not set forth ‘‘how the Commission would hold covered entities accountable.’’ American Council on Education (comment 24, NPRM) at 14. The Commission believes the term ‘‘qualified’’ provides a clear enough requirement to allow a financial institution’s compliance to be evaluated. maintain records on fewer than 5,000 individuals. Accordingly, for example, it should not apply to businesses small enough for staff to personally know a majority of customers.

Finally, the Commission does not believe the testing requirements are duplicative of other provisions of the Final Rule. The provision relating to additional risk assessments, § 314.4(b)(2), requires a financial institution to reevaluate its risks and to determine if safeguards should be modified or added—it does not require testing to detect threats and technical vulnerabilities in the existing system. Section 313.4(c)(8)’s requirement that financial institutions monitor users’ activity in an information system is focused on one aspect of information security—detecting and preventing unauthorized access and use of the system. The requirement of this paragraph, on the other hand, is focused on testing the overall effectiveness of a financial institution’s safeguards. It is broader than paragraph (c)(8)’s requirement and is necessary to ensure financial institutions test the strength of their safeguards as a whole. Accordingly, the Final Rule requires financial institutions to perform vulnerability assessments at least once every six months and, additionally, whenever there are material changes to their operations or business arrangements and whenever there are circumstances they know or have reason to know may have a material impact on their information security program. Proposed Paragraph (e) Proposed paragraph (e) set forth a requirement that financial institutions implement policies and procedures ‘‘to ensure that personnel are able to enact [the financial institution’s] information security program.’’ This requirement included four components: (1) General employee training; (2) use of qualified information security personnel; (3) specific training for information security personnel; and (4) verification that security personnel are taking steps to maintain current knowledge on security issues.

General Employee Training Proposed paragraph (e)(1) required financial institutions to provide their personnel with ‘‘security awareness training that is updated to reflect risks identified by the risk assessment.’’ 251 While one commenter specifically supported the inclusion of this training requirement,252 the U.S. Chamber of Commerce argued the Rule should not have any specific training requirements at all.253 NADA stated the requirement that the training be ‘‘updated to reflect risks identified by the risk assessment’’ will require companies to develop individualized training programs to suit their financial institution and that such a process would be expensive and unnecessary because ‘‘general security awareness’’ is generally enough for most financial institutions.254 Given the current Rule includes a similar training requirement and training remains a vital part of effective information security, the Commission declines to eliminate it. The Commission believes the Final Rule’s training requirement retains the same flexibility as the existing Rule and allows financial institutions to adopt a training program appropriate to their organization.

The Commission disagrees with NADA’s concern the requirement to update training programs would be too expensive. Without a requirement that the training program be updated based on an assessment of risks, employees may be subject to the same training year after year, which might reflect obsolete threats, as opposed to addressing current ones. The Commission interprets this provision to require only that the training program be updated as necessary based on changes in the financial institution’s risk assessment. The provision also gives financial institutions the flexibility to use programs provided by a third party, if that program is appropriate for the financial institution. In order to clarify updates are required only when needed by changes in the financial institution or new security threats, though, the Final Rule states training programs need to be updated only ‘‘as necessary.’’ Information Security Personnel Proposed paragraph (e)(2) required financial institutions to ‘‘[u]tiliz[e] qualified information security personnel,’’ employed either by them or by affiliates or service providers, ‘‘sufficient to manage [their] information security risks and to perform or oversee the information security program.’’ 255 This proposed provision was designed to ensure information security personnel used by financial institutions are qualified for their positions and information security programs are sufficiently staffed.

Some commenters argued this provision was too vague because it does not define what personnel are necessary and what ‘‘qualified’’ means.256 NADA argued hiring additional staff to meet this requirement could be prohibitively expensive.257 As discussed in relation to the appointment of a ‘‘Qualified Individual,’’ the Commission believes a more specific definition of ‘‘qualified’’ would not be appropriate because each financial institution has different needs and different levels of training, experience, and expertise will be appropriate for the information security staff of each institution. The term ‘‘qualified’’ conveys only that staff must have the abilities and expertise to perform the duties required by the information security program.258 The Commission declines to include a more prescriptive set of qualification requirements in the Final Rule.259 As to the concern about expense, the Commission acknowledges hiring employees or retaining third parties to maintain financial institutions’ information security programs can be a substantial expense. But the expense is necessary to effectuate Congressional intent that financial institutions implement reasonable safeguards to protect customer information. The Rule requires only that a financial institution have personnel ‘‘sufficient’’ to manage its risk and to maintain its information security program. A financial institution is required only to have the staff necessary to maintain its information security. An information security program that is not properly maintained cannot offer the protection it is designed to provide. A financial institution that VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00024 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 221

70295 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 260 See, e.g., Slides Accompanying Remarks of Rocio Baeza, ‘‘Models for Complying to the Safeguards Rule Changes,’’ in Safeguards Workshop Slides, supra note 72, at 27–28 (describing three different compliance models: In-house, outsource, and hybrid, with costs ranging from $199 per month to more than $15,000 per month); see also remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 81–83; slides Accompanying Remarks of Brian McManamon, ‘‘Sample Pricing,’’ in Safeguards Workshop Slides, supra note 72, at 29 (estimating the cost of cybersecurity services based on number of endpoints); Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 83–85.

261 Proposed 16 CFR 314.4(e)(3). 262 National Automobile Dealers Association (comment 46, NPRM), at 35. 263 See, e.g., Federal Trade Commission, Cybersecurity for Small Business, https:// www.ftc.gov/tips-advice/business-center/smallbusinesses/cybersecurity (last accessed 1 Dec. 2020); Remarks of Kiersten Todt, Safeguards Workshop Tr. at 86–88 (describing the resources of the Cyber Readiness Institute). 264 The Clearing House suggested the Rule should require background checks on employees. The Clearing House (Comment 49, NPRM) at 19. 265 Proposed 16 CFR 314.4(e)(4). 266 National Automobile Dealers Association (comment 46, NPRM), at 35–36. 267 Proposed 16 CFR 314.4(g). 268 The Clearing House wrote in support of this element of the Proposed Rule, noting it would bring the Safeguards Rule’s provisions relating to service provider oversight into better alignment with security guidelines for banks. The Clearing House (comment 49, NPRM), at 14. 269 National Automobile Dealers Association (comment 46, NPRM), at 37; National Independent Automobile Dealers Association (comment 48, NPRM), at 7; see also Wangyang Shen (comment 3, Privacy Rule) (noting difficulty of supervising cloud services).

270 National Automobile Dealers Association (comment 46, NPRM), at 22; National Association of Dealer Counsel (comment 44, NPRM), at 3. 271 Internet Association (comment 9, Workshop), at 3–4.

does not comply with this requirement, by definition, has insufficient staffing, and thus, cannot reasonably protect customer information.

Although the expense is necessary, the level of expense is mitigated by several factors. First, existing financial institutions should already have information security personnel (either in the form of employees or third-party service providers) qualified to perform the duties necessary to maintain reasonable security in order to comply with the requirements of the current Rule. Depending on the skills of those employees, additional staffing may not be necessary to meet the demands of the Final Rule. Second, the required staffing will vary greatly based on the size and complexity of the information system. A financial institution with an extremely simple system may not require even a single full time employee. Finally, the Rule allows the use of service providers to meet this requirement. This can significantly reduce costs as services exist to share the expense of qualified personnel and offer information security support at significantly less than the cost of employing a single qualified employee.260 The Commission continues to believe utilizing qualified and sufficient information security personnel is a vital part of any information security program and accordingly, adopts proposed paragraph (e)(2) in the Final Rule without modification.

Training of Security Personnel The Proposed Rule also required financial institutions to ‘‘[p]rovid[e] information security personnel with security updates and training sufficient to address relevant security risks.’’ 261 This is separate from paragraph (e)(1)’s requirement to train all personnel generally.

Some commenters argued providing ongoing training could be too costly for some financial institutions.262 The Commission disagrees. Maintaining awareness of emerging threats and vulnerabilities is a critical aspect of information security. In order to perform their duties, security personnel must be educated on the changing nature of threats to the information systems they maintain. There are resources that will allow smaller institutions to meet this requirement at little or no cost, such as published security updates, online courses, and educational publications.263 For financial institutions that utilize service providers to meet information security needs, the service provider is likely to include assurances that provided personnel will be trained in current security practices. The Commission views the use of such a service provider as meeting this requirement, as the financial institution is ‘‘providing’’ the service as part of the price it pays to the service provider. Thus, the Final Rule adopts paragraph (e)(3) as proposed.264 Verification of Current Knowledge Proposed paragraph (e)(4) required financial institutions to ‘‘[v]erify[ ] that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures.’’ 265 This requirement was intended to complement the proposed requirement regarding ongoing training of data security personnel, by requiring verification such training has taken place.

NADA argued this requirement should not apply to smaller financial institutions, stating the examples set forth in the Proposed Rule would be difficult for some smaller financial institutions to perform.266 The examples provided with the Proposed Rule were that a financial institution could: (1) Offer incentives or funds for key personnel to undertake continuing education that addresses recent developments, (2) include a requirement to stay abreast of security research as part of their performance metrics, or (3) conduct an annual assessment of key personnel’s knowledge of threats related to their information system. The Commission believes smaller financial institutions can take advantage of any of these methods, particularly ‘‘requiring key personnel to undertake continuing education’’ as part of that personnel’s duties. If they outsource responsibility for data security to service providers, they can simply include these requirements in their contracts. The Commission believes the rapidly changing nature of information security mandates this requirement, in order that information security leadership can properly supervise the information security program. Accordingly, the Final Rule adopts proposed paragraph (e)(4) without change.

Proposed Paragraph (f) Proposed paragraphs (f)(1) and (2) retained the current Rule’s requirement, found in existing paragraphs (d)(1) and (2), to oversee service providers, and added a paragraph (f)(3), requiring financial institutions also periodically assess service providers ‘‘based on the risk they present and the continued adequacy of their safeguards.’’ 267 The current Rule expressly requires an assessment of service providers’ safeguards only at the onboarding stage; proposed paragraph (f)(3) required financial institutions to monitor their service providers on an ongoing basis to ensure they are maintaining adequate safeguards to protect customer information they possess or access.268 Several commenters argued it would be costly and difficult for some financial institutions to periodically assess their service providers.269 These commenters were particularly concerned with smaller financial institutions’ ability to ‘‘monitor’’ larger service providers.270 The Internet Association commented the requirement to periodically assess service providers would be too onerous for the service providers themselves, arguing the requirement would place ‘‘service providers under constant surveillance by their financial institution clients.’’ 271 HITRUST suggested the Rule should state the periodic assessment requirement may be satisfied by requiring service providers to obtain and maintain information VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00025 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 222

70296 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 272 HITRUST (comment 18, NPRM), at 3–4. 273 Consumer Reports (comment 52, NPRM) at 7. 274 American Financial Services Association (comment 41, NPRM), at 7. 275 For example, in 2013, attackers were reportedly able to use stolen credentials obtained from a third-party service provider to access a customer service database maintained by national retailer Target Corporation, resulting in the theft of information relating to 41 million customer payment card accounts. Kevin McCoy, Target to pay $18.5M for 2013 data breach that affected 41 million consumers, USA Today, May 23, 2017, https://www.usatoday.com/story/money/2017/05/ 23/target-pay-185m-2013-data-breach-affectedconsumers/102063932/.

276 The National Pawnbrokers Association expressed concern they cannot control vendors of local law enforcement agencies to whom they are required to provide customer information. National Pawnbrokers Association (comment 32, NPRM), at 2. However, the Rule does not require financial institutions oversee service providers employed by other entities over which they have no control. 277 Consumer Reports (comment 52, NPRM), at 6; Princeton University Center for Information Technology Policy (comment 54, NPRM), at 7; Electronic Privacy Information Center (comment 55, NPRM), at 8; Credit Union National Association (comment 30, NPRM), at 2; Heartland Credit Union Association (comment 42, NPRM), at 2; National Association of Federally-Insured Credit Unions (comment 43, NPRM), at 1; HITRUST (comment 18, NPRM), at 2.

278 Credit Union National Association (comment 30, NPRM), at 2.

279 Consumer Reports (comment 52, NPRM), at 6. security certifications provided by third parties and based on proper information security frameworks.272 In contrast, Consumer Reports took issue with the Rule requiring only ‘‘assessment’’ of service providers, and argued financial institutions should be required to monitor their service providers for compliance.273 Yet other commenters expressed confusion over the term ‘‘service provider,’’ asking whether it would cover national consumer reporting agencies that smaller financial institutions would be hard-pressed to assess.274 The Commission retains the service provider oversight requirement from proposed paragraph (f) without modification. Some high profile breaches have been caused by service providers’ security failures,275 and the Commission views the regular assessment of the security risks of service providers as an important part of maintaining the strength of a financial institution’s safeguards. The Commission disagrees with the commenters who expressed concerns this provision, and particularly the assessment requirement, would impose undue costs on financial institutions. The Rule would require financial institutions only to assess the risks service providers present and evaluate whether they continue to provide the safeguards required by contract, which need not include extensive investigation of a service provider’s systems. In the case of large service providers, this oversight may consist of reviewing public reports of insecure practices, changes in the services provided, or security failures in the services provided. In other circumstances, such as where a large company hires a vendor to secure sensitive customer information, certifications, reports, or even third-party audits may be appropriate. The exact steps required depend both on the size and complexity of the financial institution and the nature of the services provided by the service provider. For this reason, the Commission declines to adopt the suggestion to allow a financial institution to accept an information security certification from the service provider to satisfy the service provider oversight requirement. The fact that a company maintains an information security certification may be a significant part of assessing the adequacy of a service provider’s safeguards, but the Commission declines to prescribe a one-size-fits all approach, given the variation in size and complexity of financial institutions and their service providers. To avoid imposing undue costs on financial institutions, the Commission declines to require ongoing monitoring, rather than periodic assessment, as recommended by Consumer Reports. The Commission believes periodic assessment strikes the right balance between protecting consumers and imposing undue costs on financial institutions. The Commission acknowledges financial institutions may have limited bargaining power in obtaining services from large service providers and limited ability to demand access to a service provider’s systems. In those cases, any sort of hands-on assessment of the provider’s systems may not be possible.

As to the concern the assessment requirement will impose undue burdens on the service providers themselves, the Commission does not believe this concern justifies a modification to the proposed requirement. First, the Rule does not require ‘‘constant surveillance’’ by financial institutions—they are required only to ‘‘periodically assess’’ the risks presented by service providers. Second, as discussed above, the supervision of service providers is a vitally important aspect of information security, and while there may be some burdens on the service providers associated with being supervised, these are necessary burdens. A financial institution must be sure a service provider is protecting the information of its customers, and any expenses this involves are a necessary part of fulfilling this duty.

Finally, as to concerns about potential ambiguities in the definition of service provider, the amendments preserve the definition in the current Rule. Thus, entities subject to this requirement under the Final Rule will remain the same as under the existing Rule and may include consumer reporting agencies. As discussed above, even larger service providers such as national CRAs can be subjected to some form of review by financial institutions.276 The Commission adopts proposed paragraph (f) in the Final Rule without modification.

Proposed Paragraph (g) Paragraph (g) of the Proposed Rule retained the language of existing paragraph (e) in the current Rule, which requires financial institutions to evaluate and adjust their information security programs in light of the result of testing required by this section, material changes to their operations or business arrangements, or any other circumstances they know or have reason to know may have a material impact on their information security program. The Commission received no comments on this paragraph and adopts the language of the Proposed Rule.

Proposed Paragraph (h) Proposed paragraph (h) required financial institutions to establish written incident response plans that addressed (1) the goals of the plan; (2) the internal processes for responding to a security event; (3) the definition of clear roles, responsibilities and levels of decision-making authority; (4) external and internal communications and information sharing; (5) identification of requirements for the remediation of any identified weaknesses in information systems and associated controls; (6) documentation and reporting regarding security events and related incident response activities; and (7) the evaluation and revision as necessary of the incident response plan following a security event.

Several commenters supported the proposal to require an incident response plan.277 The Credit Union National Association observed an incident response plan ‘‘helps ensure that an entity is prepared in case of an incident by planning how it will respond and what is required for the response.’’ 278 Consumer Reports noted a rapid response to a security event can limit damage caused by the event.279 The VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00026 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 223

70297 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 280 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 7. 281 HITRUST (comment 18, NPRM), at 2. 282 South Carolina Department of Consumer Affairs (comment 47, NPRM), at 2. 283 National Automobile Dealer Association (comment 46, NPRM), at 38; National Independent Automobile Dealers Association (comment 48, NPRM), at 7.

284 National Automobile Dealer Association (comment 46, NPRM), at 38. 285 National Automobile Dealer Association (comment 46, NPRM), at 12, 38–39. NPA also asked for greater detail on what constitutes an ‘‘incident.’’ National Pawnbroker Association (comment 32, NPRM), at 4.

286 American Council on Education (comment 24, NPRM), at 15.

287 Mortgage Bankers Association (comment 26, NPRM), at 4.

288 Mortgage Bankers Association (comment 26, NPRM), at 4.

289 American Council on Education (comment 24, NPRM), at 15.

290 Id.

291 National Pawnbroker Association (comment 32, NPRM), at 4.

292 See Remarks of Serge Jorgenson, Safeguards Workshop Tr., supra note 17, at 52 (observing a prompt response to an incident can prevent a ‘‘threat actor running around in my environment for days, months, years, and able to access anything they want.’’).

293 Although the Commission agrees with the South Carolina Department of Consumer Affairs that notification of senior personnel is valuable, the requirement that the plan address ‘‘the definition of clear roles, responsibilities and levels of decisionmaking authority’’ will almost always result in communication of decision-making to senior personnel authorized to make decisions about the security response. Coupled with the requirement the Qualified Individual report to the board or equivalent body on material events affecting security, the Commission does not see the need to make this change.

294 See, e.g., FTC, Data Breach Response: A Guide for Business (2019), www.ftc.gov/tips-advice/ business-center/guidance/data-breach-responseguide-business; NIST, Guide for Cybersecurity Event Recovery (2016), nvlpubs.nist.gov/nistpubs/ SpecialPublications/NIST.SP.800-184.pdf; Orion Cassetto, Incident Response Plan 101: How to Build One, Templates and Examples, Exabeam: Information Security Blog (November 21, 2018), www.exabeam.com/incident-response/incidentresponse-plan/ (last visited December 2, 2020). Princeton Center commented ‘‘a written incident response plan is an essential component of a good security system.’’ 280 HITRUST commented incident response plans can help organizations ‘‘to better allocate limited resources.’’ 281 The South Carolina Department of Consumer Affairs suggested the provision go further by requiring the incident response plan include a process for notifying senior information security personnel of the event.282 Other commenters opposed requiring an incident response plan or objected to particular aspects of the requirement. Some commenters suggested requiring financial institutions to have incident response plans is outside the Commission’s authority under the GLB Act.283 NADA argued the requirement for an incident response plan was overbroad in light of the broad definition of security event,284 and the requirement was vague as to what the plan should include.285 Other commenters argued the requirement was too burdensome. ACE argued ‘‘the range of security events that might occur and their potential impacts on institutional capacity to recover’’ make establishing an incident response plan that will allow an institution to ‘‘respond to, and recover from, any security event materially affecting . . . customer information’’ impossible.286 The Mortgage Bankers Association (‘‘MBA’’) suggested ‘‘institutions of smaller sizes may not necessarily be capable of addressing all seven of the proposed goals.’’ 287 Further, the MBA argued an incident response plan requirement had ‘‘the potential to cripple small businesses under the pressure of repeatedly checking the boxes for potentially harmless events.’’ 288 Finally, some commenters raised questions about what it means for customer information to be in a financial institution’s ‘‘possession’’ for purposes of the incident response plan requirement. ACE argued the requirement does not adequately account for customer information held in cloud storage operated by third parties, asserting such information is not technically within the financial institution’s possession.289 ACE suggested the provision should apply to customer information for which the financial institution is responsible, instead.290 Relatedly, the NPA expressed concern pawnbrokers might be subject to liability under the Proposed Rule when law enforcement agencies or their third-party vendors make public disclosures of customer information pawnbrokers are obligated to report.291 The Commission retains the requirement for financial institution to develop and implement an incident response plan, with one modification described below. The Commission believes the creation of an incident response plan is directly related to safeguarding customer information and is within its authority under the GLBA. The requirement to create an incident response plan focuses on preparing financial institutions to respond promptly and appropriately to security events, and mitigating any weaknesses in their information systems in the process. By responding quickly and promptly mitigating weaknesses, financial institutions can stop ongoing or future compromise of customer information.292 A well-organized response to a security event can limit the number of consumers affected by an outside attacker by promptly identifying the attack and taking steps to stop the attack.

The Commission disagrees with the commenters who stated this requirement was too burdensome. The Final Rule requires incident response plans address ‘‘security event[s] materially affecting the confidentiality, integrity, or availability of customer information in [a financial institution’s] control.’’ Significantly, the plan must address events that ‘‘materially’’ affect customer information. Thus, the required incident response plan does not require a plan to address every security event that may occur. The plan need not include minute details or all possible scenarios. Instead, the Rule requires the plan to establish a system— for example, by laying out clear lines of responsibility, systems for information sharing, and methods for evaluating possible solutions—that will facilitate a financial institution’s response to security events regardless of the nature of the event. A detailed approach may be appropriate for some financial institutions, such as those with especially complicated systems or personnel hierarchies, but the Rule is designed to give financial institutions the flexibility needed to develop plans that best suit their needs.293 Moreover, the Commission believes the requirement is clear as to what an incident response plan should include. The seven listed requirements for the incident response plans provide sufficient guidance to financial institutions designing incident response plans while giving them flexibility to design a plan suited to their organization. In addition, there are many resources for designing incident response plans available for financial institutions, as well as service providers that can assist with the design process.294 Individual institutions can determine the exact details of the plans. To address questions about whether information is in the financial institution’s ‘‘possession,’’ the Commission is revising paragraph (h) of the Final Rule to require financial institutions develop incident response plans ‘‘designed to promptly respond to, and recover from, any security event materially affecting . . . customer information in your control.’’ (emphasis added) Replacing the term ‘‘possession’’ with ‘‘control’’ resolves the questions raised by ACE and the NPA regarding VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00027 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 224

70298 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 295 NADA further argued the incident response plan constitutes a de facto consumer notification requirement. National Automobile Dealer Association (comment 46, NPRM), at 39. Financial institutions have an independent obligation to perform notification as required by state law, whether or not they have an incident response plan in place. The fact that the Rule requires a plan that sets forth procedures for satisfying that requirement does not impose any independent notification requirement on the financial institution. 296 Consumer Reports (comment 52, NPRM), at 6; Princeton University Center for Information Technology Policy (comment 54, NPRM), at 7; Credit Union National Association (comment 30, NPRM), at 2; Heartland Credit Union Association (comment 42, NPRM), at 2; National Association of Federally-Insured Credit Unions (comment 43, NPRM), at 1–2.

297 Princeton University Center for Information Technology Policy (comment 54, NPRM), at 7. 298 National Association of Federally-Insured Credit Unions (comment 43, NPRM), at 1. 299 National Association of Federally-Insured Credit Unions (comment 43, NPRM), at 1–2. 300 National Independent Automobile Dealers Association (comment 48, NPRM), at 7; American Council on Education (comment 24, NPRM), at 15. 301 American Council on Education (comment 24, NPRM), at 15.

302 Id.

303 Standards for Safeguarding Customer Information, SNPRM, published elsewhere in this issue of the Federal Register. 304 Proposed 16 CFR 314.4(i). 305 Rocio Baeza (comment 12, Workshop), at 3–8 (supporting requirement and providing sample report form and compliance questionnaire); see also The Clearing House (comment 49, NPRM), at 15– 16 (arguing that Rule should require more involvement from Board and senior management). 306 Remarks of Michele Norin, Safeguards Workshop Tr., supra note 17, at 194. 307 Remarks of Adrienne Allen, Safeguards Workshop Tr., supra note 17, at 199–200. 308 American Council on Education (comment 24, NPRM), at 16.

309 Id.

310 Id.

311 National Automobile Dealer Association (comment 46, NPRM), at 41. NADA also argued the whether financial institutions must plan for security events affecting data that has been transferred to various kinds of third parties. Where a financial institution has voluntarily opted to store its customer information in the cloud, to whatever extent the information is no longer in the ‘‘possession’’ of the financial institution, it is certainly within the institution’s ‘‘control.’’ By contrast, customer information that has been obtained by a third party such as a law enforcement agency, over whom a financial institution has no authority and of whose actions the financial institution has no knowledge, cannot fairly be said to be in the financial institution’s control. Consequently, the financial institution need not account for possible disclosures of that information by the third party.295 Notification of Security Events to the Commission The Commission also requested comment on whether the Rule should require financial institutions to report security events to the Commission. Several commenters supported this requirement.296 The Princeton University Center for Information Technology Policy noted such a reporting requirement would ‘‘provide the Commission with valuable information about the scope of the problem and the effectiveness of security measures across different entities’’ and ‘‘help the Commission coordinate responses to shared threats.’’ 297 The National Association of Federally-Insured Credit Unions argued requiring financial institutions to report security events to the Commission would provide an ‘‘appropriate incentive for covered financial companies to disclose information to consumers and relevant regulatory bodies.’’ 298 NAFCU also suggested notification requirements are important because they ‘‘ensure independent assessment of whether a security incident represents a threat to consumer privacy.’’ 299 Other commenters opposed the inclusion of a reporting requirement.300 ACE argued such a requirement ‘‘would simply add another layer on top of an already crowded list of federal and state law enforcement contacts and state breach reporting requirements.’’ 301 ACE also suggested any notification requirement should be limited to a more restricted definition of ‘‘security event’’ than the definition in the Proposed Rule, so financial institutions would only be required to report incidents that could lead to consumer harm.302 The Commission agrees with commenters that stated a requirement financial institutions report security events to the Commission would have many benefits, including allowing the Commission to identify emerging threats and assisting the Commission’s enforcement of the Rule. In addition, such a requirement would be unlikely to create a significant burden on financial institutions because a security event that leads to notification to the Commission is very likely to create breach notification obligations under various state laws, and the financial institution will thus already be engaged in notifying consumers and state regulators. The addition of a notification to the FTC would not require any significant additional preparation or effort. However, because the notice of proposed rulemaking did not set forth a detailed proposal for a notification requirement, the Final Rule does not include such a requirement. Instead, the Commission is issuing a supplemental notice of proposed rulemaking (SNPRM) that proposes adding a requirement financial institutions notify the Commission of detected security events under certain circumstances.303 Proposed Paragraph (i) Proposed paragraph (i) required a financial institution’s CISO to ‘‘report in writing, at least annually, to [the financial institution’s] board of directors or equivalent governing body’’ regarding the following information: (1) The overall status of the information security program and financial institution’s compliance with the Safeguards Rule; and (2) material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management’s responses thereto, and recommendations for changes in the information security program.304 For financial institutions that did not have a board of directors or equivalent, the proposal required the CISO to make the report to a senior officer responsible for the financial institution’s information security program.

One commenter supported this requirement.305 Additionally, several workshop participants emphasized the value of communication between information security leaders and corporate boards or their equivalent. For example, workshop participant Michele Norin stated it is ‘‘important’’ for the topic of information security to be discussed at the level of the board or senior leadership regularly, and at least once per year.306 Participant Adrienne Allen agreed annual reporting made sense as a requirement, but noted for some financial institutions, particularly those with an online presence, even more frequent communication could be beneficial.307 ACE argued the Proposed Rule created too much emphasis on a single annual report and should instead focus on regular reporting to the Board or equivalent.308 It also expressed concern the report required by the Proposed Rule would be too detailed and would not allow the Board to see ‘‘the forest for the trees,’’ 309 the requirements for the report were too prescriptive, and the requirements focused too much on compliance rather than security.310 Similarly, NADA argued the report would not improve security but would instead create ‘‘unnecessary liability exposure for the board/leadership of the entity.’’ 311 HITRUST suggested VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 225

70299 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations reports by third-party Qualified Individuals might not include useful information and were ‘‘more likely to be filled with platitudes and/or efforts to ‘upsell’ the dealership on additional CISO services.’’ Id. at 42. NADA provided no support for this claim. The Commission notes such a report would not meet the requirements of this provision, and the financial institution would be justified in terminating their relationship with that provider or, at least, demanding a revised report that did meet those requirements.

312 HITRUST (comment 18, NPRM), at 4. 313 See Remarks of Karthik Rangarajan, Safeguards Workshop Tr., supra note 17, at (‘‘If quarter over quarter, year over year, this watermark isn’t reducing, then board of directors should be able to challenge us and say maybe you’re not mapping your risks correctly, or vice versa if it’s reducing but we’re seeing more incidents, we’re seeing potential breaches, things like that, then the board of directors should be able to say maybe you don’t have the right risk quantification framework or the right risk management framework.’’). 314 Workshop participants Adrienne Allen, Karthik Rangarajan, and Michele Norin each emphasized this point. See Safeguards Workshop Tr., supra note 17, pp. 201–09. 315 See Juhee Kwon Jackie Rees Ulmer, & Tawei Wang, The Association Between Top Management Involvement and Compensation and Information Security Breaches, Journal of Information Systems, Spring 2013, at 219–236 (‘‘. . . the involvement of an IT executive decreases the probability of information security breach reports by about 35 percent . . .’’); Julia L. Higgs, Robert E. Pinsker, Thomas Joseph Smith, & George Young, The Relationship Between Board-Level Technology Committees and Reported Security Breaches, Journal of Information Systems, Fall 2016, at 79–98 (‘‘[A]s a technology committee becomes more established, its firm is not as likely to be breached. To obtain further evidence on the perceived value of a technology committee, this study uses a returns analysis and finds that the presence of a technology committee mitigates the negative abnormal stock returns arising from external breaches.’’). 316 Indeed, workshop participants discussed a variety of strategies for meaningful communication between security personnel and senior leadership. Participants noted the proper content, style, and cadence of reporting (beyond the minimum annual report) will vary depending on, among other things, the type of financial institution in question and the level of familiarity of leadership with the relevant technical issues. See Safeguards Workshop Tr., supra note 17, at 194–200. 317 NADA argued reports required by this provision would be expensive because the Proposed Rule stated they would need to be prepared by a ‘‘CISO,’’ which NADA takes to mean a highly compensated expert of the type retained by the most sophisticated large institutions. National Automobile Dealer Association (comment 46, NPRM), at 41. As discussed above, however, the Rule does not require all financial institutions to retain such an expert. Instead, the report will be made by the Qualified Individual, whose expertise and compensation will vary according to the size and complexity of a financial institution’s information system.

318 National Automobile Dealer Association (comment 46, NPRM), at 41 n.126; American Council on Education (comment 24, NPRM), at 16. 319 American Council on Education (comment 24, NPRM), at 16.

320 American Council on Education (comment 24, NPRM), at 4–5.

Qualified Individuals should be able to meet this reporting requirement by submitting a report from an information security certification program to the Board or equivalent body.312 The Commission adopts the proposal as final, with one modification discussed below. This provision is intended to ensure the governing body of the financial institution is engaged with and informed about the state of the financial institution’s information security program. Likewise, this will create accountability for the Qualified Individual by requiring him or her to set forth the status of the information security program for the governing body.313 This will help financial institutions to ensure their information security programs are being maintained appropriately and given the necessary resources. Written reports will create a record of decisions made and the information upon which they were based, which may aid future decisionmaking.314 Management involvement in information security programs can improve the strength of those programs and help to reduce breaches.315 The Commission disagrees with the commenters who stated the reporting requirement would be too prescriptive. In fact, the language only requires reporting of (1) the overall status of the information security program and its compliance with this Rule; and (2) material matters related to the information security program. The language includes examples of what material matters might include, such as risk assessments and security events, but does not require all of them be included. The financial institution and the Qualified Individual will be responsible for determining what is material for their organization. The Commission does not believe these requirements call for overly detailed reports.316 Although the Commission agrees a certification report from a Qualified Individual could be a part of the annual report and may cover many material matters, it may not suffice in all cases; thus, the Commission declines to include such a one-size-fits-all requirement.

As to the suggestion to require ‘‘regular’’ reporting, the Commission agrees more regular reporting may be the best approach for many financial institutions. To this end, the Commission modifies the requirement in the final rule to say ‘‘regularly, and at least annually.’’ 317 Beyond this modification, the Final Rule adopts proposed paragraph (i) as proposed. Board Certification The Commission specifically sought comment on whether the Board or equivalent should be required to certify the contents of the report. The two commenters who addressed this question stated they should not.318 ACE noted ‘‘governing boards generally will not have the knowledge and expertise to independently certify’’ the technical aspects of the report and certification might require the employment of outside auditors.319 The Commission agrees senior management of financial institutions will often lack the technical expertise to personally attest to its validity. In addition, the primary purpose of the required report is to encourage communication between information security personnel and senior management, not to show compliance with the Rule. Requiring the governing board to certify the contents of the report would likely transform the report into a compliance document and might reduce its efficacy as a communication between the Qualified Individual and the Board. Accordingly, the Commission declines to adopt this requirement in the Final Rule. § 314.5: Effective Date The Proposed Rule set a new effective date for some portions of the Rule. Proposed § 314.5 provided certain elements of the information security program would not be required until six months after the publication of a final rule, rather than immediately upon publication. The paragraphs that would have a delayed effective date were: § 314.4(a), related to the appointment of a Qualified Individual; § 314.4(b)(1), relating to conducting a written risk assessment; § 314.4(c)(1) through (8), setting forth the new elements of the information security program; § 314.4(d)(2), requiring continuous monitoring or annual penetration testing and biannual vulnerability assessment; § 314.4(e), requiring training for personnel; § 314.4(f)(3), requiring periodic assessment of service providers; § 314.4(h), requiring a written incident response plan; and § 314.4(i), requiring annual written reports from the Qualified Individual. All other requirements under the Safeguards Rule would remain in effect during this sixmonth period. These remaining requirements largely mirrored the requirements of the existing Rule. All commenters that addressed this provision noted the difficulty of complying with some of the provisions of the Proposed Rule, and argued financial institutions should be given more time to comply with them. ACE suggested financial institutions be given one year to create a plan for compliance and two years to come into actual compliance.320 AFSA suggested compliance not be required for two VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00029 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 226

70300 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 321 American Financial Services Association (comment 41, NPRM), at 7. 322 ACA International (comment 45, NPRM), at 10–11.

323 Proposed 16 CFR 314.6. 324 Consumer Reports (comment 52, NPRM), at 6; see also Credit Union National Association (comment 30, NPRM), at 2 (noting the exemption will be helpful for smaller businesses, but suggesting other changes to the Proposed Rule so the exemption is not required). 325 National Pawnbrokers Association (comment 32, NPRM), at 6.

326 Id.; see also National Independent Automobile Dealers Association (comment 48, NPRM), at 3. 327 ACA International (comment 45, NPRM), at 11–12.

328 American Council on Education (comment 24, NPRM), at 5.

329 Ahmed Aly (comment 22, NPRM). 330 ACA International (comment 45, NPRM), at 11–12.

331 American Financial Services Association (comment 41, NPRM), at 3–4. 332 National Automobile Dealers Association (comment 46, NPRM), at 43–44. NADA also suggested information about customers for which the nonpublic information has been removed should not be counted to the total. If the information is anonymized or otherwise transformed so it is no longer reasonably linkable to a customer, that information will not count towards the exemption. NADA’s example of retaining only ‘‘name, phone number, address, and VIN of the vehicle they own,’’ would still count as customer information under the Rule. 333 National Independent Automobile Dealers Association (comment 48, NPRM), at 3. 334 National Pawnbrokers Association (comment 32, NPRM), at 6.

335 ACA International (comment 45, NPRM), at 12.

336 National Federation of Independent Business (comment 16, NPRM), at 4. 337 Small Business Administration Office of Advocacy (comment 28, NPRM), at 6. 338 Independent Community Bankers of America (comment 35, NPRM), at 4; see also American Escrow (comment 6, Workshop), at 3 (arguing even small companies may need to comply with all portions of the Rule to maintain consumer confidence); see also Caiting Wang (Comment 6, Privacy) (suggesting exempted provisions should be optional for smaller businesses, or the Commission create a fund to enable small businesses to comply with these provisions).

339 See, e.g., Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 85 (noting continuous monitoring allows organizations years.321 ACA International requested the effective date be one year after publication of the Rule.322 The Commission agrees some financial institutions may need longer to modify their information security programs to comply with the new requirements in the Final Rule, especially given the current pandemic and the strains it is placing on businesses. Accordingly, the Final Rule extends the effective date for these enumerated provisions to one year after the publication of this document. Proposed § 314.6: Exceptions Proposed § 314.6 exempted financial institutions that maintain customer information concerning fewer than five thousand consumers from certain requirements of the Proposed Rule, namely § 314.4(b)(1), requiring a written risk assessment; § 314.4(d)(2), requiring continuous monitoring or annual penetration testing and biannual vulnerability assessment; § 314.4(h), requiring a written incident response plan; and § 314.4(i), requiring an annual written report by the CISO (as revised, the Qualified Individual).323 This proposed section was designed to reduce the burden on smaller financial institutions.

The Commission sought comment on whether it was appropriate to include such an exemption, whether the specific exemptions were appropriate, whether the use of the number of customers concerning whom the financial institution retains customer information is the most effective way to determine which financial institutions should be exempted and, if so, whether five thousand customers was an appropriate number. After reviewing the comments received, the Commission retains the exemption for financial institutions with fewer than 5,000 customers as proposed.

Several commenters supported the inclusion of an exemption for small financial institutions. Consumer Reports supported the exemption as proposed.324 NPA supported the decision to base this exemption on the number of customers whose information the financial institution maintains, but questioned how the number of customers would be determined.325 NPA asked whether the number of customers would be counted on an annual basis or include all records the financial institution maintains. It also asked if each transaction with a customer would be counted separately.326 Some commenters argued the number of customers whose records a financial institution maintains was the wrong measure by which to assess whether the exemption should apply. For example, commenters suggested the Rule should take into account businesses with revenue beneath a certain threshold,327 the number of students enrolled at covered educational institutions,328 or the number of individuals employed by the financial institution.329 Additionally, some commenters argued the threshold for application of the exemption should be higher. ACA International suggested the exemption should apply to all financial institutions maintaining records concerning fewer than 10,000 customers.330 AFSA suggested a 50,000 customer threshold.331 NADA 332 and NIADA 333 argued the threshold should be raised to 100,000 customers. Without proposing a specific alternative, NPA expressed concern the 5,000-customer threshold may be too low, noting pawnbrokers who accept firearms as collateral are required to keep customer records related to certain transactions for twenty years.334 As to the substance of the exemption, some commenters felt it did not go far enough to relieve the burden of the rule for small financial institutions. ACA International proposed eligible financial institutions should also be exempt from the requirement to designate a single qualified individual to oversee their information security programs.335 The National Federation of Independent Business argued businesses with 15 or fewer employees should be exempted from the Rule entirely and instead held only to a requirement to take ‘‘commercially reasonable steps’’ to safeguard customer information.336 The Small Business Administration Office of Advocacy suggested, in the absence of additional information regarding the impact of the proposed changes on small businesses, the Rule should ‘‘maintain the status quo’’ for small entities as defined by the Small Business Administration’s size standards.337 On the other hand, other commenters opposed the inclusion of any exemption. The Independent Community Bankers of America noted the Federal Financial Institutions Examination Council Interagency Guidelines Establishing Standards for Safeguarding Customer Information (‘‘FFIEC Guidelines’’), which detail how depository institutions are required to protect customer information, include no exemption for smaller institutions and suggested the Rule should also have no exemption and apply equally to all financial institutions.338 Under the existing Rule, there is no exception for smaller entities. Still, the Commission continues to believe it is appropriate to exempt small businesses from some of the revised Rule’s requirements. Although the FFIEC Guidelines do not exempt small businesses from its requirements, the FFIEC Guidelines regulate only depository financial institutions subject to an entirely different regulatory regime, including supervision by their regulatory agencies. While the provisions from which eligible financial institutions are exempt have significant benefits for the security of customer information and other sensitive data,339 VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00030 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 227

70301 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations to detect and quickly respond to threats); Remarks of Frederick Lee, Safeguards Workshop Tr., supra note 17, at 126–28 (Frederick Lee) (discussing benefits of penetration testing); Remarks of Tom Dugas, Safeguards Workshop Tr., supra note 17, at 143 (noting the importance of vulnerability scans); Remarks of Michele Norin, Safeguards Workshop Tr., supra note 17, 194–95 (asserting annual reporting by the Qualified Individual to an organization’s board or equivalent is beneficial); Remarks of Adrienne Allen, Safeguards Workshop Tr., supra note 17, at 201. 340 See Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 91–92 (noting companies that control large amounts of consumer data should in most instances implement the full range of data security safeguards, whereas small businesses with less data may need to focus on cybersecurity basics); see also Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 91 (‘‘[T]he amount of data [that a business holds] would definitely have an influence on whether a business is even going to be attacked.’’); Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 94 (citing the volume of consumer records held by an organization as an important factor in assessing cybersecurity risk). 341 See, e.g., Remarks of James Crifasi, Safeguards Workshop Tr., supra note 17, at 91–92 (noting small businesses with an enormous amount of consumer records need to follow all of the safeguards and ‘‘can’t get away with just doing the basics’’); see also ACA International (comment 45, NPRM) at 11 (‘‘Many small financial institutions, including a number of ACA members, have objectively limited operations in terms of number of employees and revenues, but handle large volumes of consumer account data for each of their clients on whose behalf they are collecting debts.’’). 342 See. e.g., Remarks of Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 94 (opining ‘‘the better indicators for cybersecurity risk are going to be two things: The volume of consumer records that a financial institution holds and also the rate of change.’’); Remarks of Lee Waters, Safeguards Workshop Tr., supra note 17, at 91 (noting the amount of data a company holds influences whether it is going to be attacked). 343 See Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 89–90 (noting the size of a financial institution and the amount and nature of the information it holds factor into an appropriate information security program). 344 The Commission understands this provision to count all individual consumers about which a financial institution maintains customer information, including both current and former customers. The exemption counts consumers rather than transactions so a financial institution that had 100 transactions with a single customer would count only a single consumer. 345 44 U.S.C. 3502(3)(A)(i). 346 See 44 U.S.C. 3502(3)(A). 347 See Standards for Safeguarding Customer Information, 67 FR 36484, 36491 (May 23, 2002). those provisions may be less necessary in situations where the overall volume of retained data is low. This is true in part because the potential for cumulative consumer harm is less where fewer consumers’ information may be exposed as the result of a security incident.340 For similar reasons, the Commission finds the number of individuals concerning whom a financial institution maintains customer information is the appropriate measure of whether the exemption should apply to a particular financial institution. The application of the exemption should take into account both the potential burden of compliance to financial institutions and the risk to consumers when standards are relaxed—in other words, the purpose of the exemption is to avoid imposing undue burden while assuring customer information is subject to necessary protections. Even a very small financial institution, depending on its business model, may retain very large quantities of sensitive customer information.341 Adequate security is necessary to protect such information, which may constitute an attractive target for bad actors such as identity thieves; the value of the target is correlated with the volume of information maintained.342 While a business’s revenue or number of employees may provide a measure of the burden of compliance for that business, these figures do not capture consumer risk. By contrast, the number of individuals about whom a financial institution maintains customer information is a proxy for the level of security necessary in light of both the risk of attack and the potential consumer harm should a security incident occur.343 In addition, basing the exemption on the number of individuals concerning whom a financial institution maintains customer information provides an incentive to financial institutions to reduce the amount of information they retain. A financial institution may choose to dispose of information so it holds information on few enough consumers to qualify for exemption.344 The Final Rule adopts this section as proposed. The Commission continues to believe the cutoff for financial institutions maintaining information concerning 5,000 consumers appropriately balances the need for security with the burdens on smaller businesses. The requirements to which exempted financial institutions would still be required to adhere are tailored to balance the importance of adequately securing customer information against the need to limit financial burdens for small businesses. Many of these requirements were already in force as part of the existing Rule—for example, covered financial institutions were already required to design and implement a written information security program, conduct risk assessments, perform an initial assessment of their service providers, and designate one or more employees to oversee information security. For reasons discussed elsewhere in this document, the new requirements that apply to exempted financial institutions, such as the requirement to designate a single qualified individual to oversee information security rather than one or more individuals, will ensure financial institutions of all sizes continue to adequately protect customer information in an environment of increasing cybersecurity risk, while avoiding the imposition of undue burden.

IV. Paperwork Reduction Act The Paperwork Reduction Act (‘‘PRA’’), 44 U.S.C. 35, requires Federal agencies to seek and obtain Office of Management and Budget (OMB) approval before undertaking a collection of information directed to ten or more persons.345 A ‘‘collection of information’’ occurs when ten or more persons are asked to report, provide, disclose, or record information in response to ‘‘identical questions.’’ 346 Applying these standards, neither the Safeguards Rule nor the amendments constitute a ‘‘collection of information.’’ 347 The Rule calls upon affected financial institutions to develop or strengthen their information security programs in order to provide reasonable safeguards. Under the Rule, each financial institution’s safeguards will vary according to its size and complexity, the nature and scope of its activities, and the sensitivity of the information involved. For example, a financial institution with numerous employees would develop and implement employee training and management procedures beyond those that would be appropriate or reasonable for a sole proprietorship, such as an individual tax preparer or mortgage broker. Similarly, a financial institution that shares customer information with numerous service providers would need to take steps to ensure such information remains protected, while a financial institution with no service providers would not need to address this issue. Thus, although each financial institution must summarize its compliance efforts in one or more written documents, the discretionary balancing of factors and circumstances the Rule allows—including the myriad operational differences among businesses it contemplated—does not require entities to answer ‘‘identical questions’’ and therefore does not trigger the PRA’s requirements. The amendments to the Rule do not change this analysis because they retain the existing Rule’s process-based approach, allowing financial institutions to tailor their programs to reflect the financial institutions’ size, complexity, and operations, and to the VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00031 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 228

70302 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 348 5 U.S.C. 603 et seq. 349 See Public Workshop Examining Information Security for Financial Institutions and Information Related to Changes to the Safeguards Rule, 85 FR 13082 (Mar. 6, 2020).

350 Small Business Administration Office of Advocacy (comment 28, NPRM), at 6. sensitivity and amount of customer information they collect. For example, amended § 314.4(b) would require a written risk assessment, but each risk assessment will reflect the particular structure and operation of the financial institution and, though each assessment must include certain criteria, these are only general guidelines and do not consist of ‘‘identical questions.’’ Similarly, amended § 314.4(h), which requires a written incident response plan, is only an extension of the preexisting requirement of a written information security plan and would necessarily vary significantly based on factors such as the financial institution’s internal procedures, which officials within the financial institution have decision-making authority, how the financial institution communicates internally and externally, and the structure of the financial institution’s information systems. Likewise, the proposed requirement for Qualified Individuals to produce annual reports under proposed § 314.4(i) does not consist of answers to identical questions, as the content of these reports would vary considerably between financial institutions and Qualified Individuals are given flexibility in deciding what to include in the reports. Finally, the modification of the definition of ‘‘financial institution’’ to include ‘‘activities incidental to financial activities’’ and therefore bring finders under the scope of the Rule do not constitute a ‘‘collection of information,’’ and therefore do not trigger the PRA’s requirements. V. Regulatory Flexibility Act The Regulatory Flexibility Act (RFA), as amended by the Small Business Regulatory Enforcement Fairness Act of 1996, requires an agency to either provide an Initial Regulatory Flexibility Analysis (IRFA) with a proposed Rule, or certify that the proposed Rule will not have a significant impact on a substantial number of small entities.348 The Commission published an Initial Regulatory Flexibility Analysis in order to inquire into the impact of the Proposed Rule on small entities. In response, the Commission received comments that argued the revision to the Safeguards Rule would be unduly burdensome for smaller financial institutions. The discussion below summarizes these comments and the Commission’s response to them. 1. Description of the Reason for Agency Action The Commission issues these amendments to clarify the Safeguards Rule by including a definition of ‘‘financial institution’’ and related examples in the Safeguards Rule rather than incorporating them from the Privacy Rule by reference. The amendments also expand the definition of ‘‘financial institution’’ in the Rule to include entities engaged in activities incidental to financial activities. This change would bring ‘‘finders’’ within the scope of the Rule. This change harmonizes the Rule with other agencies’ rules and requires finders that collect consumers’ sensitive financial information to comply with the Safeguards Rule’s process-based approach to protect that data. In addition, the amendments modify the Safeguards Rule to include more detailed requirements for the information security program required by the Rule.

2. Issues Raised by Comments in Response to the IRFA As stated above, the Commission received several comments that argued the revised Safeguards Rule would impose unduly heavy burdens on smaller businesses. The Small Business Administration’s Office of Advocacy commented it was concerned the FTC had not gathered sufficient data as to either the costs or benefits of the proposed changes for small financial institutions. The FTC shares the Office of Advocacy’s interest in ensuring regulatory changes have an evidentiary basis. Many of the questions on which the FTC sought public comment, both in the regulatory review and in the proposed rule context, specifically related to the costs and benefits of existing and proposed Rule requirements. Following the initial round of commenting, the Commission conducted the FTC Safeguards Workshop and solicited additional public comments with the explicit goal of gathering additional data relating to the costs and benefits of the proposed changes.349 As detailed throughout this document, the Commission believes there is a strong evidentiary basis for the issuance of the Final Rule. The Office of Advocacy also argued the Proposed Rule’s requirements were unduly prescriptive and should not be enacted as they apply to small businesses until the Commission can ‘‘ascertain the quantitative impact on small entities.’’ 350 The Office of Advocacy, along with other commenters, argued the amendments taken together would create a large burden on smaller financial institutions. In particular, commenters pointed to the requirements that financial institutions appoint a chief information security officer, customer information be encrypted, financial institutions utilize multi-factor authentication, and financial institutions regularly update training programs. These comments and the Commission’s response are discussed at length above. Most commenters did not provide any specific estimates of these expenses, but two commenters did provide a summary of their expected expenses. As discussed in the document, the Commission believes any burden imposed by the revised Rule is substantially mitigated by the fact the Rule continues to be process-based, flexible, and based on the financial institution’s size and complexity. In addition, the amendments exempt institutions that maintain information on fewer than 5,000 consumers from certain requirements that require additional written product and might pose a greater burden on smaller entities. The Commission believes most of the entities covered by the exemption will be small businesses. Finally, the Commission believes all financial institutions, including small businesses, that comply with the current Safeguards Rule will already be in compliance with most of the new provisions of the revised Rule as part of their current information security program. In addition, in response to the comments concerned about the burden of the amendments, the Commission extended the effective date from six months after the publication of the Final Rule to one year after the publication to allow financial institutions additional time to come into compliance with the revised Rule. In addition, in response to comments that argued hiring a chief information security officer would be prohibitively expensive for small financial institutions, the Commission amended the rule to clarify such an employee was not required for all financial institutions. The Final Rule is modified to clarify a financial institution need only appoint an individual who is qualified to coordinate its information security program, and those qualifications will vary based on the complexity of the program and size and nature of the VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00032 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 229

70303 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 351 The U.S. Small Business Administration Table of Small Business Size Standards Matched to North American Industry Classification System Codes (‘‘NAICS’’) are generally expressed in either millions of dollars or number of employees. A size standard is the largest a business can be and still qualify as a small business for Federal Government programs. For the most part, size standards are the annual receipts or the average employment of a firm. Depending on the nature of the financial services an institution provides, the size standard varies. By way of example, mortgage and nonmortgage loan brokers (NAICS code 522310) are classified as small if their annual receipts are $8.0 million or less. Consumer lending institutions (NAICS code 522291) are classified as small if their annual receipts are $41.5 million or less. Commercial banking and savings institutions (NAICS codes 522110 and 522120) are classified as small if their assets are $600 million or less. Assets are determined by averaging the assets reported on businesses’ four quarterly financial statements for the preceding year. The 2019 Table of Small Business Size Standards is available at https:// www.sba.gov/sites/default/files/2019-08/ SBA%20Table%20of%20Size%20Standards_ Effective%20Aug%2019%2C%202019_Rev.pdf. 352 See, e.g., Remarks of Brian McManamon, Safeguards Workshop Tr., supra note 17, at 78 (describing virtual CISO services); Matthew Green, Safeguards Workshop Tr., supra note 17, at 225 (noting website usage of encryption for data in motion is above 80 percent; ‘‘Let’s Encrypt’’ provides free TLS certificates; and costs have gone down to the point that if a financial institution is not using TLS encryption for data in motion, it is making an unusual decision outside the norm); Rocio Baeza, Safeguards Workshop Tr., supra note 17, at 106 (‘‘[T]he encryption of data in transit has been standard. There’s no pushback with that.’’); Slides Accompanying the Remarks of Lee Waters, ‘‘Information Security Programs and Smaller Businesses,’’ in Safeguards Workshop Slides, supra note 72, at 26 (‘‘Estimated Costs of Proposed Changes,’’ estimating costs of multi-factor authentication to be $50 for smartcard or fingerprint readers, and $10 each per smartcard); Slides Accompanying Remarks of Wendy Nather, Safeguards Workshop Slides, supra note 72, at 37 (chart showing the use of multi-factor authentication solutions such as Duo Push, phone call, mobile passcode, SMS passcode, hardware token, Yubikey passcode, and U2F token in industries such as financial services and higher education).

financial institution. The Commission also clarified employee training programs need to be updated only as necessary, to respond to a comment regular updating would be difficult for smaller financial institutions. 3. Estimate of Number of Small Entities to Which the Amendments Will Apply As previously discussed in the IRFA, determining a precise estimate of the number of small entities 351—including newly covered entities under the modified definition of financial institution—is not readily feasible. Financial institutions already covered by the Rule as originally promulgated include lenders, financial advisors, loan brokers and servicers, collection agencies, financial advisors, tax preparers, and real estate settlement services, to the extent they have ‘‘customer information’’ within the meaning of the Rule. Finders are also covered under the Final Rule. However, it is not known whether any finders are small entities, and if so, how many there are. The Commission requested comment and information on the number of ‘‘finders’’ that would be covered by the Rule’s modified definition of ‘‘financial institution,’’ and how many of those finders, if any, are small entities. The Commission received no comments that addressed this question.

4. Projected Reporting, Recordkeeping, and Other Compliance Requirements The Rule does not impose any reporting or any specific recordkeeping requirements as discussed earlier. See supra Section IV (Paperwork Reduction Act). With regard to other compliance requirements, the addition of definitions and examples from the Privacy Rule is not expected to have an impact on covered financial institutions, including those that may be small entities. (The preceding section of this analysis discusses classes of covered financial institutions that may qualify as small entities.) The addition of ‘‘finders’’ to the definition of financial institutions imposes the obligations of the Rule on entities that engage in ‘‘finding’’ activity and also collect customer information. The addition of more detailed requirements may require some financial institutions to perform additional risk assessments or monitoring, or to create additional safeguards as set forth in the Proposed Rule. These obligations may require institutions to retain employees or thirdparty service providers with skills in information security, but, as discussed above, the Commission believes most financial institutions will have already complied with many parts of the Rule as part of their information security programs required under the existing Rule. There may be additional related compliance costs (e.g., legal, new equipment or systems, modifications to policies or procedures), but, as discussed above, the Commission believes these are limited by several factors, including the flexibility of the Rule, the existing safeguards in place to comply with the existing Rule, and the exemption for financial institutions that maintain less consumer information. Although two commenters provided summaries of the expected expenses for some financial institutions to comply with the Rule, those estimates did not provide sufficient detail to fully evaluate whether they were accurate or representative of other financial institutions and appeared to be based, at least in part, on a misunderstanding of the requirement to appoint a Qualified Individual. The Commission believes, for most smaller financial institutions, there are very low-cost solutions for any additional duties imposed by the Final Rule. This view is supported by the comments of several experts at the Safeguards Rule Workshop.352 The Commission believes the protection of consumers’ financial information is of the utmost importance and the cost of the safeguards required to provide that protection is justified and necessary. The Commission carefully balanced the cost of these requirements with the need to protect consumer information and has made every effort to ensure the Final Rule retains flexibility so financial institutions can tailor information security programs to the size and complexity of the financial institution, the nature and scope of its activities, and the sensitivity of any customer information at issue.

5. Description of Steps Taken To Minimize Significant Economic Impact, if Any, on Small Entities, Including Alternatives The standards in the Final Rule allow a small financial institution to develop an information security program appropriate to its size and complexity, the nature and scope of its activities, and the sensitivity of any customer information at issue. The amendments include certain design standards (e.g., a company must implement encryption, authentication, and incident response) in the Rule, in addition to the performance standards (reasonable security) the Rule currently uses. As discussed, while these design standards may introduce some additional burden, the Commission believes many financial institutions’ existing information security programs already meet most of these requirements. In addition, the requirements in the Final Rule, like those in the existing Rule, are designed to allow financial institutions flexibility in how and whether they should be implemented. For example, the requirement encryption be used to protect customer information in transit and at rest may be met with effective alternative compensating controls if encryption is infeasible for a given financial institution.

In addition, the amendments exempt financial institutions that maintain relatively small amounts of customer information from certain requirements of the Final Rule. The exemptions would apply to financial institutions that maintain customer information VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00033 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 230

70304 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations concerning fewer than ten thousand consumers. The Commission believes exempted financial institutions are generally, but not exclusively, small entities. Such financial institutions are not required to perform a written risk assessment, conduct continuous monitoring or annual penetration testing and biannual vulnerability assessment, prepare a written incident response plan, or prepare an annual written report by the Qualified Individual. These exemptions are intended to reduce the burden on smaller financial institutions. The Commission believes the obligations subject to these exemptions are the ones most likely to cause undue burden on smaller financial institutions. Exempted financial institutions will still need to conduct risk assessments, design and implement a written information security program with the required elements, utilize qualified information security personnel and train employees, monitor activity of authorized users, oversee service providers, and evaluate and adjust their information security program. These are core obligations under the Rule any financial institution that collects customer information must meet, regardless of size.

The Commission considered allowing compliance with a third-party data security standard, such as the NIST framework, to act as a safe harbor for compliance with the Rule. The Commission, however, determined any reduction of burden created by allowing such safe harbors is offset by issues they would cause. For example, such safe harbors would require the Commission to monitor the third-party standard or standards to determine whether they continued to align with the Safeguards Rule. In addition, the Commission would still have to investigate a company’s compliance with the outside standard in any enforcement action. The Commission also does not agree compliance with an outside standard is likely to be less burdensome than complying with the Safeguards Rule itself.

VI. Other Matters Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as not a ‘‘major rule,’’ as defined by 5 U.S.C. 804(2). List of Subjects in 16 CFR Part 314 Consumer protection, Credit, Data protection, Privacy, Trade practices. For the reasons stated above, the Federal Trade Commission amends 16 CFR part 314 as follows: PART 314—STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION ■1. The authority citation for part 314 continues to read as follows: Authority: 15 U.S.C. 6801(b), 6805(b)(2). ■2. In § 314.1, revise paragraph (b) to read as follows:

§ 314.1 Purpose and scope.

* * * * * (b) Scope. This part applies to the handling of customer information by all financial institutions over which the Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) has jurisdiction. Namely, this part applies to those ‘‘financial institutions’’ over which the Commission has rulemaking authority pursuant to section 501(b) of the Gramm-Leach-Bliley Act. An entity is a ‘‘financial institution’’ if its business is engaging in an activity that is financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k), which incorporates activities enumerated by the Federal Reserve Board in 12 CFR 225.28 and 225.86. The ‘‘financial institutions’’ subject to the Commission’s enforcement authority are those that are not otherwise subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act, 15 U.S.C. 6805. More specifically, those entities include, but are not limited to, mortgage lenders, ‘‘pay day’’ lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisors that are not required to register with the Securities and Exchange Commission, and entities acting as finders. They are referred to in this part as ‘‘You.’’ This part applies to all customer information in your possession, regardless of whether such information pertains to individuals with whom you have a customer relationship, or pertains to the customers of other financial institutions that have provided such information to you.

■3. Revise § 314.2 to read as follows: § 314.2 Definitions.

(a) Authorized user means any employee, contractor, agent, customer, or other person that is authorized to access any of your information systems or data.

(b)(1) Consumer means an individual who obtains or has obtained a financial product or service from you that is to be used primarily for personal, family, or household purposes, or that individual’s legal representative.

(2) For example:

(i) An individual who applies to you for credit for personal, family, or household purposes is a consumer of a financial service, regardless of whether the credit is extended. (ii) An individual who provides nonpublic personal information to you in order to obtain a determination about whether he or she may qualify for a loan to be used primarily for personal, family, or household purposes is a consumer of a financial service, regardless of whether the loan is extended.

(iii) An individual who provides nonpublic personal information to you in connection with obtaining or seeking to obtain financial, investment, or economic advisory services is a consumer, regardless of whether you establish a continuing advisory relationship.

(iv) If you hold ownership or servicing rights to an individual’s loan that is used primarily for personal, family, or household purposes, the individual is your consumer, even if you hold those rights in conjunction with one or more other institutions. (The individual is also a consumer with respect to the other financial institutions involved.) An individual who has a loan in which you have ownership or servicing rights is your consumer, even if you, or another institution with those rights, hire an agent to collect on the loan. (v) An individual who is a consumer of another financial institution is not your consumer solely because you act as agent for, or provide processing or other services to, that financial institution. (vi) An individual is not your consumer solely because he or she has designated you as trustee for a trust. (vii) An individual is not your consumer solely because he or she is a beneficiary of a trust for which you are a trustee.

(viii) An individual is not your consumer solely because he or she is a participant or a beneficiary of an employee benefit plan that you sponsor or for which you act as a trustee or fiduciary.

(c) Customer means a consumer who has a customer relationship with you. (d) Customer information means any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00034 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 231

70305 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations or maintained by or on behalf of you or your affiliates.

(e)(1) Customer relationship means a continuing relationship between a consumer and you under which you provide one or more financial products or services to the consumer that are to be used primarily for personal, family, or household purposes.

(2) For example:

(i) Continuing relationship. A consumer has a continuing relationship with you if the consumer: (A) Has a credit or investment account with you;

(B) Obtains a loan from you; (C) Purchases an insurance product from you;

(D) Holds an investment product through you, such as when you act as a custodian for securities or for assets in an Individual Retirement Arrangement; (E) Enters into an agreement or understanding with you whereby you undertake to arrange or broker a home mortgage loan, or credit to purchase a vehicle, for the consumer; (F) Enters into a lease of personal property on a non-operating basis with you;

(G) Obtains financial, investment, or economic advisory services from you for a fee;

(H) Becomes your client for the purpose of obtaining tax preparation or credit counseling services from you; (I) Obtains career counseling while seeking employment with a financial institution or the finance, accounting, or audit department of any company (or while employed by such a financial institution or department of any company);

(J) Is obligated on an account that you purchase from another financial institution, regardless of whether the account is in default when purchased, unless you do not locate the consumer or attempt to collect any amount from the consumer on the account; (K) Obtains real estate settlement services from you; or (L) Has a loan for which you own the servicing rights.

(ii) No continuing relationship. A consumer does not, however, have a continuing relationship with you if: (A) The consumer obtains a financial product or service from you only in isolated transactions, such as using your ATM to withdraw cash from an account at another financial institution; purchasing a money order from you; cashing a check with you; or making a wire transfer through you; (B) You sell the consumer’s loan and do not retain the rights to service that loan;

(C) You sell the consumer airline tickets, travel insurance, or traveler’s checks in isolated transactions; (D) The consumer obtains one-time personal or real property appraisal services from you; or (E) The consumer purchases checks for a personal checking account from you.

(f) Encryption means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material. (g)(1) Financial product or service means any product or service that a financial holding company could offer by engaging in a financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).

(2) Financial service includes your evaluation or brokerage of information that you collect in connection with a request or an application from a consumer for a financial product or service.

(h)(1) Financial institution means any institution the business of which is engaging in an activity that is financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k). An institution that is significantly engaged in financial activities, or significantly engaged in activities incidental to such financial activities, is a financial institution. (2) Examples of financial institutions are as follows:

(i) A retailer that extends credit by issuing its own credit card directly to consumers is a financial institution because extending credit is a financial activity listed in 12 CFR 225.28(b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)(4)(F)), and issuing that extension of credit through a proprietary credit card demonstrates that a retailer is significantly engaged in extending credit.

(ii) An automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days is a financial institution with respect to its leasing business because leasing personal property on a nonoperating basis where the initial term of the lease is at least 90 days is a financial activity listed in 12 CFR 225.28(b)(3) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F). (iii) A personal property or real estate appraiser is a financial institution because real and personal property appraisal is a financial activity listed in 12 CFR 225.28(b)(2)(i) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F). (iv) A career counselor that specializes in providing career counseling services to individuals currently employed by or recently displaced from a financial organization, individuals who are seeking employment with a financial organization, or individuals who are currently employed by or seeking placement with the finance, accounting or audit departments of any company is a financial institution because such career counseling activities are financial activities listed in 12 CFR 225.28(b)(9)(iii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F). (v) A business that prints and sells checks for consumers, either as its sole business or as one of its product lines, is a financial institution because printing and selling checks is a financial activity that is listed in 12 CFR 225.28(b)(10)(ii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F). (vi) A business that regularly wires money to and from consumers is a financial institution because transferring money is a financial activity referenced in section 4(k)(4)(A) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(A), and regularly providing that service demonstrates that the business is significantly engaged in that activity.

(vii) A check cashing business is a financial institution because cashing a check is exchanging money, which is a financial activity listed in section 4(k)(4)(A) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(A). (viii) An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution because tax preparation services is a financial activity listed in 12 CFR 225.28(b)(6)(vi) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G).

(ix) A business that operates a travel agency in connection with financial services is a financial institution because operating a travel agency in connection with financial services is a financial activity listed in 12 CFR 225.86(b)(2) and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G). (x) An entity that provides real estate settlement services is a financial institution because providing real estate settlement services is a financial activity VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00035 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 232

70306 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations listed in 12 CFR 225.28(b)(2)(viii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F).

(xi) A mortgage broker is a financial institution because brokering loans is a financial activity listed in 12 CFR 225.28(b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F). (xii) An investment advisory company and a credit counseling service are each financial institutions because providing financial and investment advisory services are financial activities referenced in section 4(k)(4)(C) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(C).

(xiii) A company acting as a finder in bringing together one or more buyers and sellers of any product or service for transactions that the parties themselves negotiate and consummate is a financial institution because acting as a finder is an activity that is financial in nature or incidental to a financial activity listed in 12 CFR 225.86(d)(1). (3) Financial institution does not include:

(i) Any person or entity with respect to any financial activity that is subject to the jurisdiction of the Commodity Futures Trading Commission under the Commodity Exchange Act (7 U.S.C. 1 et seq.);

(ii) The Federal Agricultural Mortgage Corporation or any entity chartered and operating under the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.); (iii) Institutions chartered by Congress specifically to engage in securitizations, secondary market sales (including sales of servicing rights) or similar transactions related to a transaction of a consumer, as long as such institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party other than as permitted by §§ 313.14 and 313.15; or (iv) Entities that engage in financial activities but that are not significantly engaged in those financial activities, and entities that engage in activities incidental to financial activities but that are not significantly engaged in activities incidental to financial activities.

(4) Examples of entities that are not significantly engaged in financial activities are as follows: (i) A retailer is not a financial institution if its only means of extending credit are occasional ‘‘lay away’’ and deferred payment plans or accepting payment by means of credit cards issued by others. (ii) A retailer is not a financial institution merely because it accepts payment in the form of cash, checks, or credit cards that it did not issue. (iii) A merchant is not a financial institution merely because it allows an individual to ‘‘run a tab.’’ (iv) A grocery store is not a financial institution merely because it allows individuals to whom it sells groceries to cash a check, or write a check for a higher amount than the grocery purchase and obtain cash in return. (i) Information security program means the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information. (j) Information system means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information containing customer information or connected to a system containing customer information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental controls systems that contains customer information or that is connected to a system that contains customer information.

(k) Multi-factor authentication means authentication through verification of at least two of the following types of authentication factors: (1) Knowledge factors, such as a password;

(2) Possession factors, such as a token; or (3) Inherence factors, such as biometric characteristics. (l)(1) Nonpublic personal information means:

(i) Personally identifiable financial information; and (ii) Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available.

(2) Nonpublic personal information does not include:

(i) Publicly available information, except as included on a list described in paragraph (l)(1)(ii) of this section; or (ii) Any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived without using any personally identifiable financial information that is not publicly available.

(3) For example:

(i) Nonpublic personal information includes any list of individuals’ names and street addresses that is derived in whole or in part using personally identifiable financial information (that is not publicly available), such as account numbers.

(ii) Nonpublic personal information does not include any list of individuals’ names and addresses that contains only publicly available information, is not derived, in whole or in part, using personally identifiable financial information that is not publicly available, and is not disclosed in a manner that indicates that any of the individuals on the list is a consumer of a financial institution. (m) Penetration testing means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting penetration of databases or controls from outside or inside your information systems.

(n)(1) Personally identifiable financial information means any information: (i) A consumer provides to you to obtain a financial product or service from you;

(ii) About a consumer resulting from any transaction involving a financial product or service between you and a consumer; or (iii) You otherwise obtain about a consumer in connection with providing a financial product or service to that consumer.

(2) For example:

(i) Information included. Personally identifiable financial information includes:

(A) Information a consumer provides to you on an application to obtain a loan, credit card, or other financial product or service;

(B) Account balance information, payment history, overdraft history, and credit or debit card purchase information;

(C) The fact that an individual is or has been one of your customers or has obtained a financial product or service from you;

(D) Any information about your consumer if it is disclosed in a manner that indicates that the individual is or has been your consumer; (E) Any information that a consumer provides to you or that you or your agent otherwise obtain in connection with collecting on, or servicing, a credit account;

(F) Any information you collect through an internet ‘‘cookie’’ (an information collecting device from a web server); and (G) Information from a consumer report.

(ii) Information not included. Personally identifiable financial information does not include: VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00036 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 233

70307 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations (A) A list of names and addresses of customers of an entity that is not a financial institution; and (B) Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. (o)(1) Publicly available information means any information that you have a reasonable basis to believe is lawfully made available to the general public from:

(i) Federal, State, or local government records;

(ii) Widely distributed media; or (iii) Disclosures to the general public that are required to be made by Federal, State, or local law.

(2) You have a reasonable basis to believe that information is lawfully made available to the general public if you have taken steps to determine: (i) That the information is of the type that is available to the general public; and (ii) Whether an individual can direct that the information not be made available to the general public and, if so, that your consumer has not done so. (3) For example:

(i) Government records. Publicly available information in government records includes information in government real estate records and security interest filings. (ii) Widely distributed media. Publicly available information from widely distributed media includes information from a telephone book, a television or radio program, a newspaper, or a website that is available to the general public on an unrestricted basis. A website is not restricted merely because an internet service provider or a site operator requires a fee or a password, so long as access is available to the general public.

(iii) Reasonable basis. (A) You have a reasonable basis to believe that mortgage information is lawfully made available to the general public if you have determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded.

(B) You have a reasonable basis to believe that an individual’s telephone number is lawfully made available to the general public if you have located the telephone number in the telephone book or the consumer has informed you that the telephone number is not unlisted.

(p) Security event means an event resulting in unauthorized access to, or disruption or misuse of, an information system, information stored on such information system, or customer information held in physical form. (q) Service provider means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution that is subject to this part.

(r) You includes each ‘‘financial institution’’ (but excludes any ‘‘other person’’) over which the Commission has enforcement jurisdiction pursuant to section 505(a)(7) of the Gramm- Leach-Bliley Act.

■4. In § 314.3, revise paragraph (a) to read as follows:

§ 314.3 Standards for safeguarding customer information.

(a) Information security program. You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in paragraph (b) of this section.

* * * * * ■5. Revise § 314.4 to read as follows: § 314.4 Elements.

In order to develop, implement, and maintain your information security program, you shall:

(a) Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program (for purposes of this part, ‘‘Qualified Individual’’). The Qualified Individual may be employed by you, an affiliate, or a service provider. To the extent the requirement in this paragraph (a) is met using a service provider or an affiliate, you shall:

(1) Retain responsibility for compliance with this part; (2) Designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual; and (3) Require the service provider or affiliate to maintain an information security program that protects you in accordance with the requirements of this part.

(b) Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks.

(1) The risk assessment shall be written and shall include: (i) Criteria for the evaluation and categorization of identified security risks or threats you face; (ii) Criteria for the assessment of the confidentiality, integrity, and availability of your information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats you face; and (iii) Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks. (2) You shall periodically perform additional risk assessments that reexamine the reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and reassess the sufficiency of any safeguards in place to control these risks.

(c) Design and implement safeguards to control the risks you identity through risk assessment, including by: (1) Implementing and periodically reviewing access controls, including technical and, as appropriate, physical controls to:

(i) Authenticate and permit access only to authorized users to protect against the unauthorized acquisition of customer information; and (ii) Limit authorized users’ access only to customer information that they need to perform their duties and functions, or, in the case of customers, to access their own information; (2) Identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes in accordance with their relative importance to business objectives and your risk strategy; (3) Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest. To the extent you determine that encryption of customer information, either in transit over external networks or at rest, is infeasible, you may instead secure such customer information using effective VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00037 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 234

70308 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations alternative compensating controls reviewed and approved by your Qualified Individual;

(4) Adopt secure development practices for in-house developed applications utilized by you for transmitting, accessing, or storing customer information and procedures for evaluating, assessing, or testing the security of externally developed applications you utilize to transmit, access, or store customer information; (5) Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls;

(6)(i) Develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates, unless such information is necessary for business operations or for other legitimate business purposes, is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained; and (ii) Periodically review your data retention policy to minimize the unnecessary retention of data; (7) Adopt procedures for change management; and (8) Implement policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users.

(d)(1) Regularly test or otherwise monitor the effectiveness of the safeguards’ key controls, systems, and procedures, including those to detect actual and attempted attacks on, or intrusions into, information systems. (2) For information systems, the monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments. Absent effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities, you shall conduct: (i) Annual penetration testing of your information systems determined each given year based on relevant identified risks in accordance with the risk assessment; and (ii) Vulnerability assessments, including any systemic scans or reviews of information systems reasonably designed to identify publicly known security vulnerabilities in your information systems based on the risk assessment, at least every six months; and whenever there are material changes to your operations or business arrangements; and whenever there are circumstances you know or have reason to know may have a material impact on your information security program. (e) Implement policies and procedures to ensure that personnel are able to enact your information security program by:

(1) Providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment; (2) Utilizing qualified information security personnel employed by you or an affiliate or service provider sufficient to manage your information security risks and to perform or oversee the information security program; (3) Providing information security personnel with security updates and training sufficient to address relevant security risks; and (4) Verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures.

(f) Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue;

(2) Requiring your service providers by contract to implement and maintain such safeguards; and (3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.

(g) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (d) of this section; any material changes to your operations or business arrangements; the results of risk assessments performed under paragraph (b)(2) of this section; or any other circumstances that you know or have reason to know may have a material impact on your information security program. (h) Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control. Such incident response plan shall address the following areas: (1) The goals of the incident response plan;

(2) The internal processes for responding to a security event; (3) The definition of clear roles, responsibilities, and levels of decisionmaking authority;

(4) External and internal communications and information sharing;

(5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;

(6) Documentation and reporting regarding security events and related incident response activities; and (7) The evaluation and revision as necessary of the incident response plan following a security event. (i) Require your Qualified Individual to report in writing, regularly and at least annually, to your board of directors or equivalent governing body. If no such board of directors or equivalent governing body exists, such report shall be timely presented to a senior officer responsible for your information security program. The report shall include the following information: (1) The overall status of the information security program and your compliance with this part; and (2) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management’s responses thereto, and recommendations for changes in the information security program. ■6. Revise § 314.5 to read as follows: § 314.5 Effective date.

Section 314.4(a), (b)(1), (c)(1) through (8), (d)(2), (e), (f)(3), (h), and (i) are effective as of December 9, 2022. ■7. Add § 314.6 to read as follows: § 314.6 Exceptions.

Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers.

By direction of the Commission, Commissioners Phillips and Wilson dissenting.

April Tabor, Secretary.

Note: The following appendix will not appear in the Code of Federal Regulations. VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00038 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 235

70309 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 1 16 CFR part 314. Pursuant to the Gramm Leach Bliley Act (‘‘GLB’’ or ‘‘GLBA’’), Public Law 106– 102, 113 Stat. 1338 (1999) (codified as amended in scattered sections of 12 and 15 U.S.C.), the Commission promulgated the Safeguards Rule in 2001.

2 See, e.g., 2020 Internet Crime Report, Fed. Bur. Investigations,at 20 (Mar. 2021) (reporting consumer loss of over $128 million resulting from corporate data breaches to those who filed complaints in 2020 alone); Int’l Bus. Mach, Cost of a Data Breach, at 4 (2021) (estimating that the average cost of single data breach has risen to $4.24 million).

3 2013 Identity Fraud Report: Data Breaches Becoming a Treasure Trove for Fraudsters, Javelin Strategy, at 1 (Feb. 2013) (reporting that 1 in 4 recipients of a data breach notification become victims of identity theft); Michelle Singletary, Your online profile may help identity thieves, Washington Post (Feb. 28, 2012), https:// www.washingtonpost.com/business/economy/ michelle-singletary-your-online-profile-may-helpidentity-thieves/2012/02/28/gIQAXFjygR_story.html (reporting that recipients of data breach letters are 9.5% more likely to suffer identity theft). 4 See Erika Harrell, Victims of Identity Theft, 2018, U.S. Dep’t of Just., at 1 (Apr. 2021), https:// bjs.ojp.gov/content/pub/pdf/vit18.pdf. 5 See 2021 Consumer Aftermath Report, Identity Theft Resource Center (2021), at 6 (finding that in a study of 427 identity crime victims, 21% of them suffered losses of over $20,000). 6 The Commission first sought public comments on the proposed amendments in April 2019. See Privacy of Consumer Financial Information Rule Under the Gramm-Leach-Bliley Act, 84 FR 13150; Standards for Safeguarding Customer Information, 84 FR 13158 (April 4, 2019). The agency received almost 50 comments from consumer groups, industry associations, and data security experts. See FTC Seeks Comment on Proposed Amendments to Safeguards and Privacy Rules, 16 CFR part 314, Project No. P145407, (FTC–2019–0019) (‘‘2019 Safeguards and Privacy NPRM ’’), https:// www.regulations.gov/docket/FTC-2019-0019/ document. Further, the Commission conducted a workshop discussing the proposed amendments with information security professionals and experts, including IT staff from financial institutions covered by the Safeguards Rule. See Transcript, Information Security and Financial Institutions: An FTC Workshop to Examine Safeguards Rule, Fed. Trade Comm’n (July 13, 2020) (‘‘Safeguards Workshop’’), https://www.ftc.gov/system/files/ documents/public_events/1567141/transcript-glbsafeguards-workshop-full.pdf. Connected with the workshop, the Commission sought and received another round of public comments on the amendments. The eleven relevant public comments relating to the subject matter of the July 13, 2020, workshop can be found here: Postponement of Public Workshop Related to Proposed Changes to the Safeguards Rule, 85 FR 23354 (FTC–2020–0038) (Apr. 27, 2020) (‘‘Workshop Comment Docket’’), https://www.regulations.gov/document/FTC-2020- 0038-0001.

7 See, e.g., Electronic Privacy Information Center, Comment Letter No. 55 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019), at 3 (Aug. 1, 2019) (citing dramatic increase in data breaches at financial services firms affecting millions of consumers), https://www.regulations.gov/comment/ FTC-2019-0019-0055; Consumer Reports, Comment Letter No. 52 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019) (Aug. 2, 2019), https:// www.regulations.gov/comment/FTC-2019-0019- 0052 (noting several high profile data breaches at financial institutions as evidence for the need for stronger regulation); Inpher, Inc., Comment Letter No. 50 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019), at 1 (Aug. 1, 2019), https:// www.regulations.gov/comment/FTC-2019-0019- 0050 (pointing to major breaches at financial institutions as evidence for the need of stronger security regulations); Independent Community Bankers of America, Comment Letter No. 35 on 2019 Safeguards and Privacy NPRM (FTC–2019– 0019) (Aug. 2, 2019), https://www.regulations.gov/ comment/FTC-2019-0019-0035 (noting that FTCregulated financial institutions are subject to less stringent security requirements than those regulated by banking agencies, even though many handle the same types of information as those financial institutions); National Consumer Law Center et al., Comment Letter No. 58 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019) (Aug. 2, 2019), https://www.regulations.gov/document/FTC-2019- 0019-0058 (arguing that the recent Equifax breach showed the need for strengthening the Safeguards Rule); Cisco Systems, Inc., Comment Letter No. 51 on 2019 Safeguards and Privacy NPRM (FTC–2019– 0019) (Aug. 2, 2019), https://www.regulations.gov/ document/FTC-2019-0019-0051 (noting that sophisticated hacking techniques used in state sponsored attacks are likely to be adopted by ‘‘more garden variety, less sophisticated hackers.’’); Safeguards Workshop, at 24–26 (July 13, 2020) (remarks of Chris Cronin) (stating that many companies do not conduct complete or adequate risk assessments). Id. at 38–39 (remarks of Serge Jorgensen) (noting that businesses’ understanding of the need for security has improved, but that they continue to struggle to implement controls across business units). Id. at 39–41 (remarks of Chris Cronin) (stating that, ‘‘as a rule,’’ businesses of all sizes are ‘‘behind’’ on cybersecurity, attributing this in part to consultants whose advice about reasonable security is motivated by a desire to ‘‘make the clients happy’’). Id. at 43 (remarks of Pablo Molina) (citing ‘‘the mounting losses that come from cybercrime’’ as evidence that many businesses are ‘‘falling behind’’ cybercriminals). Id. at 114 (remarks of Brian McManamon) (noting that ‘‘the proposed changes are the minimum necessary to have an effective security program in place.’’). Id. at 44 (remarks of Sam Rubin) (noting that, in his experience, companies make significant investments in technical security measures but that investment in personnel to oversee and use those measures is ‘‘a huge shortcoming that I’m seeing in the field.’’); The Clearing House Association LLC, Comment Letter No. 49 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019), at 7–9 (Aug. 2, 2019), https://www.regulations.gov/comment/FTC- 2019-0019-0049 (citing a 2018 study by the Center for Financial Inclusion that showed widespread data security failures among financial technology companies around the globe). 8 Press Release, Fed. Trade Comm’n, Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach, (July 22, 2019), https://www.ftc.gov/news-events/pressreleases/2019/07/equifax-pay-575-million-partsettlement-ftc-cfpb-states-related. 9 See infra, note 7.

10 See, e.g., for Single Qualified Individual Requirement: National Consumer Law Center et al., Continued Appendix—Statements Issued on October 27, 2021 Statement of Chair Lina M. Khan Joined by Commissioner Rebecca Kelly Slaughter Regarding Regulatory Review of the Safeguards Rule Today the FTC is significantly strengthening the Safeguards Rule,1 first promulgated by the FTC twenty years ago pursuant to a Congressional directive to protect personal information that is stored by financial institutions. This revamping—the first time in the Rule’s history—is sorely needed. In the twenty years since the Rule was first issued, the complexity of information security has increased drastically, the use of computer networks in every aspect of life has expanded exponentially, and, most notably, an unending chain of damaging data breaches caused by inadequate security have cost Americans heavily.2 The amendments adopted today require financial institutions to develop information security programs that can meet the challenges of today’s security environment.

For Americans, the harms stemming from the types of security vulnerabilities that this Rule addresses are all too real. Victims of breaches have their most sensitive information exposed, making them more vulnerable to identity theft, phishing attacks, and other forms of fraud.3 In 2018, almost 10 percent of Americans suffered some form of identity theft, costing many of them hundreds of dollars and dozens of hours of time, an experience that many describe as distressing.4 For some, the cost is much higher, with victims losing tens of thousands of dollars.5 The Rule amendments the FTC is issuing today are strongly supported by the evidence in the record.6 The evidence gathered from information security experts, industry associations, and consumer groups—those with hands-on experience in the area and knowledge of the field—decisively show that the amendments are necessary. Of course, all of this information supplements the experience that Commission staff has obtained over twenty years of enforcing the Rule, and gained through investigations of companies’ data security practices under the FTC’s deception and unfairness authority. The dissent’s conclusion that these amendments are unnecessary is belied by both the reality of rampant data security breaches as well as the robust evidentiary record. The recent history of major data breaches affecting millions of consumers shows that more needs to be done to protect consumers’ sensitive information. Despite the increasing sophistication of cyberattacks, many businesses continue to offer inadequate security.7 In particular, the massive Equifax breach, which the FTC alleged was caused by inadequate data security that could have been easily corrected by the company, is a glaring example of how a financial institution’s lax security practices can have devastating consequences for Americans.8 The dissent’s suggestion that our current framework is sufficient falls flat in the face of such a stark example of the harm that can arise from avoidable lax security practices by covered financial institutions. Moreover, the dissent’s complaint that the rule is also informed by evidence arising from breaches and practices occurring in other types of industries misses the mark. Not only is there substantial evidence in the rulemaking record clearly illustrating security lapses of financial institutions that are covered by the Rule,9 but the implication that we shouldn’t use our broader knowledge of common security pitfalls is unwise. The record evidence also shows that the amendment’s requirements track bedrock principles of data security and represent proven elements of effective data security programs that reduce the risk of breaches.10 VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00039 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 236

70310 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations supra note 7, at 3 (arguing that a clear line of reporting with a single responsible individual could have prevented the Equifax consumer data breach); Safeguards Workshop, at 182–84 (remarks of Adrienne Allen) (stating that without a single responsible individual, information security staff ‘‘can fall into traps of each relying on someone else to make a hard call . . . [In a program without a single coordinator] issues can sometimes fall through the cracks.’’). Id. at 184–85 (remarks of Michele Norin) (‘‘I think it’s extremely important to have a person in front of the information security program. I think that there are so many components to understand, to manage, to keep an eye on. I think it’s difficult to do that if it’s part of someone else’s job. And so I found that it’s extremely helpful to have a person in charge of that program just from a pure basic management perspective and understanding perspective.’’); Risk Assessment Requirement: Id. at 25 (remarks of Chris Cronin) (stating that evaluating the likelihoods and impacts of potential security risks and evaluating existing controls is an important component of a risk assessment). Id. at 29–30 (remarks of Serge Jorgensen) (emphasizing the importance of risk assessments as tools for adjusting existing security measures to account for both current and future security threats); Encryption Requirement: Princeton University Center for Information Technology Policy, Comment Letter No. 54 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019), at 3 (Aug. 2, 2019), https://www.regulations.gov/ document/FTC-2019-0019-0054 (noting the effectiveness of encryption); Inpher, Inc., supra note 7, at 4; Safeguards Workshop, at 225 (remarks of Matthew Green) (noting website usage of encryption is above 80 percent; ‘‘Let’s Encrypt’’ provides free TLS certificates; and costs have gone down to the point that if a financial institution is not using TLS encryption for data in motion, it is making an unusual decision outside the norm). Id. at 106 (remarks of Rocio Baeza) (‘‘[T]he encryption of data in transit has been standard. There’s no pushback with that.’’); Multifactor Authentication Requirement: Princeton University Center for Information Technology Policy, supra note 10, at 6– 7; Electronic Privacy Information Center, supra, note 7, at 8; National Consumer Law Center et al., supra note 7, at 2; Safeguards Workshop, at 102 (remarks of Brian McManamon) (stating that his company TECH LOCK supports requiring multifactor authentication for users connecting from internal networks). Id. at 266 (remarks of Matthew Green) (explaining that passwords are not enough of an authentication feature but when MFA is used and deployed, the defenders can win against attackers). Id. at 239 (describing how because smart phones have modern secure hardware processors, biometric sensors and readers built in, increasingly consumers can get the security they need through the devices they already have by storing cryptographic authentication keys on the devices and then using the phone to activate them); Incident Response Plan: Credit Union National Association, Comment Letter No. 30 on 2019 Safeguards and Privacy NPRM (FTC–2019–0019), at 2 (Aug. 1, 2019), https://www.regulations.gov/ document/FTC-2019-0019-0030 (noting that that an incident response plan ‘‘helps ensure that an entity is prepared in case of an incident by planning how it will respond and what is required for the response.’’). Consumer Reports, supra note 7, at 6 (observing that ‘‘a written incident response plan is an essential component of a good security system.’’); HITRUST, Comment Letter No. 18 on 2019 Safeguards and Privacy NPRM (FTC–2019– 0019), at 2 (July 1, 2019), https:// www.regulations.gov/document/FTC-2019-0019- 0018 (commenting that incident response plans can help organizations ‘‘to better allocate limited resources.). Safeguards Workshop, at 52 (remarks of Serge Jorgenson) (observing that a prompt response to an incident can prevent a ‘‘threat actor running around in my environment for days, months, years, and able to access anything they want.’’); Board Reporting Requirement: Workshop participants Adrienne Allen, Karthik Rangarajan, and Michele Norin each emphasized that such reporting can aid decision making. See Safeguards Workshop, at 201– 09; see also Rocio Baeza, Comment Letter No. 12 on Workshop Comment Docket (FTC–2020–0038), at 3–8 (Aug. 12, 2020), https://www.regulations.gov/ comment/FTC-2020-0038-0012 (supporting requirement and providing sample report form and compliance questionnaire); Juhee Kwon et al., The Association Between Top Management Involvement and Compensation and Information Security Breaches, J. L. Info. Sys., at 219–236 (2013) (‘‘. . . the involvement of an IT executive decreases the probability of information security breach reports by about 35 percent . . .’’); Julia L. Higgs et al., The Relationship Between Board-Level Technology Committees and Reported Security Breaches, J. L. Info. Sys., at 79–98 (2016) (‘‘[A]s a technology committee becomes more established, its firm is not as likely to be breached. To obtain further evidence on the perceived value of a technology committee, this study uses a returns analysis and finds that the presence of a technology committee mitigates the negative abnormal stock returns arising from external breaches.’’).

11 16 CFR 314.4(c)(1).

12 16 CFR 314.4(c)(2).

13 16 CFR 314.4(c)(8).

14 16 CFR 314.4(c)(3) and 314.4(c)(5). 15 Compl. for Permanent Injunction & Other Relief., FTC v. Equifax, Inc., No. 1:19–mi–99999– UNA (N.D. Ga. July 22, 2019) ¶ 17. 16 Id. ¶ 22.E.

17 Id. ¶ 22.F.

18 While the dissent questions the requirements in the Rule regarding elevating security issues to the top levels of the corporate structure, research supports these requirements. Boards are becoming increasingly involved in cybersecurity governance, as demonstrated by surveys of practitioners and the growth of literature aimed at educating board members on cybersecurity. Some studies suggest that Board attention to data security decisions can dramatically improve data safeguarding. For example, one study found a 35% decrease in the probability of information security breaches when companies include the Chief Information Security Officer (or equivalent) in the top management team and the CISO has access to the board. See Juhee Kwon et al., supra note 10. see also Safeguards Workshop, at 201–09.

19 U.S. H. Rep. Comm. on Oversight and Gov. Reform, Majority Staff Report on The Equifax Data Breach, 115th Cong., at 55–62 (Dec. 2018). 20 See, e.g., Safeguards Workshop, at 267 (remarks of Wendy Nather) (‘‘we have a lot more options, a lot more technologies today than we did before that are making both of these solutions, both encryption and MFA, easier to use, more flexible, in some cases cheaper, and we should be encouraging their adoption wherever possible.’’). Id. at 265–66 (remarks of Matthew Green) (‘‘I think that we’re in a great time when we’ve reached the point where we can actually mandate that encryption be used. . . . And we’ve reached the point where now it is something that’s come to be and we can actually build well.’’). Id. at 229–30 (remarks of Randy Marchany) (noting that encryption is already built into the Microsoft Office environment and that a number of Microsoft products, such as The amended Rule requires that financial institutions’ information security plans address such core concepts as controlling who is accessing their system,11 understanding their system,12 monitoring what users do in their system,13 and protecting the information contained in their system.14 More particularly, it also requires encryption of customer information and the use of multifactor authentication. Adopting these practices will reduce the chances of a breach occurring.

In fact, it is likely that the massive breach at Equifax could have been prevented or mitigated by adopting practices required by these amendments. For example, the Commission’s complaint alleged that the vulnerability that led to the breach was not detected for four months because Equifax’s automated vulnerability scanner was not configured to scan all of the networks in the system, something that could have been prevented if Equifax had performed an adequate inventory of its system as required by § 314.4(c)(2) of the amended Rule.15 Equifax allegedly did not encrypt the data of 145 million consumers as required by § 314.4(c)(3) of the amended Rule; such encryption might have prevented the intruders from misusing individuals’ sensitive information, even if they were able to obtain it.16 In addition, the complaint charged that Equifax did not adequately monitor activity on its network, which allowed intruders to access and use their network undetected for months; such monitoring will be required by § 314.4(c)(8).17 Finally, and perhaps most importantly, Equifax split authority over its information security program between two people, which caused failures of communications and oversight.18 Indeed, the U.S. House Committee on Oversight and Government identified Equifax’s organization as one of the major causes of the breach.19 Appointing a single Qualified Individual as the coordinator of Equifax’s information security system, as required by § 314.4(a) of the amended Rule, could have helped prevent or limit the scope of one of the largest breaches in American history. By implementing the measures required in the amended Rule, financial institutions will prevent or mitigate many future breaches, protecting consumers and their information. There is also no support for the dissent’s notion that the amendments eliminate financial institutions’ flexibility in a way that will hurt smaller businesses. The amendments require that information security programs address certain aspects of security, but do not prescribe any particular method for doing so. Specifically, the amended Rule requires that the information security program address areas such as access control, change management, information disposal, and monitoring user activity, but it does not require that financial institutions take any particular action in those areas. In fact, the Rule recognizes the concerns of small businesses and adopts appropriate flexibilities. Section 314.6 of the revised Rule exempts financial institutions that maintain information concerning fewer than 5,000 consumers from certain requirements. In addition, financial institutions with smaller and simpler systems may determine that minimal procedures are required in those areas, and they retain flexibility under these amendments to follow that route. Moreover, the record contains significant evidence that there are free and low-cost solutions for smaller businesses with more modest data security needs.20 VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00040 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 237

70311 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations Spreadsheets, Excel, Docs, and PowerPoint, support that encryption feature). Id. at 225. Id. at 106 (Remarks of Rocio Baeza) (‘‘[T]he encryption of data in transit has been standard. There’s no pushback with that.’’). Id. at 74 (remarks of James Crifasi) (stating that car dealerships can rely on existing staff for the role of Qualified Individual). Id. at 78– 79 (remarks of Lee Waters) (stating that any dealership with any IT staff at all would have someone who could assume the role of ‘‘qualified individual,’’ perhaps requiring some additional research or outside help). Id. at 81–82 (remarks of Rocio Baeza) (stating that companies may use an existing employee for the role and ‘‘for any areas where there may be skill gaps, that can be supplemented with either certifications or some type of education.’’). Id. at 89–90 (remarks of Brian McManamon) (noting that the size of a financial institution and the amount and nature of the information that it holds factor into an appropriate information security program); Presentation Slides, Inf. Security & Fin. Inst.: An FTC Workshop of GLB Safeguards, at 27–28 (July 13, 2020) (slides Accompanying remarks of Rocio Baeza, ‘‘Models for Complying to the Safeguards Rule Changes) (‘‘Safeguards Workshop Presentation Slides’’) https://www.ftc.gov/system/files/documents/ public_events/1567141/slides-glb-workshop.pdf (describing three different compliance models: Inhouse, outsource, and hybrid, with costs ranging from $199 per month to more than $15,000 per month). Safeguards Workshop, at 81–83 (remarks of Rocio Baeza) (describing three compliance models in more detail); Safeguards Workshop Presentation Slides, at 29 (remarks of Brian McManamon, ‘‘Sample Pricing’’) (estimating the cost of cybersecurity services based on number of endpoints). Id. at 83–85.

1 Public Law 106–102, 113 Stat. 1338 (1999). Notably, even as it transferred authority for other consumer financial regulation to the Consumer Financial Protection Bureau in the Dodd-Frank Act, Congress left this rulemaking authority with the Commission, a vote of confidence in our approach. 15 U.S.C. 6804(a)(1).

2 16 CFR part 314.

3 See, e.g., Federal Trade Commission, Statement Marking the FTC’s 50th Data Security Settlement, at 1 (Jan. 31, 2014), https://www.ftc.gov/system/ files/documents/cases/140131gmrstatement.pdf (‘‘FTC Data Security Statement’’) (‘‘Through its settlements, testimony, and public statements, the Commission has made clear that it does not require perfect security; reasonable and appropriate security is a continuous process of assessing and addressing risks; there is no one-size-fits-all data security program; and the mere fact that a breach occurred does not mean that a company has violated the law.’’); see also Prepared Statement of the Federal Trade Commission: Before the Committee on Homeland Security and Governmental Affairs Permanent Subcommittee on Investigations, 116 Cong. 3 (2019) (statement of Andrew Smith, Director, Bureau of Consumer Protection) (‘‘[t]here is no one-size-fits-all data security program . . .’’), https://www.ftc.gov/ system/files/documents/public_statements/ 1466607/commission_testimony_re_data_security_ senate_03072019.pdf. Federal Trade Commission, Stick with Security: A Business Blog Series (Oct. 2017), https://www.ftc.gov/news-events/blogs/ business-blog/2017/10/stick-security-ftc-resourcesyour-business.

4 FTC Notice of Proposed Rulemaking, 84 FR 13158 (Apr. 4, 2019), https:// www.federalregister.gov/documents/2019/04/04/ 2019-04981/standards-for-safeguarding-customerinformation (‘‘The Commission continues to believe that a flexible, non-prescriptive Rule enables covered organizations to use it to respond to the changing landscape of security threats, to allow for innovation in security practices, and to accommodate technological changes and advances.’’).

5 Under the FTC’s unfairness authority, the Commission brings cases when companies under its jurisdiction fail to employ ‘‘reasonable’’ security. FTC Data Security Statement, supra note 3 (‘‘The touchstone of the Commission’s approach to data security is reasonableness: a company’s data security measures must be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.’’).

6 See, e.g., In the matter of Ascension Data & Analytics, LLC, FTC File No. 1923126 (2020), https://www.ftc.gov/enforcement/casesproceedings/192-3126/ascension-data-analytics-llcmatter; U.S. v. Mortgage Solutions FCS, Inc., Civ. Action No. 4:20–cv–110 (N.D. Cal 2020), https:// www.ftc.gov/enforcement/cases-proceedings/182- 3199/mortgage-solutions-fcs-inc; FTC v. Equifax, Inc., Civ. Action No. 1:19–cv–03297–TWT (N.D. Ga. 2019), https://www.ftc.gov/enforcement/casesproceedings/172-3203/equifax-inc. 7 Dissenting Statement of Commissioner Noah Joshua Phillips and Commissioner Christine S. Wilson, Review of Safeguards Rule (Mar. 5, 2019), https://www.ftc.gov/system/files/documents/ public_statements/1466705/reg_review_of_ safeguards_rule_cmr_phillips_wilson_dissent.pdf; See, e.g., Noah Joshua Phillips (@FTCPhillips), Twitter (Mar. 5, 2019, 3:08 p.m.), https:// twitter.com/FTCPhillips/status/ 1103024596247289867 (‘‘A reexamination of the Rule may indeed be appropriate and necessary; but, before we borrow from other existing schemes, we must first understand whether the existing Rule is inadequate for its purpose and whether the data supports the efficacy of the alternatives.’’); Christine S. Wilson, Remarks at NAD 2020, One Step Forward, Two Steps Back: Sound Policy on Consumer Protection Fundamentals 7–8 (Oct. 5, 2020), https://www.ftc.gov/system/files/documents/ public_statements/1581434/wilson_remarks_at_ nad_100520.pdf.

We believe that these amendments represent a much-needed step forward in protecting Americans’ data security. Given growing recognition that the requirements captured in the Rule represent best practices, some financial institutions seem to have already taken appropriate steps to protect customers’ data and meet the requirements set out in the amended Rule. It is important, though, to require those that lag behind to strengthen their security and prevent future breaches before they occur, rather than in the wake of a devastating breach after the damage has already been done.

Joint Statement of Commissioners Noah Joshua Phillips and Christine S. Wilson in the Matter of the Final Rule Amending the Gramm-Leach-Bliley Act’s Safeguards Rule In 1999, Congress passed the Gramm- Leach-Bliley Act, which charged the Federal Trade Commission (the ‘‘Commission’’) with promulgating and enforcing a regulation to ensure that financial firms take care to safeguard the information they collect from consumers.1 The Safeguards Rule 2 has established more data security obligations for consumer financial data than for data collected by non-financial firms, a gap that underlies our view—shared by our colleagues—that congressional data security legislation is warranted.

One hallmark of the Safeguards Rule is its recognition that, in a world of continuously evolving threats and standards, a one-sizefits-all approach to data security may not work. Under Democratic and Republic leadership, the Commission has repeatedly emphasized this principle.3 We have traditionally eschewed an overly prescriptive approach, both to data security in general and to the Safeguards Rule itself.4 The FTC has never demanded ‘‘perfect’’ security because the Commission has recognized that data security is neither cost- nor consequence-free, and often requires tradeoffs.5 At the same time, during our tenure, the Commission has continued to enforce data security standards vigorously, including those embodied in the Safeguards Rule.6 In March 2019, the Commission approved a Notice of Proposed Rulemaking (‘‘NPRM’’) proposing additional requirements to the Safeguards Rule. While we recognize the value in regularly reviewing our rules and updating them as needed, we dissented then because the proposal lacked data demonstrating the need for and efficacy of the proposed amendments.7 We appreciate Staff’s diligent work on this rule and many of the modifications made to the original proposal. The Federal Register Notice does a commendable job of presenting the full panoply of comments that the Commission received. The FTC is at its best when it seeks input from experts, industry, and consumer groups; this rulemaking process reflects a commitment to that approach. But the comment period did not produce data demonstrating that the previous iteration of the rule was inadequate, or that the costs and consequences of the new prescriptive obligations will translate into actual consumer safeguards. That was our concern, and the comments did not allay it. In fact, as several commenters observed, the new prescriptive requirements could weaken data security by diverting finite resources towards a check-the-box compliance exercise and away from risk management tailored to address the unique security needs of individual financial institutions. It is ironic that the revisions mandate a risk assessment and then order firms to prioritize specified precautions ahead of the risks and needs counseled by that assessment. The revisions also impose intrusive corporate governance obligations wholly unsupported by record evidence of prevalent failures at the senior managerial level.

For these reasons, which we explain more fully below, we dissent.

The Record Fails To Provide a Basis for the New Requirements We expressed concern in March 2019 that some of the proposals in the NPRM tracked issues that arose in cases involving firms not covered by the Safeguards Rule. That is, those failures occurred at companies to which the Safeguards Rule did not apply. And heightened obligations imposed in a settlement context, when a company has engaged in risky and allegedly illegal behavior, may not be appropriate for all market participants. We did not see evidence that covered firms had a systematic problem—i.e., that the Rule was not VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00041 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 238

70312 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 8 Commenters on the proposed rules reflected these same concerns. See, e.g, CTIA (comment 34, NPRM) at 4, https://www.regulations.gov/comment/ FTC/2019-0019-0034 (observing that most examples cited in the NPRM are from non-financial firms and arguing that the FTC’s action in Equifax demonstrated that the agency is able to use to the current framework effectively); Global Privacy Alliance (comment 38, NPRM) at 4, https:// www.regulations.gov/comment/FTC/2019-0019- 0038 (the changes to the rules started not from FTC experience but rather from state laws); Electronic Transactions Association (comment 27, NPRM), https://www.regulations.gov/comment/FTC/2019- 0019-0027 (the current rule is effective and there are no harms that warrant these changes); National Automobile Dealers Association (comment 46, NPRM) at 6, https://www.regulations.gov/comment/ FTC/2019-0019-0046 (‘‘[N]ew requirements for all financial institutions should not be based on unrelated enforcement actions that may not be generally applicable to all financial institutions subject to the Rule.’’).

9 Federal Trade Commission, Data Security, https://www.ftc.gov/datasecurity. 10 One study cited by commenters pointed toward widespread problems among fintech firms ‘‘including misuse of cryptography, use of weak cryptography, and excessive permission requirements.’’ The Clearing House Association LLC (comment 49, NPRM) at 7–9, https:// www.regulations.gov/comment/FTC/2019-0019- 0049 (citing a 2018 study by the Center for Financial Inclusion, https://content.centerfor financialinclusion.org/wp-content/uploads/sites/2/ 2018/09/CFI43-CFI_Online_Security-Final- 2018.09.12.pdf). This study included firms from around the world and did not indicate that this limited set of issues arose in U.S. firms covered by the Safeguards Rule. See also National Automobile Dealers Association (comment 46, NPRM) at 46, https://www.regulations.gov/comment/FTC/2019- 0019-0046 (‘‘These requirements have largely not been proven to be necessary or effective.’’). Participants at the FTC’s July 2020 Workshop generally agreed that companies could invest more in security, but the fact of under-investment does not mean that these changes to the Safeguards Rule constitute the best course of action. FTC, Information Security and Financial Institutions: An FTC Workshop to Examine Safeguards Rule Tr. at 23–70 (July 13, 2020), https://www.ftc.gov/system/ files/documents/public_events/1567141/transcriptglb-safeguards-workshop-full.pdf (‘‘Safeguards Workshop’’).

11 Consumer Reports (comment 52, NPRM), https://www.regulations.gov/comment/FTC/2019- 0019-0052 at 2. Not all the commenters agreed with this perspective, and some felt that these rules would have prevented the Equifax breach. See National Consumer Law Center and others (comment 58, NPRM), https://www.regulations.gov/ comment/FTC/2019-0019-0058. Chair Khan and Commissioner Slaughter focus on the Equifax breach to justify the adoption of prescriptive and complex data security measures, measures that match the sophistication and complexity of the consumer financial data managed by one of the largest credit bureaus. But even assuming the new rules would have prevented it, one (albeit) highprofile breach, without more, should not be extrapolated to an entire industry with diverse business models housing varied consumer financial data. Reasonable safeguards for a company like Equifax, based on its size and complexity, the nature and scope of its activities, and the sensitivity of the information involved, would likely outpace procedures that would be appropriate or reasonable for a sole proprietorship or small business. 12 While the Final Rule is based on proposals from New York State Department of Financial Services (‘‘NYDFS’’), the FTC imposes its requirements much more broadly than the NYDFS Cybersecurity Requirements for Financial Services Companies, 23 NYCRR Pt. 500. The NYDFS requirements exempt a much larger cross-section of organizations from the most onerous, prescriptive, and expensive provisions in their rule. 23 NYCRR § 500.19. Nor do the exceptions in the Final Rule, while helpful, suffice.

13 Unfortunately, this is not the first time this Commission has emphasized what we can do over what we should do. See, e.g., Joint Statement of Commissioners Noah Joshua Phillips and Christine S. Wilson, In the matter of Resident Home LLC, Commission File No. 2023179 (Oct. 7, 2021), https://www.ftc.gov/system/files/documents/ public_statements/1597270/resident_home_ dissenting_statement_wilson_and_phillips_final_ 0.pdf; Joint Statement of Commissioners Noah Joshua Phillips and Christine S. Wilson, U.S. v. iSpring Water Systems, LLC, Commission File No. C4611 (Apr. 12, 2019), https://www.ftc.gov/system/ files/documents/public_statements/1513499/ ispring_water_systems_llc_c4611_modified_joint_ statement_of_commissioners_phillips_and_wilson_ 4-12.pdf.

14 Cybersecurity Requirements for Financial Services Companies, 23 NYCRR Pt. 500 (2016). 15 See Consumer Data Industry Association (comment 36, NPRM) at 2, https:// www.regulations.gov/document?D=FTC-2019-0019- 0036 (noting that the NY rule is too recent and Congress is debating new legislation that should be left to Congress to resolve); National Automobile Dealers Association (comment 46, NPRM) at 46, https://www.regulations.gov/comment/FTC-2019- 0019-0046 (The new rules ‘‘are premature as they are based on untested and new standards in a rapidly changing environment, and in a context where federal debate is ongoing.’’); New York Insurance Association (comment 31, NPRM), https://www.regulations.gov/comment/FTC-2019- 0019-0031 (it is premature to adopt these rules without the benefit of the state’s experience). 16 We appreciate the time and resources the NYDFS invested in commenting on our proposed rule. Though the NYDFS does say that its rules have ‘‘enhanced cybersecurity protection across the financial industry and fostered an environment in which the threat of a cyber attack is taken seriously at all levels of New York’s financial services firms,’’ it offers no supporting data. New York State Department of Financial Services (comment 40, NPRM), https://www.regulations.gov/comment/ FTC-2019-0019-0040.

17 As several commenters pointed out, the NYDFS rules are more nuanced that the amendments introduced today. For instance, under the NYDFS regulations, certain additional requirements only apply to a category of sensitive data, a limitation not carried through to the Safeguards Rule. See, e.g., U.S. Chamber of Commerce (comment 33, NPRM), https://www.regulations.gov/comment/FTC-2019- 0019-0033; CTIA (comment 34, NPRM), https:// www.regulations.gov/comment/FTC/2019-0019- 0034; Electronic Transactions Association (comment 27, NPRM), https://www.regulations.gov/ comment/FTC/2019-0019-0027. These distinctions only raise more questions and concerns about basing our regulations on the New York rules. 18 See, e.g., Fourth Amendment is Not for Sale Act, S. 1265, 117th Cong. (2021); Data Care Act of 2021, S. 919, 117th Cong. (2021); Data Protection Act of 2021, S. 2134, 117th Cong. (2021); SAFE DATA Act, S. 2499, 117th Cong. (2021); Consumer Online Privacy Rights Act, S. 2968, 116th Cong. (2019). See also, California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq.; Virginia Consumer Data Protection Act, Va. Code § 59.1–575 et seq.; and Colorado Privacy Act, 2021 Colo. ALS 483, 2021 Colo. Ch. 483, 2021 Colo. SB. 190. 19 Council Directive 2016/679, art. 32 2016 O.J. (L119).

20 See, e.g., Joseph Menn and Christopher Bing, Hackers of SolarWinds stole data on U.S. sanctions policy, intelligence probes, Reuters (Oct. 8, 2021), https://www.reuters.com/world/us/hackerssolarwinds-breach-stole-data-us-sanctions-policyintelligence-probes-2021-10-07/; Stephanie Kelly and Jessica Resnick-ault, One password allowed hackers to disrupt Colonial Pipeline, CEO tells senators, Reuters (June 8, 2021), https:// www.reuters.com/business/colonial-pipeline-ceotells-senate-cyber-defenses-were-compromisedworking.8 The Commission can—and does— promote best practices and reasonable care requirements through speeches, guidance, reports, and the like, to help financial firms evaluate whether they are taking proper precautions.9 But new rules that set concrete standards for all companies, regardless of risk, require more justification. Such rules make companies liable for penalties, and could focus efforts on compliance to address penalty deterrence rather than risk. Dozens of commenters have shared their views on the Safeguards proposal, and FTC Staff held a workshop to evaluate the need to change the Rule. While there is no shortage of opinions as to the need and benefits of the proposed changes (nor is there a shortage of opinions critiquing the new requirements), this process failed to provide evidence of market failure or other systemic problems 10 necessitating the proposed changes for firms already governed by the requirements of the Rule. In fact, one commenter that generally supported the rule changes noted that it was not clear that the new rules would have prevented the alleged lapses that led to the Equifax breach, the largest Safeguards case on record.11 That these proposals may constitute best practices appropriate to certain firms or situations does not justify imposing them on every firm and in every situation.12 The FTC historically has been appropriately cautious in mandating specific security practices, and we see no sound basis in the rulemaking record to change that approach.13 The Revised Safeguards Rule Is Premature In our 2019 statement, we expressed concern that the proposals in the NPRM were premature. They are based in large part on the New York Department of Financial Service data security rules,14 adopted in 2016. At the same time, Congress and the Executive Branch were evaluating new privacy and data security legislation that may overlap with the proposed amendments.15 Since our original statement, we have been provided with no additional information on the impact and efficacy of the NYDFS rules.16 Without this critical input, we do not believe adopting wholesale the NYDFS approach is the prudent course.17 We would have been better served by monitoring the efficacy, costs and unintended consequences of the NYDFS rules during this ramp-up period. Imposing similar rules on far more firms across a broader array of industries makes even less sense.

Congress, with the encouragement of the Commission, has continued to consider legislative initiatives in this area. Throughout 2019, 2020 and 2021, we saw the release of several draft bills addressing data security, as well as privacy.18 And other developments, such as data security requirements of the General Data Protection Regulation 19 and new cybersecurity incidents 20 ensure that VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00042 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 239

70313 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations ahead-hack-2021-06-08; Carly Page, The Accellion data breach continues to get messier, TechCrunch (July 8, 2021), https://techcrunch.com/2021/07/08/ the-accellion-data-breach-continues-to-get-messier/; Peter Valdes-Dapena, Volkswagen hack: 3 million customers have had their information stolen, CNN (June 11, 2021), https://www.cnn.com/2021/06/11/ cars/vw-audi-hack-customer-information/ index.html.

21 Sen. Roger Wicker, Rep. Cathy McMorris Rodgers, & Noah Phillips, FTC must leave privacy legislating to Congress, Wash. Examiner (Sept. 29, 2021), https://www.washingtonexaminer.com/ opinion/op-eds/ftc-must-leave-privacy-legislatingto-congress. Substance aside, businesses and consumers need confidence to plan around new rules. As the recent—and perhaps future—debate about net neutrality rules has demonstrated, agency rules are subject to disruptive swings that undermine such confidence.

22 The Commission itself acknowledges the importance of flexibility in issuing the Final Rule. See, e.g., Final Rule at 27 (‘‘The Commission, however, believes that the elements provide sufficient flexibilityfor financial institutions to adopt information security programs suited to the size, nature, and complexity of their organization and information systems.’’) 23 See Final Rule; American Council on Education (comment 24, NPRM) at 13–14, https:// www.regulations.gov/comment/FTC-2019-0019- 0024; Wisconsin Bankers Association (comment 37, NPRM) at 1–2, https://www.regulations.gov/ comment/FTC-2019-0019-0037; American Financial Services Association (comment 41, NPRM) at 4, https://www.regulations.gov/comment/FTC-2019- 0019-0041; National Association of Dealer Counsel (comment 44, NPRM) at 1, https:// www.regulations.gov/comment/FTC-2019-0019- 0044; National Automobile Dealers Association (comment 46, NPRM) at 11, https:// www.regulations.gov/comment/FTC-2019-0019- 0046; National Independent Automobile Dealers Association, (comment 48, NPRM) at 3, https:// www.regulations.gov/comment/FTC-2019-0019- 0048; Gusto and others (comment 11, Workshop) at 2–4, https://www.regulations.gov/comment/FTC- 2019-0019-0011; National Pawnbrokers Association (comment 3, NPRM) at 2, https:// www.regulations.gov/comment/FTC-2019-0019- 0032; See also Remarks of James Crifasi, Safeguards Workshop, supra note 10, Tr. at 72–74, https:// www.ftc.gov/system/files/documents/public_events/ 1567141/transcript-glb-safeguards-workshopfull.pdf (study showing that compliance costs are unaffordable for small businesses). 24 Small Business Administration Office of Advocacy (comment 28, NPRM) at 3–4, https:// www.regulations.gov/comment/FTC-2019-0019- 0028 (‘‘An agency cannot consider alternatives that minimize any significant economic impact if the agency does not know what the economic impact of the proposed action is.’’). 25 See CTIA (comment 34, NPRM), https:// www.regulations.gov/comment/FTC-2019-0019- 0034 (noting the need for more study on the costs to competition); U.S. Chamber of Commerce (comment 33, NPRM) at 4, https:// www.regulations.gov/comment/FTC-2019-0019- 0033 (‘‘Some private organizations can absorb the added costs, while others cannot.’’). See also Christine S. Wilson, Remarks at the Future of Privacy Forum, A Defining Moment for Privacy: The Time is Ripe for Federal Privacy Legislation 13 (Feb. 6, 2020), https://www.ftc.gov/system/files/ documents/public_statements/1566337/ commissioner_wilson_privacy_forum_speech_02- 06-2020.pdf (‘‘Importantly, the legislative framework should also consider competition. Regulations, by their nature, will impact markets and competition. GDPR may have lessons to teach us in this regard. Research indicates that GDPR may have decreased venture capital investment and entrenched dominant players in the digital advertising market.’’); Noah Joshua Phillips, Prepared Remarks at internet Governance Forum USA, Keep It: Maintaining Competition in the Privacy Debate (July 27, 2018), https://www.ftc.gov/ system/files/documents/public_statements/ 1395934/phillips_-_internet_governance_forum_7- 27-18.pdf (discussing the competition impacts of new privacy rules).

26 See U.S. Chamber of Commerce (comment 33, NPRM), https://www.regulations.gov/comment/ FTC-2019-0019-0033; Consumer Data Industry Association (comment 36, NPRM), https:// www.regulations.gov/comment/FTC-2019-0019- 0036; Global Privacy Alliance (comment 38, NPRM), https://www.regulations.gov/comment/ FTC/2019-0019-0038. While some parts of the rule, such as encryption requirements, allow security officials to make a written determination that a different precaution is appropriate, it seems unlikely that any individual security official will risk liability to make such a determination and the specific requirements here will likely become the default rule. American Council on Education (comment 24, NPRM) at 12, https:// www.regulations.gov/comment/FTC-2019-0019- 0024 (‘‘In the absence of a clear delineation by the Commission of what alternatives an institutional information security executive might approve that the Commission considers reasonably equivalent, and assurance that they are reasonably applicable in our contexts, that pressure release valve in the requirement seems unlikely to release much pressure.’’); Software Information & Industry Association (comment 29, NPRM) at 3, https:// www.regulations.gov/comment/FTC-2019-0019- 0056 (‘‘The mere threat of a per se law violation will chill these approvals except in the most ironclad circumstances, thereby potentially thwarting industry-wide adoption of new and better security standards.’’); New York Insurance Association (comment 31, NPRM), https:// www.regulations.gov/comment/FTC-2019-0019- 0031 (‘‘This runs the risk that companies might feel compelled to encrypt all consumer data regardless of whether the CISO’s compensating controls would be second guessed in the event a company were to lose unencrypted customer information.’’); Mortgage Bankers Association (comment 26, NPRM) at 4, https://www.regulations.gov/comment/FTC- 2019-0019-0026 (noting the obligation to prepare an incident response plan had ‘‘the potential to cripple small businesses under the pressure of repeatedly checking the boxes for potential harmless events.’’). 27 Bank Policy Institute (comment 39, NPRM) at 6, https://www.regulations.gov/comment/FTC-2019- 0019-0039 (‘‘When the sector surveyed its information security teams in late 2016, CISOs reported that approximately 40% of their cyber team’s time was spent on compliance related matters, not on cybersecurity. Due to one framework issuance, in particular, the reconciliation process delayed one firm’s implementation of a security event monitoring tool intended to better detect and respond to cyberattacks by 3–6 months. With respect to another issuance, another firm stated that 91 internal meetings were held to determine how that issuance aligned with its program and in gathering data for eventual regulatory requests.’’). 28 See U.S. Chamber of Commerce (comment 33, NPRM) at 4, https://www.regulations.gov/comment/ FTC-2019-0019-0033 (‘‘the proposed requirements would increasingly divert company resources toward compliance and away from risk management activities that are tailored to businesses’ unique security needs.’’); Software Information & Industry Association (comment 29, NPRM) at 3, https://www.regulations.gov/comment/ FTC-2019-0019-0056 (‘‘The effect of a prescriptive approach in this enforcement structure is to place companies in the position of forced compliance with potentially unnecessary or inapplicable requirements without the appropriate process for these covered entities to explain to a supervisory authority why it is unnecessary.’’); American Financial Services Association (comment 41, NPRM), https://www.regulations.gov/comment/ FTC-2019-0019-0041. In some cases, asking too much of small businesses for whom all this is a substantial undertaking may lead them to fail at even the basic protections. Safeguards Workshop, supra note 10, Tr. at 118–19 (July 13, 2020), https:// www.ftc.gov/system/files/documents/public_events/ 1567141/transcript-glb-safeguards-workshopfull.pdf.

29 See Bank Policy Institute (comment 39, NPRM), https://www.regulations.gov/comment/FTC-2019- 0019-0039; Money Services Round Table (comment 53, NPRM), https://www.regulations.gov/comment/ FTC-2019-0019-0053.

30 See Consumer Data Industry Association (comment 36, NPRM) at 7–8, https:// www.regulations.gov/comment/FTC-2019-0019- Continued these issues will continue to draw congressional attention. The decisions about tradeoffs in this space are complex and significant for consumers, business, and government; intrusive mandates are best left to the people’s representatives rather than to the vagaries of the administrative rulemaking process.21 The Revised Rules Inhibit Flexibility and Impose Substantial Costs The Safeguards Rule originally drafted and evaluated by the Commission embraced a flexible approach, emphasizing protections targeted to a company’s size and risk profile.22 As we wrote in 2019, these new rules move us away from that approach; that loss of flexibility will impose costs without necessarily improving safeguards for consumer data, which should be the point of this exercise.

Commenters and the Commission itself have noted that there are financial impacts to these new requirements.23 The Small Business Administration’s Office of Advocacy stated its belief that the Commission itself does not appear to understand fully the economic impact of the proposed changes to the Safeguards Rule.24 The burden of these new rules may also reduce competition and innovation, as smaller firms less able to absorb the financial costs cede ground to larger firms better equipped to handle new regulatory mandates.25 Security itself may also suffer. A series of specific rules can incentivize companies to move from a thoughtful assessment of risk and precautions to a check-the-box exercise to ensure that they are complying with regulatory mandates—in other words, from a focus on real security to an emphasis on rule compliance.26 One commenter cited data demonstrating that when security personnel are busy with compliance and regulatory response, they have less time to focus on a firm’s actual security needs.27 Further, without the flexibility to prioritize, finite resources may be diverted to areas of lower risk but higher regulatory scrutiny; 28 commenters noted the irony of mandating a risk assessment and then ordering firms to prioritize specified precautions ahead of the risks and needs counseled by that assessment.29 And potentially innovative security practices that address changing threats and needs may be discouraged.30 As VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00043 Fmt 4701 Sfmt 4700 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 240

70314 Federal Register / Vol. 86, No. 234 / Thursday, December 9, 2021 / Rules and Regulations 0036 (minimization requirement can impact innovative uses more broadly). 31 See Cisco Systems Inc. (comment 51, NPRM) at 3, https://www.regulations.gov/comment/FTC-2019- 0019-0051 (noting also in the context of multi-factor authentication that there will come a time when it is no longer the ‘‘appropriate baseline’’ and ‘‘covered entities could find themselves in full compliance with the rule as long as they use access control technology no less protective than MFA as defined in the Proposed Amendments.’’). 32 National Automobile Dealers Association (comment 46, NPRM), https://www.regulations.gov/ comment/FTC-2019-0019-0046. 33 See CTIA (comment 34, NPRM) at 3–5, https:// www.regulations.gov/comment/FTC-2019-0019- 0034 (flexibility in the rule allowed it to keep up with evolving threats, whereas new rule could limit innovation); HITRUST Alliance (comment 18, NPRM), https://www.regulations.gov/comment/ FTC-2019-0019-0018 (expressing concern about creating outdated requirements); The American Financial Services Association (comment 41, NPRM), https://www.regulations.gov/comment/ FTC-2019-0019-0041.

34 National Automobile Dealers Association (comment 46, NPRM) https://www.regulations.gov/ comment/FTC-2019-0019-0046 (arguing that the Commission needs additional study into the costs and benefits); See also Consumer Data Industry Association (comment 36, NPRM), https:// www.regulations.gov/comment/FTC-2019-0019- 0036 (benefits of new rule not justified by tradeoffs).

35 American Council on Education (comment 24, NPRM) at 16, https://www.regulations.gov/ comment/FTC-2019-0019-0024; National Automobile Dealers Association (comment 46, NPRM) at 41, https://www.regulations.gov/ comment/FTC-2019-0019-0046. 36 U.S. Chamber of Commerce (comment 33, NPRM) at 12, https://www.regulations.gov/ comment/FTC-2019-0019-0033; National Automobile Dealers Association (comment 46, NPRM) at 34–36, https://www.regulations.gov/ comment/FTC-2019-0019-0046. 37 See Final Rule. See also American Council on Education (comment 24, NPRM) at 14, https:// www.regulations.gov/comment/FTC-2019-0019- 0024 (critiquing the intrusion on personnel practices).

38 U.S. v. Facebook, Inc., Civ. Action No. 19–cv– 2184 (D.D.C. July 24, 2019), https://www.ftc.gov/ enforcement/cases-proceedings/092-3184/facebookinc.

39 These governance rules may not even promote security. See Consumer Data Industry Association (comment 36, NPRM), https://www.regulations.gov/ comment/FTC-2019-0019-0036 (arguing that the annual reporting will become a checkbox exercise). one commenter noted, ‘‘[e]ven today’s best practices will be overtaken by future changes in both technology and the capabilities of threat actors,’’ 31 and these proscriptive rules lose the ‘‘self-modernizing’’ nature of flexible requirements,32 locking in place the primacy of current practices.33 The reduction in flexibility and imposition of these costs must be justified by a significant reduction in risk or some other substantial consumer benefit. But the record provides scant support for these tradeoffs. Or as one commenter put it:

[A]s with many of these requirements, we do not take issue with the notion that there is merit to this step [requiring monitoring], and that many financial institutions will implement some version of this control. However, by making this an explicit, standalone requirement, the Commission is enshrining costs and efforts that will be extensive and will likely not be needed in all circumstances.34 The Rules Involve the FTC in the Internal Governance Decisions of Covered Firms The specifics of the proposals also raise issues, as we expressed in 2019, with regard to mandating the appropriate level of board engagement,35 hiring and training requirements,36 and program accountability structures.37 We wrote then, and remain concerned now, that the Commission is substituting its own judgement about governance decisions for those of private companies covered by this Rule. In certain extraordinary cases involving clear evidence of management failure, we have imposed prescriptive governance obligations on respondents.38 Those rare and egregious instances cannot justify a similar approach in a broad rulemaking absent a real record of widespread corporate mismanagement or failure at the senior management level.

The Commission has elected to proceed with most of these governance requirements, forcing the hand of management and shifting their priorities to avoid the risk of regulatory action,39 without clear evidence of their need or efficacy.

Conclusion Regularly reviewing our rules to ensure that they address the current environment is an important part of the FTC’s regular process. But rules have far-reaching and frequently unintended impacts in the real world; when imposing additional legal obligations in the rulemaking context, we must do so with great care. The amended Safeguards Rule replaces a rule that has worked well for 20 years, a rule that took a principle-based approach in order to provide financial institutions flexibility to determine the appropriate and realistic security safeguards for their organizations. The record before us at best fails to convince that the changes are necessary and at worst raises concern about the substantial costs and risks in imposing these amendments. Accordingly, we dissent.

[FR Doc. 2021–25736 Filed 12–8–21; 8:45 am] BILLING CODE 6750–01–P VerDate Sep<11>2014 18:18 Dec 08, 2021 Jkt 256001 PO 00000 Frm 00044 Fmt 4701 Sfmt 9990 E:\FR\FM\09DER3.SGM 09DER3 khammond on DSKJM1Z7X2PROD with RULES3

Page 241

77499 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 1 Public Law 106–102, 113 Stat. 1338 (1999). 2 See 15 U.S.C. 6801(b), 6805(b)(2). 3 67 FR 36483 (May 23, 2002). 4 Id.

5 84 FR 13158 (Apr. 4, 2019). 6 The 49 relevant public comments received on or after March 15, 2019, can be found at Regulations.gov. See FTC Seeks Comment on Proposed Amendments to Safeguards and Privacy Rules, 16 CFR part 314, Project No. P145407, https://www.regulations.gov/docket/FTC-2019- 0019/comments. The 11 relevant public comments relating to the subject matter of the July 13, 2020, workshop can be found at: https:// www.regulations.gov/document/FTC-2020-0038- 0001/comment. This notice cites comments using the last name of the individual submitter or the name of the organization, followed by the number based on the last two digits of the comment ID number.

7 See FTC, Information Security and Financial Institutions: FTC Workshop to Examine Safeguards Rule Tr. (July 13, 2020), https://www.ftc.gov/ system/files/documents/public_events/1567141/ transcript-glb-safeguards-workshop-full.pdf. 8 86 FR 70272 (Dec. 9. 2021). 9 84 FR 13158, 13163 (Apr. 4, 2019). 10 Id. at 13169.

11 See Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, 70 FR 15736, 15752 (Mar. 29, 2005) (originally issued by the Office of the Comptroller of the Currency; the Board of Governors of the Federal Reserve System; the Federal Deposit Insurance Corporation; and the Office of Thrift Supervision) (‘‘At a minimum, an institution’s response program should contain procedures for the following: . . . Notifying its primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information, as defined below; . . . [and notifying] customers when warranted’’), https:// www.occ.treas.gov/news-issuances/federal-register/ 2005/70fr15736.pdf (emphasis in original). Authority: 49 U.S.C. 106(f), 106(g); 40103, 40113, 40120; E.O. 10854, 24 FR 9565, 3 CFR, 1959–1963 Comp., p. 389. § 71.1 [Amended] ■2. The incorporation by reference in 14 CFR 71.1 of FAA Order JO 7400.11H, Airspace Designations and Reporting Points, dated August 11, 2023, and effective September 15, 2023, is amended as follows:

Paragraph 5000 Class D Airspace.

* * * * * ASO GA D Eastman, GA [Amended] Heart of Georgia Regional Airport, GA (Lat 32°12′59″ N, long 83°07′43″ W) That airspace extending upward from the surface to and including 2,500 feet MSL within a 4.6-mile radius of the Heart of Georgia Regional Airport. This Class D airspace area is effective during the specific dates and times established in advance by a Notice to Air Missions. The effective date and time will thereafter be continuously published in the Chart Supplement. * * * * * Paragraph 6005 Class E Airspace Areas Extending Upward From 700 Feet or More Above the Surface of the Earth. * * * * * ASO GA E5 Eastman, GA [Amended] Heart of Georgia Regional Airport, GA (Lat 32°12′59″ N, long 83°07′43″ W) That airspace extending upward from 700 feet above the surface within a 7.1-mile radius of Heart of Georgia Regional Airport. * * * * * Issued in College Park, Georgia, on November 7, 2023.

Lisa E. Burrows, Manager, Airspace & Procedures Team North, Eastern Service Center, Air Traffic Organization.

[FR Doc. 2023–25016 Filed 11–9–23; 8:45 am] BILLING CODE 4910–13–P FEDERAL TRADE COMMISSION 16 CFR Part 314 RIN 3084–AB35 Standards for Safeguarding Customer Information AGENCY: Federal Trade Commission. ACTION: Final rule.

SUMMARY: The Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) is issuing a final rule (‘‘Final Rule’’) to amend the Standards for Safeguarding Customer Information (‘‘Safeguards Rule’’ or ‘‘Rule’’) to require financial institutions to report to the Commission any notification event where unencrypted customer information involving 500 or more consumers is acquired without authorization. DATES: The amendments are effective May 13, 2024.

FOR FURTHER INFORMATION CONTACT: David Lincicum (202–326–2773), Division of Privacy and Identity Protection, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION: I. Background Congress enacted the Gramm Leach Bliley Act (‘‘GLBA’’) in 1999.1 The GLBA provides a framework for regulating the privacy and data security practices of a broad range of financial institutions. Among other things, the GLBA requires financial institutions to provide customers with information about the institutions’ privacy practices and about their opt-out rights, and to implement security safeguards for customer information.

Subtitle A of Title V of the GLBA required the Commission and other Federal agencies to establish standards for financial institutions relating to administrative, technical, and physical safeguards for certain information.2 Pursuant to the GLBA’s directive, the Commission promulgated the Safeguards Rule in 2002.3 The Safeguards Rule became effective on May 23, 2003.4 II. Regulatory Review of the Safeguards Rule On April 4, 2019, the Commission issued a notice of proposed rulemaking (‘‘NPRM’’) setting forth proposed amendments to the Safeguards Rule.5 In response, the Commission received 49 comments from various interested parties including industry groups, consumer groups, and individual consumers.6 On July 13, 2020, the Commission held a workshop concerning the proposed changes and conducted panels with information security experts discussing subjects related to the proposed amendments.7 The Commission received 11 comments following the workshop. After reviewing the initial comments to the NPRM, conducting the workshop, and then reviewing the comments received following the workshop, the Commission issued final amendments to the Safeguards Rule on December 9, 2021.8 In the NPRM, the Commission explained that its proposed amendments to the Safeguards Rule were based primarily on the cybersecurity regulations issued by the New York Department of Financial Services, 23 NYCRR 500 (‘‘Cybersecurity Regulations’’).9 The Commission also noted that the Cybersecurity Regulations require covered entities to report security events to the superintendent of the Department of Financial Services.10 Relatedly, for many years, some other Federal agencies enforcing the GLBA have required financial institutions to provide notice to the regulator, and in some instances notice to consumers as well.11 Although the Commission did not include a similar reporting requirement in the NPRM, it did seek comment on whether the Safeguards Rule should be amended to require that financial institutions report security events to the Commission. Specifically, the Commission requested comments on whether such a requirement should be added and, if so, (1) the appropriate deadline for reporting security events after discovery, (2) whether all security events should require notification or whether notification should be required only under certain circumstances, such as a determination of a likelihood of harm to customers or that the event VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00005 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 242

77500 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 12 Id.

13 86 FR 70272 (Dec. 9. 2021). 14 See 86 FR 70062, 70067 (Dec. 9, 2021). 15 The 14 relevant public comments received can be found at Regulations.gov. See FTC Seeks Comment on Proposed Amendments to Safeguards and Privacy Rules, 16 CFR part 314, Project No. P145407, https://www.regulations.gov/docket/FTC- 2021-0071/comments.

16 See Anonymous (Comment 2); Briggs (Comment 4); Clearing House Association L.L.C. (‘‘Clearing House’’) (Comment 11); Anonymous (Comment 14); Securities Industry and Financial Markets Association (‘‘SIFMA’’) and Bank Policy Institute (‘‘BPI’’) (‘‘SIFMA/BPI’’) (Comment 15) (supporting notification requirement for financial institutions that are not regulated by non-FTC financial agencies); American Council on Education (Comment 18) (supporting proposed notice requirement with revisions); Electronic Privacy Information Center (‘‘EPIC’’) (Comment 19). 17 See, e.g., Anonymous (Comment 2); Briggs (Comment 4); The Clearing House (Comment 11) at 2 (describing breaches in the fintech industry). 18 Clearing House (Comment 11) at 1–2. 19 EPIC (Comment 19) at 2. 20 See American Financial Services Association (‘‘AFSA’’) (Comment 12); Consumer Data Industry Association (‘‘CDIA’’) (Comment 13); American Escrow Association (Comment 16); CTIA (Comment 20); National Automobile Dealers Association (‘‘NADA’’) (Comment 21); U.S. Chamber of Commerce (Comment 22).

21 See, e.g., AFSA (Comment 12) at 3; CDIA (Comment 13) at 2–3; CTIA (Comment 20) at 2–4; NADA (Comment 21) at 2–3; U.S. Chamber of Commerce (Comment 22) at 3. 22 CTIA (Comment 20) at 6–7. 23 While some States that require notification to a State agency make companies’ breach notifications public, see, e.g., N.H. Dep’t of Just., Off. of Attorney Gen., Security Breach Notifications, https://www.doj.nh.gov/consumer/securitybreaches/, other States do not make notifications public, and as noted above, not all States require notice to a State government agency. Some nongovernmental sources report breach notifications, but there is no guarantee that such sources are comprehensive as they depend in part on reporting by consumers who received a breach notification letter. Thus, the Commission could not obtain comprehensive data relating to breaches at regulated financial institutions by compiling reports of breaches from other sources. 24 See, e.g., Clearing House (Comment 11) at 8; CDIA (Comment 13) at 3; CTIA (Comment 20) at 4. affects a certain number of customers, (3) whether such reports should be made public, (4) whether events involving encrypted information should be included in the requirement, and (5) whether the requirement should allow law enforcement agencies to prevent or delay notification if notification would affect law-enforcement investigations.12 The final rule, which the Commission published in the Federal Register on December 9, 2021, did not include a reporting requirement.13 However, on the same date, the Commission published a supplemental notice of proposed rulemaking (‘‘SNPRM’’) in the Federal Register, which proposed further amending the Safeguards Rule to require financial institutions to report to the Commission certain security events as soon as possible, and no later than 30 days after discovery of the event.14 Specifically, the Commission proposed to require financial institutions to notify the Commission electronically through a form located on the FTC’s website about any security event that resulted or is reasonably likely to result in the misuse of customer information affecting at least 1,000 consumers. The Commission proposed that the notification include a limited set of information, consisting of (1) the name and contact information of the reporting financial institution, (2) a description of the types of information involved in the security event, (3) the date or the date range of the security event, if it can be determined, and (4) a general description of the security event. In response to the SNPRM, the Commission received 14 comments from various interested parties, including industry groups, consumer groups, and individual consumers.15 After reviewing the comments, the Commission now finalizes the proposed amendments with minor changes. III. Overview of Final Rule The Final Rule requires financial institutions to report notification events, defined as the unauthorized acquisition of unencrypted customer information, involving at least 500 customers to the Commission. The notice to the Commission must include: (1) the name and contact information of the reporting financial institution; (2) a description of the types of information that were involved in the notification event; (3) if the information is possible to determine, the date or date range of the notification event; (4) the number of consumers affected; (5) a general description of the notification event; and, if applicable, whether any law enforcement official has provided the financial institution with a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security, and a means for the Federal Trade Commission to contact the law enforcement official. The notice must be provided electronically through a form located on the FTC’s website, https:// www.ftc.gov.

IV. Detailed Analysis The following section discusses the comments that the Commission received in response to the SNPRM. General Comments Several commenters generally supported the inclusion of a notification requirement in the Rule.16 Some of these commenters pointed to frequent data breaches as an indication that companies’ data security practices are inadequate and stated that requiring companies to provide notice to the Commission would enable the Commission to more easily enforce the Rule.17 The Clearing House argued that the requirement is appropriate because it would place financial institutions covered by the Rule in the same position as banks, which are required to report data breaches to their prudential regulators.18 The Electronic Privacy Information Center (‘‘EPIC’’) suggested that the amendment would incentivize ‘‘use of strong data security measures by financial institutions, bring additional accountability and transparency to the handling of security events, and enhance the data security and privacy of all consumers.’’ 19 Other commenters opposed the proposal.20 Many of these commenters argued that the proposed notification requirement would be duplicative of State breach notification laws and is, therefore, unnecessary.21 The Commission, however, disagrees that requiring financial institutions to provide notice to the Commission is redundant because of State breach notification laws. State breach notification laws provide notice to consumers and in some cases also to State regulators, while the notice requirement of the Final Rule requires notice to the Commission and is designed to ensure that the Commission receives notice of security breaches affecting financial institutions under the Commission’s jurisdiction. Notice to consumers or to State regulators does not achieve this purpose. Receipt of these notices will enable the Commission to monitor for emerging data security threats affecting financial institutions and to facilitate prompt investigative response to major security breaches. CTIA argued that the Commission could achieve this goal by accessing and reviewing regulated entities’ reports to consumers and State authorities under State notification laws.22 The Commission disagrees that this indirect method would be as efficient or effective as requiring regulated financial institutions to directly notify the Commission.23 Such an approach would be extremely burdensome on the Commission and would require the diversion of resources from enforcement to search for and collect information about breaches involving regulated financial institutions. Also, as some of the commenters noted,24 State laws vary in what types of incidents must be VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00006 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 243

77501 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 25 See, e.g., Tex. Bus. & Com. Code 521.053(i) (requiring companies to notify Texas Attorney General if a breach affects at least 250 Texas residents); Va. Code Ann. 18.2–186.6(E) (requiring companies to notify Virginia Attorney General if a breach affects at least 1,000 Virginia residents); Fla. Stat. 501.171(3) (requiring businesses to notify the Florida Department of Legal Affairs if a breach affects at least 500 individuals in Florida). 26 See, e.g., AFSA (Comment 12) at 1; CDIA (Comment 13) at 2–3; American Escrow Association (Comment 16) at 2; CTIA (Comment 20) at 3–6; NADA (Comment 21) at 2–3; U.S. Chamber of Commerce (Comment 22) at 2–3. 27 See EPIC (Comment 19) at 2, see also Anonymous (Comment 2); Briggs (Comment 4). 28 NADA argues that banking regulations are not relevant examples because they are designed ‘‘to protect depositors and to ensure the public interest in the safety and soundness of banks,’’ rather than to facilitate enforcement. NADA (Comment 21) at 4–5, n.8. The banking regulations, however, are also designed to facilitate enforcement. In addition, the Safeguards Rule is also designed to protect customers of financial institutions and ensure the public interest in the safety of consumer’s financial information.

29 NADA (Comment 21) at 4–5, n. 9. 30 See, e.g., Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, 70 FR 15736, 15752 (Mar. 29, 2005) (originally issued by the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of Thrift Supervision); 45 CFR 164.408 (requiring covered entities to report breaches affecting 500 or more individuals to the Secretary of Health and Human Services); 12 CFR 53.3 (requiring banking organizations to report security events to the Office of the Comptroller of the Currency); 12 CFR 225.302 (requiring Boardsupervised banking organization to report certain breaches to the Board); 12 CFR 304.23 (requiring certain bank organizations to report breaches to the FDIC); see also 87 FR 16590 (Mar. 23, 2022) (proposed rule requiring companies to report security incidents to the SEC). 31 See, e.g., Tex. Bus. & Com. Code 521.053(i) (requiring companies to notify Texas Attorney General if a breach affects at least 250 Texas residents); Va. Code Ann. 18.2–186.6(E) (requiring companies to notify Virginia Attorney General if a breach affects at least 1,000 Virginia residents); Fla. Stat. 501.171(3) (requiring businesses to notify the Florida Department of Legal Affairs if a breach affects at least 500 individuals in Florida). 32 NADA (Comment 21) at 3–5. 33 NADA (Comment 21) at 4. 34 See, e.g., FTC v. Equifax, 1:19–cv–03297–TWT (N.D. Ga., July 22, 2019), available at https:// www.ftc.gov/legal-library/browse/casesproceedings/172-3203-equifax-inc. 35 AFSA (Comment 12) at 1. reported and to whom.25 The Safeguards Rule notice requirement will establish a uniform reporting requirement for all regulated financial institutions, assisting the Commission in getting consistent information about notification events affecting those financial institutions regardless of which State’s consumers are affected. This benefit is not offset by the cost to financial institutions because the burden on individual financial institutions is minimal, as the Final Rule does not require an extensive report and, in many instances, financial institutions will already be preparing notices to consumers and State agencies. Some commenters argued that the notification requirement would not improve financial institutions’ data security.26 Other commenters disagreed with this assertion, arguing that the notification requirement would further incentivize financial institutions to protect customer information.27 The Commission agrees with these commenters that the notification requirement will increase the efficiency and effectiveness of the Commission’s enforcement of the Rule. As noted above, while State breach notification laws require notice to consumers, some States do not require that such notices be provided to State regulators as well, and not all State regulators that do receive such notices publish them. By requiring financial institutions to provide notice directly to the Commission, the Commission will not have to devote resources to continually search for breach notifications posted by other sources in order to know that a financial institution has experienced a breach. Without a notification, the Commission would have no guarantee that it has found all breaches in its searches. The required notices will enable the Commission to identify breaches that merit investigation more quickly and efficiently. Also, receiving notice of breaches will allow the Commission to develop better awareness of emerging risks to financial institutions’ security. The Commission expects that these benefits will enable more efficient enforcement of the Rule, which will in turn increase financial institutions’ incentive to comply. In addition, as discussed below, making the notices public will enable consumers to make more informed decisions about which financial institutions they choose to entrust with their information, providing financial institutions with an additional incentive to comply with the Rule.

The National Automobile Dealers Association (‘‘NADA’’) argued that a requirement for financial institutions to report events in order to facilitate enforcement against them is ‘‘unprecedented’’ 28 and ‘‘raises serious questions,’’ including ‘‘potential First Amendment and potentially even Fifth Amendment concerns.’’ 29 The Commission disagrees. Far from being unique, the requirement to report security events to law enforcement agencies that might result in enforcement actions against the notifying company is common. Many Federal agencies 30 require regulated entities to report data breaches to them, and most States require that companies report breaches to State attorneys general or other State law enforcement and have done so for years.31 NADA also argued that requiring reporting security events to assist the Commission to enforce the Safeguards Rule is inappropriate because not every breach is the result of a failure to comply with the Safeguards Rule.32 NADA suggested that the reporting requirement should only ‘‘apply after a series of security events,’’ because only multiple events can be ‘‘suggestive of compliance failures,’’ while any single breach ‘‘certainly . . . is not.’’ 33 While the Commission acknowledges that not every notification event is necessarily the result of a failure to comply with the Safeguards Rule, it disagrees that a single breach cannot be ‘‘suggestive of compliance failures.’’ 34 Indeed, the fact that an institution has not experienced a breach does not necessarily mean that the institution is in compliance with the Rule’s requirements. The Commission believes that taking action to correct a potential Safeguards Rule violation before additional security events can harm consumers is appropriate and desirable. The American Financial Services Association (‘‘AFSA’’) contended that ‘‘the FTC should clarify what factors in a report could lead to enforcement concerns,’’ arguing that otherwise ‘‘institutions may seek to minimize all risks associated with a report.’’ 35 The Commission does not believe that providing a guide to when a report could possibly lead to enforcement is either possible or desirable because the reports are unlikely to contain all of the information that the Commission would need to determine that law enforcement is appropriate or necessary. Such determinations are typically made following investigations that afford entities the opportunity to provide context and information.

In addition, the Commission notes that requiring a financial institution to report an event is not suggesting that every notification event is the result of a violation of the Rule and will result in an enforcement action or even investigation. Rather, the reporting requirement will provide the Commission with valuable information about security threats to financial institutions and assist in the determination of whether any individual event should be investigated further. This will improve the Commission’s ability to respond to data breaches and may enable the Commission to issue business and VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00007 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 244

77502 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 36 CDIA (Comment 13) at 2–3; SIFMA/BPI (Comment 15) at 8; ETA (Comment 17) at 2–3; CTIA (Comment 20) at 3–6; NADA (Comment 21) at 2– 3; U.S. Chamber of Commerce (Comment 22). 37 CDIA (Comment 13) at 2–3; CTIA (Comment 20) at 6; NADA (Comment 21) at 2–3. 38 American Escrow Association (Comment 16) at 2; ACE (Comment 18) at 2, 7–8; EPIC (Comment 19) at 6–7.

39 See, e.g., Ala. Code 8–38–5(d); Ariz. Rev. Stat. 18–552(E); Cal. Civ. Code 1798.82(d); Fla. Stat. 501.171(3)(b); Mich. Comp. Laws 445.72(6); Mo. Rev. Stat. 407.1500(2)(4); N.H. Rev. Stat. Ann. 359– C:20(IV); N.Y. U.C.C. Law 899–AA(7); and Or. Rev. Stat. 646A.604(5).

40 As discussed below, the Final Rule no longer requires the financial institution to determine whether misuse had occurred or was likely. 41 See, e.g., SIFMA/BPI (Comment 15) at 8–9; CTIA (Comment 20) at 11–12; NADA (Comment 21) at 2–3.

42 See CDIA (Comment 13) at 4–5; SIFMA/BPI (Comment 15) at 9–10; American Escrow Association (Comment 16) at 2–3; ETA (Comment 17) at 2; CTIA (Comment 20) at 11–14. 43 See, e.g., CDIA (Comment 13) at 4–5. 44 AFSA (Comment 12) at 2; CDIA (Comment 13) at 6; SIFMA/BPI (Comment 15) at 9; ACE (Comment 18); CTIA (Comment 20) at 12; NADA (Comment 21) at 3; U.S. Chamber of Commerce (Comment 22) at 4.

45 SIFMA/BPI (Comment 15) at 9; ETA (Comment 17) at 2; CTIA (Comment 20) at 11. 46 EPIC (Comment 19) at 4. 47 Id.

consumer education about emerging threats.

Other commenters argued that the reporting requirement would be unduly burdensome.36 Some of these commenters suggested that because the Rule’s requirement may differ from State notification laws’ requirements, complying with the Rule will be burdensome.37 Other commenters disagreed, noting that the information required is limited to basic information about the company and the notification event.38 The Commission agrees with these commenters. The information required to be reported is minimal and is very similar to the information required by many State notification laws.39 The company will have this information as the result of even a basic investigation of the security event, an investigation that would be required in any event to comply with the Rule and basic security practices. The fact that some State laws may be triggered under different circumstances and may require different information does not render this simple report burdensome. In addition to addressing the proposed amendment in general, commenters also addressed specific elements of the proposed amendments. These comments are addressed in the following detailed discussion. Triggering Event The Commission adopts proposed § 314.4(j) as originally proposed, with minor changes. Proposed paragraph (j) would have required financial institutions that become aware of a security event to promptly determine the likelihood that customer information has been or will be misused. Under the provision as originally proposed, financial institutions would have been required to make a report to the Commission upon determining that, among other conditions, ‘‘misuse of customer information ha[d] occurred or . . . [was] reasonably likely [to occur].’’ However, upon consideration of the comments, Commission is clarifying the triggering language by adding a new paragraph (m) in § 314.2, which defines the term ‘‘notification event’’ as the ‘‘acquisition of . . . [unencrypted customer] information without the authorization of the individual to which the information pertains.’’ Section 314.2(m) further clarifies that: (1) ‘‘[c]ustomer information is considered unencrypted . . . if the encryption key was accessed by an unauthorized person;’’ and (2) ‘‘[u]nauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.’’ Several commenters addressed whether becoming aware of a security event is an appropriate trigger for the notification process. In a joint comment, the Securities Industry and Financial Markets Association (‘‘SIFMA’’) and the Bank Policy Institute (‘‘BPI’’) argued that the notification process should not begin when a financial institution becomes aware of an event, but instead begin when the financial institution ‘‘determines’’ a security event has occurred. SIFMA and BPI suggested that ‘‘determination’’ takes place sometime after ‘‘discovery,’’ and that financial institutions should have 30 days to notify the Commission after making this determination rather than after discovery. SIFMA and BPI argued that ‘‘determination’’ ‘‘connotes a higher standard of certainty than ‘discovery,’ ’’ and would include determining whether any further requirements for notice, such as number of consumers affected, had been met. The Commission disagrees that 30 days after discovery of a notification event is insufficient time to determine whether the event meets the requirements for notification and to prepare the notice. The Commission expects that companies will be able to decide quickly whether a notification event has occurred by determining whether unencrypted customer information has been acquired and, if so, how many consumers are affected, so there will not be a significant difference between ‘‘determination’’ and ‘‘discovery.’’ 40 In addition, the notification to the Commission requires minimal details and will not take significant time to prepare and, as discussed above, many States require reports containing similar information, so the financial institutions will need to prepare such a report in any event. Other commenters argued the term ‘‘security event’’ is too broad a term to act as a trigger for the notification process, stating that the term encompasses types of incidents that pose little risk of consumer harm and for which notification is unnecessary.41 Some commenters felt notification should be required only when harm to consumers has occurred or is likely to occur, rather than when ‘‘misuse’’ has occurred or is reasonably likely.42 Some commenters argued a trigger that requires consumer harm would be more in accord with State notification laws.43 Similarly, several commenters argued the notification requirement should exclude security events that involve only encrypted customer information, because there is little chance of consumer harm in such cases.44 Others argued requiring financial institutions to report breaches that do not involve possible harm to consumers would be unduly burdensome on financial institutions and would produce an overwhelming number of reports to the Commission.45 Conversely, EPIC argued notice should be required for all security events regardless of whether misuse had occurred or was likely.46 EPIC argued that removing the analysis of whether misuse was likely would lower the burden of determining whether a report should be made and would prevent attempts by financial institutions to avoid reporting to the Commission.47 The Commission agrees with EPIC that the trigger for notification requires clarification. The meaning of the term ‘‘misuse’’ in the proposed rule was ambiguous. It was not clear if acquisition of customer information alone constituted misuse, or if other forms of misuse, such as alteration of data, would fall within the notification requirement. Given this ambiguity, financial institutions would have had difficulty evaluating the likelihood of misuse of customer information that has been acquired without authorization. At the same time, the ambiguity could have VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00008 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 245

77503 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 48 See also 74 FR 42962, 42966 (Aug. 25, 2009). Examples of this rebuttable presumption cited in that rulemaking, and equally relevant here, included a circumstance where ‘‘an unauthorized employee inadvertently accesses an individual’s PHR and logs off without reading, using, or disclosing anything. If the unauthorized employee read the data and/or shared it, however, he or she ‘acquired’ the information, thus triggering the notification obligation in the rule.’’ Another example related to a lost laptop: ‘‘If an entity’s employee loses a laptop in a public place, the information would be accessible to unauthorized persons, giving rise to a presumption that unauthorized acquisition has occurred. The entity can rebut this presumption by showing, for example, that the laptop was recovered, and that forensic analysis revealed that files were never opened, altered, transferred, or otherwise compromised.’’ Id. at 42966. 49 Id.

50 See, e.g., Ala. Code 8–38–2(6)(b)(2); Alaska Stat. 45.48.090(7); Colo. Rev. Stat. 6–1–716 (2)(a.4); 815 Ill. Comp. Stat. 530/5 (‘‘Personal Information’’ definition); NY Gen. Bus. Law 899–aa(b); Tex. Bus. & Com. Code 521.053(a). 51 AFSA (Comment 12) at 2; CDIA (Comment 13) at 5–6; ETA (Comment 17) at 2; CTIA (Comment 20) at 11–12.

52 AFSA (Comment 12) at 2; CDIA (Comment 13) at 5–6; ETA (Comment 17) at 2; CTIA (Comment 20) at 11–12.

53 16 CFR 314.2(d).

54 16 CFR 314.2(l).

55 CTIA (Comment 20) at 9–10; NADA (Comment 21) at 7.

56 Clearing House (Comment 11) at 9; ACE (Comment 18) at 7; EPIC (Comment 19) at 6–7. been used as an opportunity to circumvent the reporting requirement. Specifically, because the proposed rule required the financial institution to assess the likelihood of misuse, it would have allowed financial institutions to underestimate the likelihood of misuse, and, thereby, the need to report the security event.

Accordingly, the Final Rule requires notification where customer information has been acquired, rather than when misuse is considered likely. Specifically, the Commission is adding a new § 314.2(m) that defines the term ‘‘[n]otification event’’ to mean the acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Section 314.2(m) also provides that unauthorized access of information will be presumed to result in unauthorized acquisition unless the financial institution can show that there has not been, or could not reasonably have been, unauthorized acquisition of such information. This rebuttable presumption is consistent with the Health Breach Notification Rule. See 16 CFR 318.2(a) (‘‘Unauthorized acquisition will be presumed to include unauthorized access to unsecured PHR [personal health record] identifiable health information unless the vendor of personal health records, PHR related entity, or third party service provider that experienced the breach has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.’’).48 Here, too, the presumption is ‘‘intended to address the difficulty of determining whether access to data (i.e., the opportunity to view the data) did or did not lead to acquisition (i.e., the actual viewing or reading of the data).’’ 49 The Commission also agrees notification should not be required when harm to consumers is rendered extremely unlikely because the customer information is encrypted. Accordingly, the Final Rule does not require notification if the customer information acquired is encrypted, so long as the encryption key was not accessed by an unauthorized person. See § 314.2(m). By requiring notice relating to unauthorized acquisition only of unencrypted customer information, this change brings the Rule into accord with most State breach notification laws. If customer information was encrypted but the encryption key was also accessed without authorization, then the customer information will be considered to be unencrypted. Someone who has both the encrypted information and the encryption key can easily decrypt the information.50 In summary, the Final Rule requires notification if the financial institution discovers that unencrypted customer information has been acquired without authorization. See § 314.2(m). Unlike under the proposed rule, notification is not conditioned on the assessment of likelihood of misuse. The Commission believes that determining whether acquisition has occurred simplifies the requirement and will enable financial institutions to more speedily determine whether a notification event has occurred. In addition, the Commission believes this change will reduce the number of notifications by excluding events where encrypted information was acquired, while ensuring it receives notice of events that are more likely to result in harm. As noted earlier, the Rule also includes a rebuttable presumption stating that when there is unauthorized access to data, unauthorized acquisition will be presumed unless the entity that experienced the breach ‘‘has reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.’’ See § 314.2(m). Some commenters argued the notification requirement should trigger only when especially ‘‘sensitive’’ information is involved.51 These commenters argue that requiring notification when any kind of customer information is involved would result in notifications when there is no risk of harm to consumers.52 The Commission disagrees with this contention. The definition of ‘‘customer information’’ in the Rule does not encompass all information that a financial institution has about consumers. ‘‘Customer information’’ is defined as records containing ‘‘non-public personal information’’ about a customer.53 ‘‘Nonpublic personal information’’ is, in turn, defined as ‘‘personally identifiable financial information,’’ and excludes information that is publicly available or not ‘‘personally identifiable.’’ 54 The Commission believes security events that trigger the notification requirement—where customers’ nonpublic personally identifiable, unencrypted financial information has been acquired without authorization— are serious and support the need for Commission notification. In the SNPRM, the Commission asked whether, rather than having a standalone reporting requirement, the Rule should require reporting only when another State or Federal statute, rule, or regulation requires a financial institution to provide notice of a security event or similar event to a governmental entity. Some commenters supported this suggestion, arguing that such a requirement would reduce duplicative notice and consumer confusion.55 Other commenters opposed it, arguing that because of the varied nature of State notification laws, this would produce inconsistent reporting to the Commission.56 The Commission agrees that a stand-alone requirement will help ensure the Commission receives consistent information regarding security events. Determination of Scope of Security Event After a financial institution becomes aware of a security event, the proposed rule would have required it to determine whether at least 1,000 consumers have been affected or reasonably may be affected and, if so, to notify the Commission.

A number of commenters expressed views pertaining to the minimum threshold for the number of affected customers. Some commenters agreed that notification of security events should not be required if the number of consumers that could be affected fell below the proposed threshold (1,000 VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00009 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 246

77504 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 57 CDIA (Comment 13) (suggesting a requirement of notification when a security event affects at least 1,000 consumers and may cause substantial harm); American Escrow Association (Comment 16) at 2 (supporting 1,000 consumer requirement while suggesting other changes to the notice requirement); ACE (Comment 17) at 2 (stating that requiring notice when 1,000 consumers are affected would be appropriate, if notices were required only when there was a risk of substantial harm); EPIC (Comment 19) at 4 (suggesting that notice be required whenever an event involves the information of at least 1,000 consumers regardless of the likelihood of misuse). 58 Clearing House (Comment 11) at 4–5 (suggesting a requirement for notice for any security event involving sensitive customer information, regardless of the number of consumers potentially affected by the event).

59 AFSA (Comment 12) at 2; see also Anonymous (Comment 2) (arguing that threshold should be proportional to the size of the financial information).

60 Id.

61 Clearing House (Comment 11) at 5. While the Rule requires direct notice of breaches only to the Commission, consumers affected by smaller breaches could learn of those breaches when the Commission makes the notices public. Also, the Rule does not limit State consumer notification laws that require direct notification of consumers. 62 45 CFR 164.400 through 164.414. 63 See, e.g., CDIA (Comment 13) at 7; ACE (Comment 18) at 8; U.S. Chamber of Commerce (Comment 22) at 4.

64 Anonymous (Comment 2) (suggesting a twoweek deadline); Clearing House (Comment 11) at 6 (recommending a 36-hour deadline). 65 See SIFMA/BPI (Comment 15) at 8 (arguing that 30 days should not begin until financial information has determined that security event meets notification requirements); CTIA (Comment 20) at 14 (same).

66 See SIFMA/BPI (Comment 15) at 10; ACE (Comment 18) at 4–5; CTIA (Comment 20) at 15; U.S. Chamber of Commerce (Comment 22) at 5. 67 EPIC (Comment 19) at 5–6. 68 See Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, 88 FR 51896, 51898 (Aug. 8, 2023) (allowing delay of required disclosure of material cybersecurity incidents if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing); Office of the Comptroller of the Currency, Federal Reserve System, Federal Deposit Insurance Corporation, Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers, 86 FR 66424 (Nov. 23, 2021) (adopting regulations that require banking organizations to notify their primary Federal Regulator of any ‘‘computer security incident’’ that rises to the level of a ‘‘notification incident,’’ as soon as possible and no longer than 36 hours after the banking organization determines that a notification incident has occurred).

consumers).57 The Clearing House, however, suggested that notification should be required in all cases, regardless of the number of consumers potentially affected.58 AFSA suggested there should be a higher threshold of affected consumers before notice is required.59 AFSA argued that the thousand consumer threshold was too low because of ‘‘the large number of financial institutions with many more customers.’’ 60 The Commission disagrees that the fact that some financial institutions hold the information of millions of consumers suggests a higher threshold is appropriate. The Clearing House, conversely, argues the Rule should require that the Commission receive notice whenever any consumer is affected, because otherwise consumers whose information was involved in smaller breaches would have no notice of the breach and would be ‘‘without the benefit of important notices’’ if financial institutions were not required to report breaches affecting fewer consumers.61 The Commission does not agree that setting a minimum threshold of consumers affected before requiring notification would leave consumers involved in smaller breaches without notice, as consumers will typically receive direct notification under State breach notification laws, regardless of whether notice to the Commission is required. In determining the proper threshold, the Commission notes that numerous State laws require notification of breaches either with no minimum threshold, or with a threshold of 250 or 500 people. The Commission’s own Health Breach Notification Rule, and the Health Insurance Portability and Accountability Act (HIPAA) Breach Notification Rule,62 also require notification of breaches involving 500 or more people. The Commission concludes that a lower threshold than in the proposed rule is appropriate. Accordingly, the Commission is adopting a minimum threshold of 500 consumers, rather than the minimum threshold of 1,000 consumers that was in proposed § 314.4(j). The Commission believes a security event that involves the acquisition of unencrypted customer information involving at least 500 consumers is significant enough to warrant notification of the Commission, regardless of the size of the financial institution.

Time To Report The proposed Rule would have required Commission notification within 30 days from discovery of the notification event. Some commenters that addressed this deadline agreed that this would provide financial institutions sufficient time to make the required determinations and to notify the Commission.63 Other commenters argued that financial institutions should be given significantly less time to notify the Commission.64 Other commenters argued that financial institutions should be given more time to notify the Commission.65 The Commission believes that a 30-day deadline properly balances the need for prompt notification with the need to allow financial institutions to investigate a security event, determine whether the information was acquired without authorization and how many consumers were affected, and learn enough about the event to make the notification to the Commission meaningful. Accordingly, finalized § 314.2(j)(1) retains the 30-day deadline from the SNPRM.

Some commenters argued that financial institutions should be permitted to delay or withhold notification of a security event to the Commission at the request of a lawenforcement agency or if notification would interfere with a law enforcement investigation.66 Alternatively, EPIC suggested the Commission should not allow companies to delay reporting in cases of a law enforcement investigation, but should instead delay publication of the notice in cases where publication would interfere with an investigation.67 The Commission agrees that, while notifications to the Commission should not be made public if law enforcement has requested a delay, there is no reason to delay notice to the Commission itself on that basis. This conclusion is consistent with the approach taken by the Securities and Exchange Commission and by other Federal financial regulators in rulemakings that require notice of cyber incidents to a regulator, as opposed to notice directly to consumers.68 Accordingly, § 314.4(j)(1)(vi) of the Final Rule provides that a financial institution’s notice must (1) indicate whether any law enforcement official has provided the institution with a written determination that public disclosure of the breach would impede a criminal investigation or cause damage to national security, and (2) provide a means for the Commission to contact the law enforcement official. In order that notice to the public is not delayed indefinitely, the provision also provides that a law enforcement official may request an initial delay of up to 30 days following the date when the disclosure is filed with the Commission. The delay may be extended for an additional period of up to 60 days if the law enforcement official seeks such an extension in writing. Additional delay may be permitted only if the Commission staff determines that public disclosure of a notification event continues to impede a criminal VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00010 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 247

77505 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 69 SIFMA/BPI argued that financial institutions should be allowed to notify the Commission by phone because that ‘‘could foster confidentiality.’’ SIFMA/BPI (Comment 15) at 7. Similarly, the U.S. Chamber of Commerce suggested that financial institutions should be allowed to notify the Commission by alternative means, such as mail, ‘‘where covered entities may lack access to the internet.’’ U.S. Chamber of Commerce (Comment 22) at 4. The Commission believes that notification should be limited to the form on the Commission’s website, as this will ensure that all notifications are received and recorded in the same way. The Commission believes that it is not likely that a financial institution that has suffered a notification event will not be able to access the internet for the entirety of the 30-day reporting window. 70 See AFSA (Comment 12) at 2; ACE (Comment 18) at 2; U.S. Chamber of Commerce (Comment 22) at 4.

71 NADA (Comment 21) at 6. 72 EPIC (Comment 19) at 3. 73 Id.

74 As noted above, if applicable, financial institutions would also inform the Commission whether any law enforcement official has provided a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security, and a means for the FTC to contact the law enforcement official. 75 Briggs (Comment 4); Clearing House (Comment 11) at 10; EPIC (Comment 19) at 5–6. 76 AFSA (Comment 12) at 2–3; CDIA (Comment 13) at 7; SIFMA/BPI (Comment 15) at 5–7; ACE (Comment 18) at 5–7; CTIA (Comment 20) at 15– 16; NADA (Comment 21) at 5–6; U.S. Chamber of Commerce (Comment 22) at 5. 77 SIFMA/BPI (Comment 15) at 7; ACE (Comment 18) at 5–7; CTIA (Comment 20) at 15–16; NADA (Comment 21) at 6.

78 NADA (Comment 21) at 6. 79 AFSA (Comment 12) at 2–3; NADA (Comment 21) at 5.

80 CDIA (Comment 13) at 7; see also SIFMA/BPI (Comment 15) at 6 (suggesting that publication of the reports could cause confusion for consumers and investors); ACE (Comment 18) at 5–7. 81 CTIA (Comment 20) at 16. 82 SIFMA/BPI (Comment 15) at 6. investigation or cause damage to national security.

The proposed § 314.4(j) did not address when a security event should be treated as discovered. The Commission believes adding such a provision will clarify the rule and prevent confusion. Accordingly, under the Final Rule, a notification event shall be treated as discovered as of the first day on which such event is known. Financial institutions will be deemed to have knowledge of a notification event if the event is known to any person, other than the person committing the breach, who is the financial institution’s employee, officer, or other agent. Therefore, in instances where an employee, officer, or other agent of the financial institution accesses customer information without authorization, a financial institution will be deemed to have knowledge of a notification event if the event is known to another employee, officer, or other agent of the financial institution.

Contents of Notice The proposed Rule required that a notice be made electronically on a form on the FTC’s website,69 and that such notice must include the following information: (1) the name and contact information of the reporting financial institution; (2) a description of the types of information that were involved in the notification event; (3) if the information is possible to determine, the date or date range of the notification event; and (4) a general description of the notification event.

Several commenters supported these elements as an appropriate level of detail.70 However, NADA was opposed to the requirement that the report include a description of the security event,71 while EPIC suggested the Rule should require a more detailed description of the security event.72 EPIC argued that financial institutions should also be required to provide a comprehensive description of the types of information involved in the security event and a comprehensive description of the security event, because ‘‘it is critical that financial institutions provide a sufficiently detailed account of each security event to enable the FTC and affected consumers to assess whether and how personal information is at risk.’’ 73 The Commission believes that, with the exception noted below, the proposed elements generally provide sufficient information to the Commission and the public without imposing undue burdens on reporting financial institutions. If the Commission determines more information is needed, it will obtain that information from the financial institution. The Commission believes, however, that knowing the number of consumers affected or potentially affected by the notification event would allow it to better evaluate the impact of a particular event. Providing this information, which financial institutions will typically determine in the course of responding to a breach, will not significantly add to the burden to financial institutions. Accordingly, the Final Rule retains the proposed elements, while adding a requirement to provide the number of consumers affected or potentially affected by the notification event.74 Publication of Notices The SNPRM requested public comment on whether submitted reports should be made public. Several commenters argued that making the reports public would benefit consumers by helping them to make informed decisions about which financial institutions to entrust with their financial information or to determine whether they might have been affected by a security event.75 Other commenters argued the reports should be confidential and not shared with the public.76 Some commenters argued that making the reports public could encourage further cybersecurity attacks on affected financial institutions by making potential attackers aware of vulnerabilities that have not been remedied by the time the notice is made public.77 NADA argued that the description of the event in particular should not be made public, suggesting the description provided no benefit to consumers and would not improve data security.78 The Commission disagrees that making the reports public will increase risk to financial institutions’ data security. As discussed above, most financial institutions are already subject to State breach notification laws, many of which require notification to a State agency that then makes the notification public. In addition, the general nature of the information required to be included in the report is unlikely to provide potential attackers any advantage in comprising the financial institution’s security.

Other commenters argued that publication of the notices could create undue media coverage and that the information would be too general to assist consumers in making informed decisions.79 Similarly, CDIA argued that because State law requires direct consumer notification to those affected by the breach, making the information public to all consumers would cause ‘‘consumer confusion and angst about whether the consumer’s information has been compromised.’’ 80 CTIA also argued that financial institutions that have suffered a security event should not be subject to the punishment of ‘‘name and shame.’’ 81 SIFMA and BPI suggested that making the reports public would limit the information financial institutions are willing to share in the reports in order to avoid public revelation of the details of the breach.82 As discussed above, the Commission acknowledges not all security events at financial institutions are the result of a failure to comply with the Safeguards Rule. Nevertheless, the Commission believes providing more information to consumers about these events will both benefit consumers and incentivize companies to better protect that information. The Commission is not persuaded that attention given to breaches is ‘‘undue’’ or otherwise inappropriate, as suggested by some commenters. Apart from providing VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00011 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 248

77506 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 83 Clearing House (Comment 11) at 8–9; EPIC (Comment 19); see also Anonymous (Comment 14) (stating that if there is a data breach, consumers ‘‘need to know what happened to their information.’’ 84 See AFSA (Comment 12) at 3; CDIA (Comment 13) at 8; SIFMA/BPI (Comment 15) at 10; CTIA (Comment 20) at 16–17; NADA (Comment 21) at 7; see also American Council on Education (Comment 18) at 8 (stating that the Commission should engage with covered financial institutions about existing notification requirements before establishing a consumer notification requirement). 85 44 U.S.C. 3502(3)(A)(i). 86 According to the Identity Theft Resource Center, 108 entities in the ‘‘Banking/Credit/ Financial’’ category suffered data breaches in 2019, which affected more than 100 million consumers. 2019 End-of-Year Data Breach Report, Identity Theft Resource Center at 2, available at https://www.idthe ftcenter.org/wp-content/uploads/2020/01/ 01.28.2020_ITRC_2019-End-of-Year-Data-Breach- Report_FINAL_Highres-Appendix.pdf. On average, each breach would have involved more than 930,000 consumers, far over both the 500 and the 1,000 consumer thresholds. 87 According to the Identity Theft Resource Center, 108 entities in the ‘‘Banking/Credit/ Financial’’ category suffered data breaches in 2019. 2019 End-of-Year Data Breach Report, Identity Theft Resource Center at 2, available at https:// www.idtheftcenter.org/wp-content/uploads/2020/ 01/01.28.2020_ITRC_2019-End-of-Year-Data- Breach-Report_FINAL_Highres-Appendix.pdf. Although this number may exclude some entities that are covered by the Safeguards Rule but are not contained in the ‘‘Banking/Credit/Financial’’ category, not every security event will trigger the reporting obligations (e.g., breaches affecting less than 500 people). Therefore, Commission staff estimated in the SNPRM that 110 institutions would have reportable events. Because of the change in the reporting threshold the Commission expects an additional 5 entities to have reporting obligations.

88 See, e.g., Cal. Civil Code 1798.82; Tex. Bus. & Com. Code 521.053; Fla. Stat. 501.171. 89 This figure is derived from the mean hourly wage for Information security analysts. See actionable information for individuals who are directly affected, reporting provides a broader value to the general public to consider proactive measures, such as implementing a credit freeze, prioritizing methods to secure their own data, and determining where to do business. The Commission does not believe a confidential reporting system is needed in order to incentivize more comprehensive reporting by financial institutions. The general level of detail required to be reported under § 314.4(j)(1) will not compromise a financial institution’s security posture going forward—the report requires only the most general information and cannot provide a meaningful roadmap for attackers. Accordingly, the Commission intends to enter notification event reports into a publicly available database.

The SNPRM also asked for comment on whether the Commission should require financial institutions that suffer a security event to directly notify affected consumers, as well as the Commission. Some commenters were in favor of requiring consumer notification, at least when notification of the Commission was required.83 Most commenters who addressed the issue, however, opposed such a requirement, pointing to the existing regime of State consumer notification laws and arguing that a separate FTC notification requirement would be duplicative and unduly burdensome.84 The Commission agrees that, because all States have some form of consumer notification requirement, a direct consumer notification requirement in the Safeguards Rule would be largely duplicative of those State laws. Therefore, the Commission has not included such a requirement in the Final Rule.

Finally, the Commission is revising § 314.4(c) to correct a typographical error. As originally promulgated, that section required a financial institution to ‘‘[d]esign and implement safeguards to control the risks you identity through risk assessment. . . .’’ Actually, a financial institution must ‘‘[d]esign and implement safeguards to control the risks you identify through risk assessment. . . .’’ In the Final Rule, this error is corrected. Section 314.5: Effective Date The proposed rule revised § 314.5 so that the reporting requirement in § 314.4(j) would not go into effect until six months after the publication of a final rule. As proposed, finalized § 314.5 provides that § 314.4(j) will become effective on May 13, 2024. V. Paperwork Reduction Act The Paperwork Reduction Act (‘‘PRA’’), 44 U.S.C. 3501 et seq., requires Federal agencies to obtain Office of Management and Budget (‘‘OMB’’) approval before undertaking a collection of information directed to ten or more persons. Pursuant to the regulations implementing the PRA (5 CFR 1320.8(b)(3)(vi)), an agency may not collect or sponsor the collection of information, nor may it impose an information collection requirement, unless it displays a currently valid OMB control number.

The amendment requiring financial institutions to report certain security events to the Commission discussed above constitutes a ‘‘collection of information’’ for purposes of the PRA.85 As required by the PRA, the FTC submitted the proposed information collection requirement to OMB for its review at the time of the publication of the SNPRM. OMB directed the Commission to resubmit the requirement at the time the Final Rule is published. Accordingly, FTC staff has estimated the information collection burden for this requirement as set forth below.

The amendment will affect only those financial institutions that suffer a security event in which unencrypted customer information affecting at least 500 consumers is acquired without authorization. Although the SNPRM proposed a 1,000-consumer cut-off for notification, the Commission believes that the reducing the reporting threshold by 500 consumers will likely make only a small difference in the number of breaches reported.86 Assuming that reducing the reporting threshold by 500 individuals will lead an additional 5% of financial institutions to report—a generous estimate—FTC staff estimates the reporting requirement will affect approximately 115 financial institutions each year.87 FTC staff anticipates the burden associated with the reporting requirement will consist of the time necessary to compile the requested information and report it via the electronic form located on the Commission’s website. FTC staff estimates this will require approximately five hours for affected financial institutions, for a total annual burden of approximately 575 hours (115 responses × 5 hours).

The Commission does not believe the reporting requirement would impose any new investigative costs on financial institutions. The information about notification events required by the reporting requirement is information the Commission believes financial institutions would acquire in the normal course of responding to a notification event. In addition, in many cases, the information requested by the reporting requirement is similar to information entities are required to disclose under various States’ data breach notification laws.88 As a result, FTC staff estimates the additional costs imposed by the reporting requirement will be limited to the administrative costs of compiling the requested information and reporting it to the Commission on an electronic form located on the Commission’s website.

FTC staff derives the associated labor cost by calculating the hourly wages necessary to prepare the required reports. FTC staff anticipates that required information will be compiled by information security analysts in the course of assessing and responding to a notification event, resulting in 3 hours of labor at a mean hourly wage of $57.63 (3 hours × $57.63 = $172.89).89 FTC staff VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00012 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 249

77507 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations ‘‘Occupational Employment and Wages—May 2022,’’ Bureau of Labor Statistics, U.S. Department of Labor (April 5, 2023), Table 1 (‘‘National employment and wage data from the Occupational Employment Statistics survey by occupation, May 2023’’), available at https://www.bls.gov/ news.release/pdf/ocwage.pdf. 90 This figure is derived from the mean hourly wage for Lawyers. See ‘‘Occupational Employment and Wages—May 2019,’’ Bureau of Labor Statistics, U.S. Department of Labor (March 31, 2020), Table 1 (‘‘National employment and wage data from the Occupational Employment Statistics survey by occupation, May 2019’’), available at https:// www.bls.gov/news.release/pdf/ocwage.pdf. 91 CDIA (Comment 13) at 2–3; SIFMA/BPI (Comment 15) at 8; ETA (Comment 17) at 2–3; CTIA (Comment 20) at 3–6; NADA (Comment 21) at 2– 3; U.S. Chamber of Commerce (Comment 22). 92 American Escrow Association (Comment 16) at 2; ACE (Comment 18) at 2, 7–8; EPIC (Comment 19) at 6–7.

93 5 U.S.C. 601–612.

94 5 U.S.C. 603–605.

95 CDIA (Comment 13) at 2–3; SIFMA/BPI (Comment 15) at 8; ETA (Comment 17) at 2–3; CTIA (Comment 20) at 3–6; NADA (Comment 21) at 2– 3; U.S. Chamber of Commerce (Comment 22). 96 American Escrow Association (Comment 16) at 2; ACE (Comment 18) at 2, 7–8; EPIC (Comment 19) at 6–7.

97 American Escrow Association (Comment 16) at 2 (stating that the reporting requirement ‘‘does not appear to be onerous as a reporting matter and we also agree with the FTC’s conclusion that there would not be a significant impact on small business’’).

98 The U.S. Small Business Administration Table of Small Business Size Standards Matched to North American Industry Classification System Codes (‘‘NAICS’’) are generally expressed in either millions of dollars or number of employees. A size standard is the largest that a business can be and still qualify as a small business for Federal Government programs. For the most part, size standards are the annual receipts or the average employment of a firm. Depending on the nature of the financial services an institution provides, the size standard varies. By way of example, mortgage and nonmortgage loan brokers (NAICS code 522310) are classified as small if their annual receipts are $15 million or less. Consumer lending institutions (NAICS code 52291) are classified as small if their annual receipts are $47 million or less. Commercial banking and savings institutions (NAICS codes 522110 and 522120) are classified as small if their assets are $850 million or less. Assets are determined by averaging the assets reported on businesses’ four quarterly financial statements for the preceding year. The 2023 Table of Small Business Size Standards is available at https:// www.sba.gov/document/support--table-sizestandards.

also anticipates that affected financial institutions may use attorneys to formulate and submit the required report, resulting in 2 hours of labor at a mean hourly wage of $78.74 (2 hours × $78.74 = $157.48).90 Accordingly, FTC staff estimates the approximate labor cost to be $330 per report (rounded to the nearest dollar). This yields a total annual cost burden of $37,950 (115 annual responses × $330). The Commission is providing an online reporting form on the Commission’s website to facilitate reporting of qualifying notification events. As a result, the Commission does not anticipate covered financial institutions will incur any new capital or non-labor costs in complying with the reporting requirement. Pursuant to Section 3506(c)(2)(A) of the PRA, the FTC invited comments on: (1) whether the disclosure requirements are necessary, including whether the information will be practically useful; (2) the accuracy of our burden estimates, including whether the methodology and assumptions used are valid; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of providing the required information to the Commission. Although the Commission received several comments that argued that the required notifications would be burdensome for businesses, none addressed the accuracy of the Commission’s burden estimate.91 Other commenters argued that the reporting requirement would create little burden.92 For the reasons discussed above, the Commission agrees with these commenters and does not believe that reporting requirement will create a significant burden for businesses.

VI. Regulatory Flexibility Act The Regulatory Flexibility Act (‘‘RFA’’) 93 requires that the Commission provide an Initial Regulatory Flexibility Analysis (‘‘IRFA’’) with a proposed rule, and a Final Regulatory Flexibility Analysis (‘‘FRFA’’) with the final rule, unless the Commission certifies that the Rule will not have a significant economic impact on a substantial number of small entities.94 As discussed in the IRFA, the Commission does not believe this amendment to the Safeguards Rule has the threshold impact on small entities. The reporting requirement will apply to financial institutions that, in most cases, already have an obligation to disclose similar information under certain Federal and State laws and regulations and will not require additional investigation or preparation.

In this document, the Commission adopts the amendments proposed in its SNPRM with only minimal modifications. In its IRFA, the Commission determined that the proposed rule would not have a significant impact on small entities because of the minimal information being requested. Although the Commission certifies under the RFA that the rule will not have a significant impact on a substantial number of small entities, and hereby provides notice of that certification to the Small Business Administration, the Commission nonetheless has determined that publishing a FRFA is appropriate to ensure that the impact of the rule is fully addressed. Therefore, the Commission has prepared the following analysis:

1. Need for and Objectives of the Final Rule The need for and the objective of the Final Rule is to ensure the Commission is aware of notification events that could suggest a financial institution’s security program does not comply with the Rule’s requirements, thus facilitating Commission enforcement of the Rule. To the extent the reported information is made public, the information will also assist consumers by providing information as to notification events experienced by various financial institutions.

2. Significant Issues Raised in Public Comments in Response to the IRFA Although the Commission received several comments that argued that the required notifications would be burdensome for businesses,95 none argued specifically that smaller businesses in particular would be subject to special burden. Other commenters argued that the reporting requirement would create little burden.96 One commenter specifically argued that the requirement would not create significant burden for small businesses.97 As discussed above, the Commission does not anticipate that covered financial institutions will incur any new capital or non-labor costs in complying with the reporting requirement. Additionally, the average annual labor costs per covered financial institution are de minimis because most entities, including small entities, will only infrequently be required to file a report. Thus, the Commission does not believe that the reporting requirement will create a significant burden for financial institutions in general, including small businesses. The Commission did not receive any comments filed by the Chief Counsel for Advocacy of the Small Business Administration (‘‘SBA’’). 3. Description and an Estimate of the Number of Small Entities to Which the Final Rule Will Apply, or Explanation Why No Estimate Is Available As explained in the IRFA, determining a precise estimate of the number of small entities 98 that would VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00013 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 250

77508 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations 99 See, e.g., 2023 Verizon Data Breach Investigations Report at 65, available at https:// www.verizon.com/business/resources/reports/dbir/ (reporting cybersecurity incidents and confirmed data disclosures for companies with fewer than or more than 1000 employees). have to report a notification event in a given year is not readily feasible. No commenters addressed this issue. Both small entities and larger ones experience security incidents involving disclosure of consumer information.99 However, other factors complicate the analysis. There are no estimates available reflecting the percentage of financial institutions under the Commission’s jurisdiction that would be considered small entities, and small entities may be more likely to experience notification events that fall below the notification threshold, for example. Such factors are not reflected in industry and economic sector data, and, therefore, it is not possible to estimate the number of small entities covered by the Rule from such data. Projecting from entities’ past experiences of actual breaches, however, as discussed in the section discussing the PRA, FTC staff estimates the Rule’s reporting requirement would affect approximately 115 entities per year in the future. Accordingly, even if every financial institution required to report in a given year were a small entity, the reporting requirement would affect only approximately 115 such entities. Regardless, as discussed above, these amendments will not add any significant additional burdens on any covered small businesses. 4. Projected Reporting, Recordkeeping, and Other Compliance Requirements The notification requirement imposes reporting requirements. As outlined above, the amendment will affect only those financial institutions that suffer a notification event in which unencrypted customer information affecting at least 500 consumers is acquired without authorization. If such an event occurs, the affected financial institution may expend costs to provide the Commission with the information required by the reporting requirement. As noted in the PRA analysis above, the total estimated annual cost burden for all entities subject to the reporting requirement will be approximately $37,950. 5. Description of Steps Taken To Minimize Significant Economic Impact, If Any, on Small Entities, Including Alternatives The Commission did not propose any specific small entity exemption or other significant alternatives because the burden imposed upon small businesses is minimal. In drafting the reporting requirement, the Commission has made every effort to avoid unduly burdensome requirements for entities. The reporting requirement only mandates that affected financial institutions provide the Commission with information necessary to assist it in its regulatory and enforcement efforts. The rule minimizes burden on all covered financial institutions, including small businesses, by providing for reporting through an online form on the Commission’s website. In addition, the rule requires that only notification events involving at least 500 consumers must be reported, which will reduce potential burden on small businesses that retain information on fewer consumers. Therefore, the Commission does not believe that any alternatives for small entities are required or appropriate.

VII. Other Matters Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as not a ‘‘major rule,’’ as defined by 5 U.S.C. 804(2). List of Subjects in 16 CFR Part 314 Consumer protection, Computer technology, Credit, Privacy, Trade practices.

For the reasons stated above, the Federal Trade Commission amends 16 CFR part 314 as follows: PART 314—STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION ■1. The authority citation for part 314 continues to read as follows: Authority: 15 U.S.C. 6801(b), 6805(b)(2). ■2. In § 314.2:

■a. Redesignate paragraphs (m) through (r) as paragraphs (n) through (s), respectively; and ■b. Add a new paragraph (m). The addition reads as follows: § 314.2 Definitions.

* * * * * (m) Notification event means acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Customer information is considered unencrypted for this purpose if the encryption key was accessed by an unauthorized person. Unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.

* * * * * ■3. In § 314.4, revise the introductory text of paragraph (c) and add paragraph (j) to read as follows: § 314.4 Elements.

* * * * * (c) Design and implement safeguards to control the risks you identify through risk assessment, including by: * * * * * (j) Notify the Federal Trade Commission about notification events in accordance with paragraphs (j)(1) and (2) of this section.

(1) Notification requirement. Upon discovery of a notification event as described in paragraph (j)(2) of this section, if the notification event involves the information of at least 500 consumers, you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event. The notice shall be made electronically on a form to be located on the FTC’s website, https://www.ftc.gov. The notice shall include the following: (i) The name and contact information of the reporting financial institution; (ii) A description of the types of information that were involved in the notification event;

(iii) If the information is possible to determine, the date or date range of the notification event;

(iv) The number of consumers affected or potentially affected by the notification event;

(v) A general description of the notification event; and (vi) Whether any law enforcement official has provided you with a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security, and a means for the Federal Trade Commission to contact the law enforcement official. A law enforcement official may request an initial delay of up to 30 days following the date when notice was provided to the Federal Trade Commission. The delay may be extended for an additional period of up to 60 days if the law enforcement official seeks such an extension in writing. Additional delay may be permitted only if the Commission staff determines that public disclosure of a security event continues to impede a criminal investigation or cause damage to national security. (2) Notification event treated as discovered. A notification event shall be treated as discovered as of the first day on which such event is known to you. You shall be deemed to have knowledge VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00014 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 251

77509 Federal Register / Vol. 88, No. 217 / Monday, November 13, 2023 / Rules and Regulations of a notification event if such event is known to any person, other than the person committing the breach, who is your employee, officer, or other agent. ■4. Revise § 314.5 to read as follows: § 314.5 Effective date.

Section 314.4(j) is effective as of May 13, 2024.

By direction of the Commission. April J. Tabor, Secretary.

[FR Doc. 2023–24412 Filed 11–9–23; 8:45 am] BILLING CODE 6750–01–P DEPARTMENT OF HOMELAND SECURITY Coast Guard 33 CFR Part 100 [Docket No. USCG–2023–0882] Special Local Regulations; San Diego Parade of Lights, San Diego, CA AGENCY: Coast Guard, DHS. ACTION: Notification of enforcement of regulation.

SUMMARY: The Coast Guard will enforce the San Diego Parade of Lights special local regulations on the waters of San Diego Bay, California on December 10, 2023 and December 17, 2023. These special local regulations are necessary to provide for the safety of the participants, crew, spectators, sponsor vessels, and general users of the waterway. During the enforcement period, persons and vessels are prohibited from anchoring, blocking, loitering, or impeding within this regulated area unless authorized by the Captain of the Port Sector San Diego or a designated representative. DATES: The regulations in 33 CFR 100.1101 will be enforced from 5 p.m. through 8 p.m. on December 10, 2023, and from 5 p.m. through 8 p.m. on December 17, 2023, for Item 5 in Table 1 of Section 100.1101.

FOR FURTHER INFORMATION CONTACT: If you have questions about this publication of enforcement, call or email Lieutenant Shelley Turner, Waterways Management, U.S. Coast Guard Sector San Diego, CA; telephone (619) 278–7656, email [email protected]. SUPPLEMENTARY INFORMATION: The Coast Guard will enforce the special local regulations in 33 CFR 100.1101 for the San Diego Parade of Lights in San Diego Bay, CA in 33 CFR 100.1101, Table 1, Item 5 of that section from 5 p.m. until 8 p.m. on December 10, 2023, and on December 17, 2023. This enforcement action is being taken to provide for the safety of life on navigable waterways during the event. The Coast Guard’s regulation for recurring marine events in the San Diego Captain of the Port Zone identifies the regulated entities and area for this event. During the enforcement periods and under the provisions of 33 CFR 100.1101, persons and vessels are prohibited from anchoring, blocking, loitering, or impeding within this regulated area, unless authorized by the Captain of the Port, or his designated representative. The Coast Guard may be assisted by other Federal, State, or local law enforcement agencies in enforcing this regulation.

In addition to this document in the Federal Register, the Coast Guard will provide the maritime community with advance notification of this enforcement period via the Local Notice to Mariners, marine information broadcasts, and local advertising by the event sponsor. J.W. Spitler, Captain, U.S. Coast Guard, Captain of the Port Sector San Diego.

[FR Doc. 2023–25028 Filed 11–9–23; 8:45 am] BILLING CODE 9110–04–P DEPARTMENT OF HOMELAND SECURITY Coast Guard 33 CFR Part 100 [Docket No. USCG–2023–0871] Special Local Regulation; Marine Events Within the Eleventh Coast Guard District—Mission Bay Parade of Lights AGENCY: Coast Guard, DHS. ACTION: Notification of enforcement of regulation.

SUMMARY: The Coast Guard will enforce the special local regulation on the waters of Mission Bay, CA, during the Mission Bay Parade of Lights on December 10, 2022. This special local regulation is necessary to provide for the safety of the participants, crew, sponsor vessels of the event, and general users of the waterway. During the enforcement period, persons and vessels are prohibited from entering into, transiting through, or anchoring within this regulated area unless authorized by the Captain of the Port Sector San Diego or their designated representative. DATES: The regulations in 33 CFR 100.1101 for the location described in Item 6 in Table 1 to § 100.1101, will be enforced from 5:30 p.m. through 8 p.m. on December 10, 2023, and December 17, 2023.

FOR FURTHER INFORMATION CONTACT: If you have questions about this notification of enforcement, call or email Lieutenant Shelley Turner, Waterways Management, U.S. Coast Guard Sector San Diego, CA; telephone (619) 278–7656, email [email protected]. SUPPLEMENTARY INFORMATION: The Coast Guard will enforce the special local regulations in 33 CFR 100.1101 for the location identified in Item No. 6 in Table 1 to § 100.1101, from 5:30 p.m. until 8 p.m. on December 10, 2023, and December 17, 2023, for the Mission Bay Parade of Lights in Mission Bay, CA. This action is being taken to provide for the safety of life on the navigable waterways during the event. Our regulation for recurring marine events in the San Diego Captain of the Port Zone, § 100.1101, Item No. 6 in table 1 to § 100.1101, specifies the location of the regulated area for the Mission Bay Parade of Lights, which encompasses portions of Mission Bay. Under the provisions of § 100.1101, persons and vessels are prohibited from entering into, transiting through, or anchoring within this regulated area unless authorized by the Captain of the Port, or his designated representative. The Coast Guard may be assisted by other Federal, State, or local law enforcement agencies in enforcing this regulation. In addition to this document in the Federal Register, the Coast Guard will provide the maritime community with advance notification of this enforcement period via the Local Notice to Mariners and marine information broadcasts. J.W. Spitler, Captain, U.S. Coast Guard, Captain of the Port Sector San Diego.

[FR Doc. 2023–25027 Filed 11–9–23; 8:45 am] BILLING CODE 9110–04–P DEPARTMENT OF HOMELAND SECURITY Coast Guard 33 CFR Part 165 [Docket Number USCG–2023–0870] RIN 1625–AA00 Safety Zone; APEC 2023 Fireworks; San Francisco Bay, San Francisco, CA AGENCY: Coast Guard, Department of Homeland Security (DHS). ACTION: Temporary final rule. VerDate Sep<11>2014 15:58 Nov 09, 2023 Jkt 262001 PO 00000 Frm 00015 Fmt 4700 Sfmt 4700 E:\FR\FM\13NOR1.SGM 13NOR1 khammond on DSKJM1Z7X2PROD with RULES

Page 252

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations FEDERAL TRADE COMMISSION 16 CFR Part 463 RIN 3084–AB72 Combating Auto Retail Scams Trade Regulation Rule AGENCY: Federal Trade Commission. ACTION: Final rule.

SUMMARY: The Federal Trade Commission (‘‘FTC’’ or ‘‘Commission’’) is issuing this Combating Auto Retail Scams Trade Regulation Rule (‘‘CARS Rule,’’ ‘‘Rule,’’ or ‘‘Final Rule’’) and Statement of Basis and Purpose (‘‘SBP’’) related to the sale, financing, and leasing of covered motor vehicles by covered motor vehicle dealers. The Final Rule, among other things, prohibits motor vehicle dealers from making certain misrepresentations in the course of selling, leasing, or arranging financing for motor vehicles, requires accurate pricing disclosures in dealers’ advertising and sales communications, requires dealers to obtain consumers’ express, informed consent for charges, prohibits the sale of any add-on product or service that confers no benefit to the consumer, and requires dealers to keep records of certain advertisements and customer transactions.

DATES: This rule is effective July 30, 2024.

ADDRESSES: Copies of this document are available on the Commission’s website, www.ftc.gov.

FOR FURTHER INFORMATION CONTACT: Daniel Dwyer or Sanya Shahrasbi, Division of Financial Practices, Bureau of Consumer Protection, Federal Trade Commission, 202–326–2957 (Dwyer), 202–326–2709 (Shahrasbi), ddwyer@ ftc.gov, [email protected]. SUPPLEMENTARY INFORMATION: Table of Contents I. Background A. Statutory Authority B. Commission Actions Following the Dodd-Frank Act and the Rulemaking Process II. Motor Vehicle Financing and Leasing A. Overview of the Motor Vehicle Marketplace B. Deceptive and Unfair Practices in the Motor Vehicle Marketplace 1. Bait-and-Switch Tactics 2. Unlawful Practices Relating to Add-On Products or Services and Hidden Charges C. Law Enforcement and Other Responses III. Section-by-Section Analysis A. § 463.1: Authority B. § 463.2: Definitions 1. Overview 2. Definition-by-Definition Analysis (a) Add-On or Add-On Product(s) or Service(s) (b) Add-On List (c) Cash Price Without Optional Add-Ons (d) Clearly and Conspicuously (e) Motor Vehicle (finalized as ‘‘‘Covered Motor Vehicle’ or ‘Vehicle’ ’’) (f) Dealer or Motor Vehicle Dealer (finalized as ‘‘‘Covered Motor Vehicle Dealer’ or ‘Dealer’ ’’) (g) Express, Informed Consent (h) GAP Agreement (l) Government Charges (j) Material or Materially (k) Offering Price C. § 463.3: Prohibited Misrepresentations 1. General Comments 2. Paragraph-by-Paragraph Analysis of § 463.3 (a) The Costs or Terms of Purchasing, Financing, or Leasing a Vehicle (b) Any Costs, Limitation, Benefit, or Any Other Aspect of an Add-On Product or Service (c) Whether Terms Are, or Transaction Is, for Financing or a Lease (d) The Availability of Any Rebates or Discounts That Are Factored Into the Advertised Price but Not Available to All Consumers (e) The Availability of Vehicles at an Advertised Price (f) Whether Any Consumer Has Been or Will Be Preapproved or Guaranteed for Any Product, Service, or Term (g) Any Information on or About a Consumer’s Application for Financing (h) When the Transaction Is Final or Binding on All Parties (i) Keeping Cash Down Payments or Tradein Vehicles, Charging Fees, or Initiating Legal Process or Any Action If a Transaction Is Not Finalized or If the Consumer Does Not Wish To Engage in a Transaction (i) Keeping Cash Down Payments or Tradein Vehicles, Charging Fees, or Initiating Legal Process or Any Action If a Transaction Is Not Finalized or If the Consumer Does Not Wish To Engage in a Transaction (j) Whether or When a Dealer Will Pay Off Some or All of the Financing or Lease on a Consumer’s Trade-in Vehicle (k) Whether Consumer Reviews or Ratings Are Unbiased, Independent, or Ordinary Consumer Reviews or Ratings of the Dealer or the Dealer’s Products or Services (l) Whether the Dealer or Any of the Dealer’s Personnel or Products or Services Is or Was Affiliated With, Endorsed or Approved by, or Otherwise Associated With the United States Government or Any Federal, State, or Local Government Agency, Unit, or Department, Including the United States Department of Defense or Its Military Departments (m) Whether Consumers Have Won a Prize or Sweepstakes (n) Whether, or Under What Circumstances, a Vehicle May Be Moved, Including Across State Lines or Out of the Country (o) Whether, or Under What Circumstances, a Vehicle May Be Repossessed (p) Any of the Required Disclosures Identified in This Part D. § 463.4: Disclosure Requirements 1. Overview 2. Paragraph-by-Paragraph Analysis of § 463.4 (a) Offering Price (b) Add-On List (c) Add-Ons Not Required (d) Total of Payments and Consideration for a Financed or Lease Transaction (e) Monthly Payments Comparison E. § 463.5: Dealer Charges for Add-Ons and Other Items 1. Overview 2. Paragraph-by-Paragraph Analysis of § 463.5 (a) Add-Ons That Provide No Benefit (b) Undisclosed or Unselected Add-Ons (c) Any Item Without Express, Informed Consent F. § 463.6: Recordkeeping G. § 463.7: Waiver Not Permitted H. § 463.8: Severability I. § 463.9: Relation to State Laws IV. Effective Date V. Paperwork Reduction Act A. Add-On List Disclosures B. Disclosures Relating to Cash Price Without Optional Add-Ons C. Prohibited Misrepresentations and Required Disclosures D. Recordkeeping E. Capital and Other Non-Labor Costs 1. Disclosures 2. Recordkeeping VI. Regulatory Flexibility Act A. Significant Impact Analysis 1. Comments on Significant Impact 2. Certification of the Final Rule (a) Industry Averages (b) Dealer Size Based on the Number of Employees B. Initial and Final Regulatory Flexibility Analysis 1. Comments on the Initial Regulatory Flexibility Analysis (a) Description of the Reasons Why Action by the Agency Is Being Considered (b) Succinct Statement of the Objectives of, and Legal Basis for, the Proposed Rule (c) Description of and, Where Feasible, Estimate of the Number of Small Entities to Which the Proposed Rule Will Apply (d) Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Proposed Rule (e) Duplicative, Overlapping, or Conflicting Federal Rules (f) Description of Any Significant Alternatives to the Proposed Rule Which Accomplish the Stated Objectives of Applicable Statutes and Which Minimize Any Significant Economic Impact of the Proposed Rule on Small Entities 2. Final Regulatory Flexibility Analysis (a) Statement of the Need for, and Objectives of, the Rule (b) Issues Raised by Comments, Including Comments by the Chief Counsel for Advocacy of the SBA, the Commission’s Assessment and Response, and Any Changes Made as a Result VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 253

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 1 Public Law 111–203, 124 Stat. 1376 (2010). 2 12 U.S.C. 5519(d). See 12 U.S.C. 5519(f)(1) and (2) for definitions of the terms ‘‘motor vehicle’’ and ‘‘motor vehicle dealer’’ under section 1029 of the Dodd-Frank Act, respectively. 3 See 12 U.S.C. 5519(a) (discussing the authority over ‘‘motor vehicle dealer[s] that [are] predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both’’); 12 U.S.C. 5519(d) (‘‘Notwithstanding section 57a of title 15, the Federal Trade Commission is authorized to prescribe rules under sections 45 and 57a(a)(1)(B) of title 15[ ] in accordance with section 553 of title 5, with respect to a person described in subsection (a).’’); 5 U.S.C. 553. Because the Commission has authority to promulgate this Rule in accordance with the APA, it is not required to include a statement as to the prevalence of the acts or practices treated by the Rule under section 18(d) of the FTC Act. Compare 12 U.S.C. 5519(d) and (a) (providing the FTC with APA rulemaking authority for purposes of section 1029 of the Dodd-Frank Act), with 15 U.S.C. 57a(b)(3) (requiring a statement as to prevalence for certain rulemaking proceedings by the Commission under non-APA procedures), and 15 U.S.C. 57a(b)(1) (establishing that certain rulemaking proceedings by the Commission under non-APA procedures are subject to requirements in addition to those under the APA). 4 See 12 U.S.C. 5411(a).

5 76 FR 14014, 14015 (Mar. 15, 2011). 6 See Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles’’ (Apr. 12, 2011), https://www.ftc.gov/news-events/events/ 2011/04/road-ahead-selling-financing-leasingmotor-vehicles (providing materials from roundtable in Detroit, Michigan); Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles’’ (Aug. 2, 2011), https:// www.ftc.gov/news-events/events/2011/08/roadahead-selling-financing-leasing-motor-vehicles (providing materials from roundtable in San Antonio, Texas); Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles’’ (Nov. 17, 2011), https://www.ftc.gov/ news-events/events/2011/11/road-ahead-sellingfinancing-leasing-motor-vehicles (providing materials from roundtable in Washington, District of Columbia).

7 As used herein, references to the ‘‘Statement of Basis and Purpose’’ or ‘‘SBP’’ refer to the portions of this document that precede the regulatory text of the Final Rule. References to the ‘‘Rule,’’ ‘‘Final Rule,’’ or ‘‘CARS Rule’’ refer to the text in part 463—Combating Auto Retail Scams (‘‘CARS’’) Trade Regulation Rule. Because the Final Rule is narrower than the proposed Motor Vehicle Dealers Trade Regulation Rule in the NPRM, the Commission has modified the Rule title to reflect the more limited scope.

8 See Press Release, Fed. Trade Comm’n, ‘‘FTC Proposes Rule to Ban Junk Fees, Bait-and-Switch Tactics Plaguing Car Buyers’’ (June 23, 2022), https://www.ftc.gov/news-events/news/pressreleases/2022/06/ftc-proposes-rule-ban-junk-feesbait-switch-tactics-plaguing-car-buyers. 9 See Fed. Trade Comm’n, Notice of Proposed Rulemaking, Motor Vehicle Dealers Trade Regulation Rule, 87 FR 42012 (released June 23, 2022; published July 13, 2022) [hereinafter NPRM], https://www.govinfo.gov/content/pkg/FR-2022-07- 13/pdf/2022-14214.pdf.

10 The Commission received 27,349 comment submissions filed online in response to its NPRM. See Gen. Servs. Admin., Dkt. No. FTC–2022–0046, Proposed Rule, Motor Vehicle Dealers Trade Regulation Rule (July 13, 2022), https:// www.regulations.gov/document/FTC-2022-0046- 0001 (noting comments received). To facilitate public access, over 11,000 such comments have been posted publicly on Regulations.gov at https:// www.regulations.gov/document/FTC-2022-0046- 0001/comment (noting posted comments). As explained at Regulations.gov, agencies may choose to redact or withhold certain submissions (or portions thereof) such as those containing private or proprietary information, inappropriate language, or duplicate/near duplicate examples of a massmail campaign. See Gen. Servs. Admin., Regulations.gov Frequently Asked Questions, Find Dockets, Documents, and Comments FAQs, ‘‘How are comments counted and posted to Regulations.gov?,’’ https://www.regulations.gov/ faq?anchor=downloadingdata (last visited Dec. 5, 2023). The Commission has considered all timely and responsive public comments it received in response to its NPRM.

11 See, e.g., Individual commenter, Doc. No. FTC– 2022–0046–4648 (‘‘As a young Marine stationed in Continued (c) Description and Estimate of the Number of Small Entities to Which the Final Rule Will Apply or an Explanation of Why No Such Estimate Is Available (d) Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements (e) Description of the Steps the Commission Has Taken To Minimize the Significant Economic Impact on Small Entities Consistent With the Stated Objectives of Applicable Statutes VII. Final Regulatory Analysis Under Section 22 of the FTC Act A. Introduction B. Estimated Benefits of Final Rule 1. Consumer Time Savings When Shopping for Motor Vehicles 2. Reductions in Deadweight Loss 3. Framework 4. Estimation 5. Benefits Related to More Transparent Negotiation C. Estimated Costs of Final Rule 1. Prohibited Misrepresentations 2. Required Disclosure of Offering Price in Advertisements and in Response to Inquiry 3. Disclosure of Add-On List and Associated Prices 4. Required Disclosure of Total of Payments for Financing/Leasing Transactions 5. Prohibition on Charging for Add-Ons that Provide No Benefit 6. Requirement to Obtain Express, Informed Consent Before Any Charges 7. Recordkeeping D. Other Impacts of Final Rule E. Conclusion F. Appendix: Derivation of Deadweight Loss Reduction G. Appendix: Uncertainty Analysis VIII. Other Matters I. Background A. Statutory Authority The Dodd-Frank Wall Street Reform and Consumer Protection Act (‘‘Dodd- Frank Act’’) was signed into law in 2010.1 Section 1029 of the Dodd-Frank Act authorizes the FTC to prescribe rules with respect to unfair or deceptive acts or practices by motor vehicle dealers.2 The FTC is authorized to do so under the FTC Act and in accordance with section 553 of the Administrative Procedure Act (‘‘APA’’).3 The grant of APA rulemaking authority set forth in section 1029 of the Dodd-Frank Act became effective as of July 21, 2011— the designated ‘‘transfer date’’ established by the Treasury Department.4 B. Commission Actions Following the Dodd-Frank Act and the Rulemaking Process Following enactment of the Dodd- Frank Act, the Commission published in the Federal Register a notice discussing its authority to prescribe rules with respect to unfair or deceptive acts or practices by motor vehicle dealers and announcing that it would be hosting a series of public roundtables to explore consumer protection issues pertaining to motor vehicle sales and leasing, including what consumer protection issues, if any, exist that could be addressed through a possible rulemaking.5 The Commission sought participation from regulators, consumer advocates, industry participants, and other interested parties and ultimately held three such public roundtables.6 The Commission subsequently focused on enforcement and business guidance in the motor vehicle dealer marketplace. As discussed in SBP II.C,7 however, certain unfair and deceptive acts or practices have persisted, despite more than a decade of enforcement and education. Accordingly, on June 23, 2022, the Commission announced a notice of proposed rulemaking (‘‘NPRM’’) addressing unfair or deceptive acts or practices by motor vehicle dealers.8 That notice was published in the Federal Register on July 13, 2022.9 The NPRM, among other things, proposed to (i) prohibit motor vehicle dealers from making certain misrepresentations, (ii) require accurate pricing disclosures, (iii) prohibit the sale of any add-on product or service that confers no benefit to the consumer, (iv) require express, informed consent for add-ons and other charges, and (v) impose certain recordkeeping requirements. The comment period for the NPRM closed on September 12, 2022.

In response to the NPRM and proposed rule, the Commission received more than 27,000 comments from stakeholders representing a wide range of viewpoints.10 These stakeholders included numerous individual consumers who described deceptive practices during recent car purchases and many who discussed current or former military service and deceptive and predatory practices common near military installations.11 Commenters VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 254

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations a military town I was taken advantage of by a dealership when purchasing my first car. It set me back financially for years. I know of many young military people who purchased vehicle[ ]s and we[ ]re instantly so far upside down after leaving the dealership with thousands of dollars in add on junk charges . . . .’’); Individual commenter, Doc. No. FTC–2022–0046–0542 (‘‘As a former member of the Military, the amount of scams and horror stories I have heard regarding young service members buying cars is absurd. . . . Someone shouldn’t have to do hours of research on how to buy a car so they don’t get taken advantage of.’’); Individual commenter, Doc. No. FTC–2022–0046–0637 (‘‘As a small business owner and active duty military member I have played the role of both a buyer, toiling for hours to just reach fair deals on vehicles, as well as that of an advocate for my Sailors who have been preyed upon by local dealerships. Nowhere else in our society do so many average citizens have to mentally prepare for a battle over fair pricing and treatment for something that is realistically a modern necessity.’’); Individual commenter, Doc. No. FTC–2022–0046–9840 (‘‘I can’t list the number of times I have either seen, or have stepped in a situation, where car dealers have either attempted to take, or have successfully taken, advantage of a young military member or their family by baiting and switching when it came to the price of a car, or stated that the price was one amount, only to be charged, and over-charged a higher amount. These dealers have even attempted to pull unethical tricks on me and my wife, even after they found out that I was a military member, a combat veteran, that was serving this great nation.’’); Individual commenter, Doc. No. FTC– 2022–0046–0845 (‘‘Predatory practices like [baitand-switch pricing] are common near military installations . . . .’’).

12 Industry commenters claimed that many of the areas covered by the proposed rule are already addressed in industry guidance. The Commission notes that, although industry guidance can provide helpful information to dealers, dealers who choose not to follow such guidance, or who engage in deceptive or unfair practices, subject their customers to significant harm. The Rule addresses such practices, thus protecting consumers and lawabiding dealers.

13 Unless otherwise indicated, the terms ‘‘auto,’’ ‘‘automobile,’’ ‘‘car,’’ ‘‘motor vehicle,’’ and ‘‘vehicle,’’ as used in this SBP and the Commission’s final regulatory analysis, refer to ‘‘Covered Motor Vehicle’’ as defined in this part. 14 During 2017 to 2022, an average of 91% of American workers who did not work from home drove to work. See U.S. Census Bureau, ‘‘American Community Survey: Means of Transportation to Work by Selected Characteristics, 2022: ACS 1-Year Estimates Subject Tables’’ (2023), https://data. census.gov/table?q=Commuting&tid= ACSST1Y2022.S0802 (reporting 110,245,368 workers 16 years and over who drove alone to work in a car, truck, or van, and 13,881,067 workers 16 years and over who drove by carpool to work in a car, truck or van, together accounting for 91% of the total of 136,196,004 workers 16 years and over who did not work from home); U.S. Census Bureau, ‘‘American Community Survey: Means of Transportation to Work by Selected Characteristics, 2021: 2017–2021 ACS 5-Year Estimates Subject Tables’’ (2022), https://data.census.gov/ table?q=Commuting&tid=ACSST5Y2021.S0802 (reporting 113,724,271 workers 16 years and over who drove alone to work in a car, truck, or van, and 13,340,838 workers 16 years and over who drove by carpool to work in a car, truck or van, together accounting for 91% of the total of 140,223,271 workers 16 years and over who did not work from home).

15 Nat’l Auto. Dealers Ass’n, ‘‘NADA Data 2022’’ 7, https://www.nada.org/media/4695/download ?inline (noting average retail selling price of $46,287 for new vehicles sold by dealerships in 2022).

16 Id. at 10 (noting average retail selling price of $30,736 for used vehicles sold by new-vehicle dealerships in 2022).

17 Lydia DePillis, ‘‘How the Costs of Car Ownership Add Up,’’ N.Y. Times (Oct. 6, 2023), https://www.nytimes.com/interactive/2023/10/07/ business/car-ownership-costs.html (citing average monthly payment figures from TransUnion). 18 Id. (citing data from AAA and the U.S. Census Bureau).

19 Bureau of Econ. Analysis, ‘‘National Data: National Income and Product Accounts, Personal Consumption Expenditures by Major Type of Product’’ tbl. 2.3.5, https://apps.bea.gov/iTable/ ?reqid=19&step=2&isuri=1&categories=survey #eyJhcHBpZCI6MTksInN0ZXBzIjpbMSwyLDNd LCJkYXRhIjpbWyJjYXRlZ29yaWVzIiwiU3VydmV5I l0sWyJOSVBBX1RhYmxlX0xpc3QiLCI2NSJdXX0= (last revised July 27, 2023) (listing estimated annual expenditure rates of between $713.1 billion and $737.1 billion in 2022).

20 Melinda Zabritski, Experian Info. Sols., Inc., ‘‘State of the Automotive Finance Market Q4 2020’’ 5, https://www.experian.com/content/dam/ marketing/na/automotive/quarterly-webinars/ credit-trends/2020-quarterly-trends/v2-2020-q4state-automotive-market.pdf (on file with the Commission).

21 Fed. Rsrv. Bank of N.Y., ‘‘Quarterly Report on Household Debt and Credit, 2023: Q1’’ 3–4 (May 2023), https://www.newyorkfed.org/medialibrary/ interactives/householdcredit/data/pdf/HHDC_ 2023Q1; Fed. Rsrv. Bank of N.Y., ‘‘Data Underlying Report’’ on ‘‘Page 3 Data’’ and ‘‘Page 4 Data’’ tabs, https://www.newyorkfed.org/medialibrary/ interactives/householdcredit/data/xls/HHD_C_ Report_2023Q1 (last visited Dec. 5, 2023) (listing number of open ‘‘Auto Loan’’ accounts and total outstanding balance in such accounts). 22 Fed. Rsrv. Bank of N.Y., ‘‘Quarterly Report on Household Debt and Credit, 2023: Q1’’ 3, 21 (May 2023), https://www.newyorkfed.org/medialibrary/ interactives/householdcredit/data/pdf/HHDC_ 2023Q1; Fed. Rsrv. Bank of N.Y., ‘‘Data Underlying Report’’ on ‘‘Page 3 Data’’ and ‘‘Page 21 Data’’ tabs, https://www.newyorkfed.org/medialibrary/ interactives/householdcredit/data/xls/HHD_C_ Report_2023Q1 (last visited Dec. 5, 2023) (listing total ‘‘Auto Loan’’ debt balance compared to other product type categories).

23 See Consumer Fin. Prot. Bureau, ‘‘Financially Fit? Comparing the Credit Records of Young Servicemembers and Civilians’’ 27 (July 2020), https://files.consumerfinance.gov/f/documents/ cfpb_financially-fit_credit-young-servicememberscivilians_report_2020-07.pdf. also included dealerships and their employees, industry groups, consumer and community groups, and Federal and State lawmakers and law enforcement agencies. Many commenters, such as consumers, some dealers and dealer employees, consumer groups, and lawmakers and enforcers, were supportive of the proposed rule in whole or in part. Many of these commenters also urged the FTC to include additional protections for consumers and law-abiding businesses, while others, such as industry groups, dealers, and dealer employees, asked questions or criticized the proposal.12 These comments and responses to comments are discussed primarily in the discussion of the Final Rule in SBP III.

The Commission notes that it has undertaken careful review and consideration of each of the comments it received in response to its NPRM. The Commission has dedicated the majority of its section-by-section analysis to descriptions of, and responses to, comments or portions thereof that were critical of the Commission’s proposal or that urged the Commission to adopt additional requirements. Thus, to ensure that this document also reflects the many comments in the public record from stakeholders who supported the proposal as is, the Commission has excerpted a number of such comments in portions of its SBP.

II. Motor Vehicle Financing and Leasing A. Overview of the Motor Vehicle Marketplace For many consumers, buying or leasing a motor vehicle is essential, expensive, and time-consuming.13 Americans rely on their vehicles for work, school, childcare, groceries, medical visits, and many other important tasks in their daily lives.14 These vehicles have become increasingly costly: the average price of a new vehicle sold at a new car dealership in 2022 was more than $46,000,15 while the average price of a used vehicle sold at such dealerships was more than $30,000.16 By the second quarter of 2023, the average monthly payment for used cars reached $533, and the average monthly payment for new cars reached $741—both record highs.17 Vehicles are now many consumers’ largest expense—on a par with housing, child care and food, and accounting for 16% of the median annual household income before taxes.18 In 2022 alone, Americans spent more than $720 billion on motor vehicles and vehicle parts.19 Given these costs, many consumers who purchase a motor vehicle rely on financing to complete their purchases. According to public reports, 81% of new motor vehicle purchases, and nearly 35% of used vehicle purchases, are financed.20 By the first quarter of 2023, Americans had more than 107 million outstanding auto financing accounts and owed more than $1.56 trillion thereon,21 making auto finance the third-largest source of debt for U.S. consumers, and the second-largest for U.S. consumers ages 40 and over.22 Servicemembers have an average of twice as much auto debt as civilians— particularly young servicemembers, who generally require vehicles for transportation while living on military bases.23 By the age of 24, around 20 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 255

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 24 See Consumer Fin. Prot. Bureau, ‘‘Protecting Servicemembers from Costly Auto Loans and Wrongful Repossessions’’ (July 18, 2022), https:// www.consumerfinance.gov/about-us/blog/ protecting-servicemembers-from-costly-auto-loansand-wrongful-repossessions/. 25 Mary W. Sullivan, Matthew T. Jones & Carole L. Reynolds, Fed. Trade Comm’n, ‘‘The Auto Buyer Study: Lessons from In-Depth Consumer Interviews and Related Research’’ 15 (July 2020) [hereinafter Auto Buyer Study], https://www.ftc.gov/system/ files/documents/reports/auto-buyer-study-lessonsdepth-consumer-interviews-related-research/ bcpreportsautobuyerstudy.pdf (noting that the purchase transactions in the FTC’s qualitative study often took 5 hours or more to complete, with some extending over several days); Cf. Cox Auto., ‘‘2020 Cox Automotive Car Buyer Journey’’ 6 (2020) [hereinafter 2020 Cox Automotive Car Buyer Journey], https://b2b.autotrader.com/app/uploads/ 2020-Car-Buyer-Journey-Study.pdf (reporting average consumer time spent shopping for a vehicle at 14 hours, 53 minutes); Cox Auto., ‘‘2022 Car Buyer Journey: Top Trends Edition’’ 6 (2023) [hereinafter 2022 Car Buyer Journey], https:// www.coxautoinc.com/wp-content/uploads/2023/01/ 2022-Car-Buyer-Journey-Top-Trends.pdf (reporting average consumer time spent shopping for a vehicle at 14 hours, 39 minutes).

26 For example, consumers have complained about going to a dealership based on an offer that the dealer refuses to honor only after they have spent hours driving there and additional time on the lot. See, e.g., Complaint ¶¶ 23–26, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv– 0169 (N.D. Ill. Mar. 31, 2022) (alleging that many consumers drive hours to dealerships based on the advertised prices; that test-driving and selecting a vehicle, and negotiating the price and financing terms, is an often hours-long process; and that, after this time, dealers falsely told consumers that addon products or packages were required to purchase or finance the vehicle, even though they were not included in the low prices advertised or disclosed to consumers who called to confirm prices). 27 Unless otherwise indicated, the terms ‘‘dealer,’’ ‘‘dealership,’’ and ‘‘motor vehicle dealer’’ as used in this SBP and the Commission’s final regulatory analysis refer to ‘‘ ‘Covered Motor Vehicle Dealer’ or ‘Dealer’ ’’ as defined in this part. 28 See Nat’l Auto. Dealers Ass’n, ‘‘Dealer-Assisted Financing Benefits Consumers,’’ https:// www.nada.org/autofinance/[https:// web.archive.org/web/20220416131718/https:// www.nada.org/autofinance/] (Apr. 16, 2022) (noting that 7 out of 10 consumers finance through their dealership). This is also known as ‘‘dealer financing,’’ because consumers obtain financing through the dealer that partners with other entities in the financing process.

29 Dealers often originate the contract governing the extension of retail credit or retail leases and then sell, or otherwise assign, these contracts to unaffiliated third-party finance or leasing sources, including such third parties the dealer may have contacted in the course of arranging dealerprovided ‘‘indirect’’ financing. See Consumer Fin. Prot. Bureau, ‘‘Automobile Finance Examination Procedures’’ 3 (Aug. 2019), https://files.consumer finance.gov/f/documents/201908_cfpb_automobilefinance-examination-procedures.pdf. 30 See Nat’l Auto. Dealers Ass’n, Nat’l Ass’n of Minority Auto. Dealers & Am. Int’l Auto. Dealers Ass’n, ‘‘Fair Credit Compliance Policy & Program’’ 2 (2015), https://www.nada.org/media/4558/ download?inline. (defining ‘‘buy rate’’ as ‘‘the rate at which the finance source will purchase the credit contract from the dealer’’). 31 See, e.g., id. at 1 n.4 & accompanying text. 32 Id. (describing this as the amount dealers earn for arranging financing, measured as the difference between the consumer’s annual percentage rate (‘‘APR’’) and the wholesale ‘‘buy rate’’ at which a finance source buys the finance contract from the dealer, and noting that finance sources typically permit dealers to retain the dealer participation). 33 Nat’l Auto. Dealers Ass’n, ‘‘Average Dealership Profile’’ 1 (2020), https://www.nada.org/media/ 4136/download?attachment[http://web.archive.org/ web/20220623204158/https://www.nada.org/ media/4136/download?attachment] (June 23, 2022). 34 Nat’l Indep. Auto. Dealers Ass’n, ‘‘NIADA Used Car Industry Report 2020’’ 21 (2020). 35 Id. at 8, 10.

36 Melinda Zabritski, Experian Info. Sols., Inc., ‘‘State of the Automotive Finance Market Q2 2020’’ 8 (2020), https://www.experian.com/content/dam/ marketing/na/automotive/quarterly-webinars/ credit-trends/2020-q2-safm-final.pdf [http:// web.archive.org/web/20201106002015/https:// www.experian.com/content/dam/marketing/na/ automotive/quarterly-webinars/credit-trends/2020q2-safm-final.pdf] (Mar. 6, 2023). 37 Consumer Fin. Prot. Bureau, ‘‘Automobile Finance Examination Procedures’’ 4 (Aug. 2019), https://files.consumerfinance.gov/f/documents/ 201908_cfpb_automobile-finance-examinationprocedures.pdf.

38 Consumer Fin. Prot. Bureau, ‘‘Consumer Voices on Automobile Financing’’ 5 (June 2016), https:// files.consumerfinance.gov/f/documents/201606_ cfpb_consumer-voices-on-automobile-financing.pdf. 39 Melinda Zabritski, Experian Info. Sols., Inc., ‘‘State of the Automotive Finance Market Q4 2020’’ 26 (2020), https://www.experian.com/content/dam/ marketing/na/automotive/quarterly-webinars/ credit-trends/2020-quarterly-trends/v2-2020-q4state-automotive-market.pdf [http:// web.archive.org/web/20210311174922/https:// www.experian.com/content/dam/marketing/na/ automotive/quarterly-webinars/credit-trends/2020quarterly-trends/v2-2020-q4-state-automotivemarket.pdf] (Mar. 6, 2023). 40 See Fed. Trade Comm’n, ‘‘Financing or Leasing a Car,’’ https://www.consumer.ftc.gov/articles/0056financing-or-leasing-car (last visited Dec. 5, 2023) (‘‘The annual mileage limit in most standard leases is 15,000 or less.’’); Consumer Fin. Prot. Bureau, ‘‘What should I know about the differences between leasing and buying a vehicle?,’’ https:// www.consumerfinance.gov/ask-cfpb/what-should-iknow-about-the-differences-between-leasing-andbuying-a-vehicle-en-815/ (last visited Aug. 24, 2023) (‘‘Most leases restrict your mileage to 10,000–15,000 miles per year.’’).

percent of young servicemembers have at least $20,000 in auto debt, which equates to nearly two-thirds of an enlisted soldier’s typical base salary at that age.24 In addition to the expense, the process of buying or leasing a vehicle is often time-consuming and arduous. It can take several hours or days to finalize a transaction,25 on top of the hours it can take, particularly in rural areas, to drive to a dealership.26 Consumers may need to take time off work or arrange childcare, and families with a single vehicle may be forced to delay other important appointments due to the length of the vehicle-buying or -leasing process.

Most consumers—approximately 70%—finance vehicle purchases through a motor vehicle dealer,27 using what is known as dealer-provided ‘‘indirect’’ financing.28 This financing is typically offered through dealers’ financing and insurance (‘‘F&I’’) offices, which may also offer leasing and addon products or services. In the dealerprovided financing scenario, the dealer collects financial information about the consumer and forwards that information to prospective motor vehicle financing entities. These financing entities evaluate this information and, in the process, determine whether, and on what terms, to provide credit.29 These terms include the ‘‘buy rate’’: a riskbased finance charge that reflects the interest rate at which the entity will finance the deal.30 Dealers often add a finance charge called a ‘‘dealer reserve’’ or ‘‘markup’’ to the buy rate.31 Unlike the buy rate, the markup is not based on the underwriting risk or credit characteristics of the applicant, and dealers retain the markup as profit.32 New vehicle dealers average a gross profit of about $2,444 per vehicle,33 more than half of which comes from the dealers’ F&I offices. Independent used vehicle dealers averaged a gross profit of more than $6,000 per vehicle, as of 2019.34 While some used vehicle dealerships do not have a separate F&I office, more than half of such dealerships sell add-on products.35 Six to eight percent of financed vehicle purchases use what is called ‘‘buy here, pay here’’ dealers.36 In this scenario, consumers typically borrow from, and make their payments directly to, the dealership.

The remainder of financed vehicle transactions use what is commonly referred to as ‘‘direct’’ financing, provided by a credit union, bank, or other financing entity.37 In this scenario, consumers typically receive an interest rate quote from the financing entity prior to arriving at a dealership to purchase a vehicle, and use the financing to pay for their chosen vehicle.38 Dealerships do not profit on the financing portion of the vehicle sale transaction when a consumer arranges financing directly.

Finally, consumers may choose to lease a vehicle from a dealership rather than purchase one. In this scenario, consumers may drive a vehicle for a set period of time—typically around three years 39—and for a certain maximum number of miles—typically 10,000– 15,000 miles per year—in exchange for an upfront payment, a monthly payment, and fees before, during, and at the end of the lease, including for excess wear and usage over the mileage limit.40 When consumers lease a vehicle, they do not own it, and they must return the vehicle when the lease expires, though they may have the option to purchase VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 256

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 41 Melinda Zabritski, Experian Info. Sols., Inc., ‘‘State of the Automotive Finance Market Q4 2020’’ 5 (2020), https://www.experian.com/content/dam/ marketing/na/automotive/quarterly-webinars/ credit-trends/2020-quarterly-trends/v2-2020-q4state-automotive-market.pdf [https:// www.experian.com/content/dam/marketing/na/ automotive/quarterly-webinars/credit-trends/2020quarterly-trends/v2-2020-q4-state-automotivemarket.pdf] (Mar. 6, 2023).

42 See Fed. Trade Comm’n, ‘‘FTC Policy Statement on Deception’’ 2, 5, 103 F.T.C. 174 (1984) [hereinafter FTC Policy Statement on Deception] (appended to Cliffdale Assocs., Inc., 103 F.T.C. 110, 183 (1984)), https://www.ftc.gov/system/files/ documents/public_statements/410531/831014 deceptionstmt.pdf.

43 Id.

44 15 U.S.C. 45(n).

45 See, e.g., Fed. Trade Comm’n, ‘‘Consumer Sentinel Network Data Book 2022’’ app. B3 at 85 (Feb. 2023) [hereinafter Consumer Sentinel Network Data Book 2022], https://www.ftc.gov/system/files/ ftc_gov/pdf/CSN-Data-Book-2022.pdf (reporting complaints about new and used motor vehicle sales, financing, service & warranties, and rentals & leasing, collectively, of more than 100,000 in 2020, 2021, and 2022); Fed. Trade Comm’n, ‘‘Consumer Sentinel Network Data Book 2021’’ app. B3 at 85 (Feb. 2022) [hereinafter Consumer Sentinel Network Data Book 2021], https://www.ftc.gov/system/files/ ftc_gov/pdf/CSN%20Annual%20Data%20 Book%202021%20Final%20PDF.pdf (reporting complaints about new and used motor vehicle sales, financing, service & warranties, and rentals & leasing, collectively, of more than 100,000 in 2019, 2020, and 2021).

46 According to commenters, complaints to the Better Business Bureau about new and used auto dealers, when combined, have been either the first or second highest regarding any industry in the U.S. for the past twenty years. See Comment of Nat’l Consumer L. Ctr. et al., Doc. No. FTC–2022–0046– 7607 at ii; see also Better Bus. Bureau, ‘‘BBB Complaint and Inquiry Statistics,’’ https:// www.bbb.org/all/bbb-complaint-statistics (last visited Dec. 5, 2023) (listing complaint statistics from 2010 through 2022, sorted by industry). In addition, for the past seven years annual surveys of State and local consumer protection agencies have reported that auto-related complaints were the top complaint received from consumers. See Comment of Nat’l Consumer L. Ctr. et al., Doc. No. FTC–2022– 0046–7607 at 13; Consumer Fed’n of Am., ‘‘2022 Consumer Complaint Survey Report’’ 4–5 (May 2023), https://consumerfed.org/wp-content/ uploads/2023/05/2022-Consumer-Complaint- Survey-Report.pdf (‘‘For the seventh year in a row, auto sales, leases and repairs are the #1 complaint category. Consumers filed complaints about add-on products and services, bait and switch pricing, and mechanical condition issues.’’). 47 See Consumer Sentinel Network Data Book 2021, supra note 45, at 8 (listing vehicle-related complaints as the seventh most common report category, outside of identity theft, in 2021); Consumer Sentinel Network Data Book 2022, supra note 45, at 8 (listing motor vehicle-related complaints as the fifth most common report category, outside of identity theft, in 2022). 48 See Consumer Sentinel Network Data Book 2021, supra note 45, at 18 (listing vehicle-related complaints as the eighth most common complaint category for military consumers, outside of identity theft categories, in 2021); Consumer Sentinel Network Data Book 2022, supra note 45, at 18 (listing vehicle-related complaints as the ninth most common complaint category for military consumers, outside of identity theft categories, in 2022).

49 See, e.g., United States v. Brien, 617 F.2d 299, 308 (1st Cir. 1980); United States v. Offs. Known as 50 State Distrib. Co., 708 F.2d 1371, 1374–75 (9th Cir. 1983); Keith B. Anderson, Fed. Trade Comm’n, ‘‘Consumer Fraud in the United States: An FTC Survey’’ 80 (2004), https://www.ftc.gov/sites/ default/files/documents/reports/consumer-fraudunited-states-ftc-survey/040805confraudrpt.pdf (staff report noting consumers who reported they were victims of fraud complained to an official source only 8.4 percent of the time, filing complaints with the BBB in 3.5 percent of incidents and to a Federal agency, including the FTC, in only 1.4 percent of cases).

50 See Complaint, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv–0169 (N.D. Ill. Mar. 31, 2022); see also WardsAuto, ‘‘WardsAuto 2020 Megadealer 100,’’ https://www.wardsauto.com/ dealers/wardsauto-2020-megadealer-100-industryforce (last visited Dec. 5, 2023) (listing Napleton Automotive Group as the 13th-ranked dealership group by total revenue).

51 Complaint ¶ 27, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv–0169 (N.D. Ill. Mar. 31, 2022) (alleging that defendants buried charges for add-ons in voluminous paperwork, making them difficult to detect); see Press Release, Fed. Trade Comm’n, ‘‘FTC Returns Additional $857,000 To Consumers Harmed by Napleton Auto’s Junk Fees and Discriminatory Practices’’ (Nov. 20, 2023), https://www.ftc.gov/news-events/news/pressreleases/2023/11/ftc-returns-additional-857000consumers-harmed-napleton-autos-junk-feesdiscriminatory-practices.

52 For example, in a recent action involving deceptive pre-approval claims, the FTC had received roughly 30 complaints about the company’s pre-approval conduct in the five-year period prior to announcing its action. But in the five months following announcement of the action, more than 900 additional consumers came forward with complaints about the conduct. See Press Release, Fed. Trade Comm’n, ‘‘FTC Announces Claims Process for Consumers Harmed by Credit Karma ‘Pre-Approved’ Offers for Which They Were Denied’’ (Dec. 5, 2023), https://www.ftc.gov/newsevents/news/press-releases/2023/12/ftc-announcesclaims-process-consumers-harmed-credit-karmapre-approved-offers-which-they-were (‘‘[W]ithin five months of that announcement, the agency received nearly 900 more such complaints’’). 53 While other issues exist in the motor vehicle sales, financing, and leasing space, including issues involving discrimination, financing application falsification, data privacy and security, and yo-yo financing, this Rule’s core focus is on misrepresentations and add-on and pricing practices.

the vehicle at the end of the lease period. Nearly 27% of new vehicles are leased, as are just over 8% of used vehicles.41 B. Deceptive and Unfair Practices in the Motor Vehicle Marketplace Section 5 of the Federal Trade Commission Act (‘‘FTC Act’’), as amended (15 U.S.C. 45), authorizes the FTC to address deceptive or unfair acts or practices in or affecting commerce, including in the motor vehicle marketplace.

An act or practice is deceptive if there is a representation, omission, or other practice that is likely to mislead consumers acting reasonably under the circumstances and is material to consumers—that is, it is likely to affect consumers’ conduct or decisions with regard to a product or service.42 Deceptive conduct can involve omission of material information, the disclosure of which is necessary to prevent the claim, practice, or sale from being misleading.43 An act or practice is considered unfair under section 5 of the FTC Act if: (1) it causes, or is likely to cause, substantial injury to consumers; (2) the injury is not reasonably avoidable by consumers; and (3) the injury is not outweighed by countervailing benefits to consumers or to competition.44 In each of the past four years, the FTC received more than 100,000 complaints regarding motor vehicle sales, financing, service and warranties, and rentals and leasing.45 This industry is also consistently at or near the top of private sources of consumer complaints.46 Many of these complaints concerned deceptive or unfair acts or practices affecting U.S. consumers. Complaints about motor vehicle transactions are regularly in the top ten complaint categories tracked by the FTC.47 For military consumers as well, auto-related complaints are among the top 10 complaint categories outside of identity theft.48 Moreover, law enforcement experience shows that complaints are just the tip of the iceberg.49 The Commission’s recent enforcement action against a large, multistate dealership group is illustrative of this point in the motor vehicle marketplace: in that matter, the Commission received 391 complaints—about add-ons and other issues—over a several-month period prior to filing a complaint against the thirteenth largest dealership group in the country by revenue as of 2020.50 However, in a survey of the dealer’s customers over the same time period, 83% of respondents—or at least 16,848 customers—indicated they were subject to the dealer’s unlawful practices related to add-ons alone.51 Similarly, in other contexts where companies were charged with making misrepresentations or engaging in misconduct regarding add-on products, information obtained after filing has shown widespread harm far beyond the initial consumer complaint volumes reported prior to filing.52 As examined in greater detail in the paragraphs that follow, consumers in the motor vehicle marketplace are confronted with chronic deceptive or unfair practices, including bait-andswitch tactics and hidden charges.53 1. Bait-and-Switch Tactics Advertisements for motor vehicles are often consumers’ first contact in the vehicle-buying or -leasing process. Dealers utilize a variety of means to VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 257

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 54 Nat’l Auto. Dealers Ass’n, ‘‘NADA Data 2022’’ 15, https://www.nada.org/media/4695/download? inline (listing average dealership advertising per new vehicle sold of $718 in 2022, and $602 in 2021).

55 Id. at 16 (listing 68.2% of estimated advertising expenditures by medium as internet expenditures). 56 See, e.g., Complaint, Timonium Chrysler, Inc., No. C–4429 (F.T.C. Jan. 28, 2014) (alleging dealership advertised internet prices and dealer discounts that were only available through rebates not applicable to the typical consumer); Complaint, Ganley Ford West, Inc., No. C–4428 (F.T.C. Jan. 28, 2014) (alleging dealership advertised discounts on vehicle prices, but failed to disclose that discounts were only available on the most expensive models); Complaint, Progressive Chevrolet Co., No. C–4578 (F.T.C. June 13, 2016) (alleging deceptive failure to disclose material conditions of obtaining the lease monthly payment in their online and print advertising); Complaint ¶¶ 38–46, Fed. Trade Comm’n v. Tate’s Auto Ctr. of Winslow, Inc., No. 3:18–cv–08176–DJH (D. Ariz. July 31, 2018) (alleging that company issued advertisements for attractive terms but concealed that the terms were only applicable to lease offers); Complaint ¶¶ 36– 38, United States v. New World Auto Imports, Inc., No. 3:16–cv–02401–K (N.D. Tex. Aug. 18, 2016) (alleging misrepresentation that terms were for financing instead of leasing); Complaint ¶¶ 85–87, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016) (alleging that dealerships claimed consumers could finance the purchase of vehicles with attractive terms and buried disclosures indicating that such terms were applicable to leases only). 57 Complaint ¶¶ 82–84, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016) (alleging misrepresentation that dealer would pay off a consumer’s trade-in when in fact consumers were still responsible for outstanding debt on trade-in vehicles); Complaint ¶¶ 17–19, TXVT Ltd. P’ship, No. C–4508 (F.T.C. Feb. 12, 2015) (alleging misrepresentation in leasing advertising that the dealership would pay off the negative equity of a consumer’s trade in vehicle, when in fact, it was merely rolled into the financed amount for the consumer’s newly financed vehicle). 58 See, e.g., Complaint ¶¶ 12, 17–19, Traffic Jam Events, LLC, No. 9395 (F.T.C. Aug. 7, 2020); Complaint ¶¶ 4, 7–9, Fowlerville Ford, Inc., No. C– 4433 (F.T.C. Feb. 20, 2014). 59 See, e.g., Complaint ¶¶ 25, 27–28, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv– 0169 (N.D. Ill. Mar. 31, 2022). 60 See Ben Eisen, ‘‘Car Dealer Markups Helped Drive Inflation, Study Finds,’’ Wall St. J., Apr. 23, 2023, https://www.wsj.com/articles/car-dealermarkups-helped-drive-inflation-study-finds- 7c1d5a2d; U.S. Bureau of Labor Statistics, ‘‘Automotive Dealerships 2019–2022: Dealer Markup Increases Drive New-Vehicle Consumer Inflation’’ (Apr. 2023), https://www.bls.gov/opub/ mlr/2023/article/automotive-dealershipsmarkups.htm.

61 See Nat’l Consumer L. Ctr., ‘‘Auto Add-ons Add Up: How Dealer Discretion Drives Excessive, Arbitrary, and Discriminatory Pricing’’ (Oct. 1, 2017), https://www.nclc.org/images/pdf/car_sales/ report-auto-add-on.pdf; Adam J. Levitin, ‘‘The Fast and the Usurious: Putting the Brakes on Auto Lending Abuses,’’ 108 Geo. L.J. 1257, 1265–66 (2020), https://www.law.georgetown.edu/ georgetown-law-journal/wp-content/uploads/sites/ 26/2020/05/Levitin_The-Fast-and-the-Usurious- Putting-the-Brakes-on-Auto-Lending-Abuses.pdf (discussing ‘‘loan packing’’ as the sale of add-on products that are falsely represented as being required in order to obtain financing); Complaint ¶¶ 12–19, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020) (alleging deceptive and unauthorized add-on charges in consumers’ transactions); Complaint ¶¶ 59–64, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016) (alleging deceptive and unauthorized add-on charges in consumers’ transactions); Complaint ¶¶ 6, 9, TT of Longwood, Inc., No. C–4531 (F.T.C. July 2, 2015) (alleging misrepresentations regarding prices for added features); see also Auto Buyer Study, supra note 25, at 14 (‘‘Several participants who thought that they had not purchased add-ons, or that the add-ons were included at no additional charge, were surprised to learn, when going through the paperwork, that they had in fact paid extra for add-ons. This is consistent with consumers’ experiencing fatigue during the buying process or confusion with a financially complex transaction, but would also be consistent with dealer misrepresentations.’’).

62 Consumers for Auto Reliability and Safety, Comment Letter on Motor Vehicle Roundtables, Project No. P104811 at 2–3 (Apr. 1, 2012), https:// www.ftc.gov/sites/default/files/documents/public_ comments/public-roundtables-protectingconsumers-sale-and-leasing-motor-vehicles-projectno.p104811-00108/00108-82875.pdf (citing a U.S. Department of Defense data call summary that found that the vast majority of military counselors have clients with auto financing problems and cited ‘‘loan packing’’ and yo-yo financing as the most frequent auto lending abuses affecting servicemembers).

63 Complaint ¶¶ 17–19, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020); Complaint ¶ 60, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016); Carole L. Reynolds & Stephanie E. Cox, Fed. Trade Comm’n, ‘‘Buckle Up: Navigating Auto Sales and Financing’’ (2020) [hereinafter Buckle Up], https://www.ftc.gov/ reports/buckle-navigating-auto-sales-financing. 64 See, e.g., Buckle Up, supra note 63, at 10–11 (noting the long, complex transaction process); Complaint ¶¶ 23–28, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv–01690 (N.D. Ill. Mar. 31, 2022) (same).

65 Complaint ¶ 24, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv–01690 (N.D. Ill. Mar. 31, 2022); see also Buckle Up, supra note 63, at 10– 11.

reach consumers, including social media and online advertisements, television and radio commercials, and direct mail marketing. New vehicle dealers spend an average of more than $700 on advertising per vehicle sold 54—more than two-thirds of which goes toward online advertising.55 The FTC has brought many law enforcement actions involving motor vehicle dealers’ deceptive advertising and other unlawful tactics. Such actions have charged dealers with, inter alia, making misrepresentations regarding the price of a vehicle, the availability of discounts and rebates, the monthly payment amount for a financed purchase or lease, the amount due at signing, and whether an offer pertains to a purchase or a lease.56 Other such actions have charged dealers with misrepresentations regarding whether the dealer or consumer is responsible for paying off ‘‘negative equity,’’ i.e., the outstanding debt on a vehicle that is being ‘‘traded in’’ as part of another vehicle purchase.57 And in other FTC actions, some dealers have lured potential buyers through financial incentives incidental to the purchase, such as deceptive promises of a valuable prize that is redeemable only by visiting the dealership.58 Deceptive tactics can cause significant consumer harm and impede competition, competitively disadvantaging law-abiding dealers. When dealerships advertise prices, discounts, or other terms that are not actually available to typical consumers, consumers who select that dealership instead of others spend time visiting the dealership or otherwise interacting with the dealership under false pretenses. 2. Unlawful Practices Relating to Add- On Products or Services and Hidden Charges Another key consumer protection concern is the sale of add-on products or services in a deceptive or unfair manner. Add-ons in connection with the sale or financing of motor vehicles include extended warranties, service and maintenance plans, payment programs, guaranteed automobile or asset protection (‘‘GAP’’) agreements, emergency road service, VIN etching and other theft protection devices, and undercoating. Individual add-ons can cost consumers thousands of dollars and can significantly increase the overall cost to the consumer in the transaction.59 Moreover, in the past two years, dealers have substantially increased prices for these add-ons, notwithstanding that such products or services largely are not constrained by supply.60 A significant consumer protection concern is consumers paying for addons without knowing about, or expressly agreeing to, these products or services.61 This type of payment packing has been a particular concern in the military community.62 The protracted and paperwork-heavy vehicle-buying or -leasing process can make it difficult for consumers to spot add-on charges, particularly when advertised prices or payment terms do not mention add-ons.63 If consumers are financing or leasing the vehicle, they undergo a separate financing process after selecting a vehicle, which can include wading through a thick stack of dense paperwork filled with fine print.64 For example, according to an FTC law enforcement action, consumers visiting one large dealership group were required to complete a stack of paperwork that ran more than sixty pages and required more than a dozen signatures.65 This paperwork can include hidden charges for add-on products or services, causing consumers VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 258

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 66 Complaint ¶¶ 25, 27, 29–32, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv– 01690 (N.D. Ill. Mar. 31, 2022); see also Complaint ¶¶ 17–19, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020); Dale Irwin, Slough Connealy Irwin & Madden LLC, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00060 (Dec. 29, 2011), https:// www.regulations.gov/comment/FTC-2022-0036- 0051 (consumer protection lawyer noting ‘‘payment packing’’ among problems ‘‘that cry out for scrutiny and regulation’’); Michael Archer, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00041 at 3 (Aug. 6, 2011), https://www.regulations.gov/comment/ FTC-2022-0036-0014 (workshop panelist stating, ‘‘I have seen cases wherein the dealer uses financing to pack in extra costs or to wipe out trade-in value.’’); Dawn Smith, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00027 (July 27, 2011), https://www.regulations.gov/comment/FTC-2022- 0036-0043 (‘‘Confusing or misleading sales terms[.] Extra fees was [sic] added at the time of purchase and to this day I still do not understand what the fee was for; it made the payment higher.’’); Carrie Ferraro, Legal Servs. of N.J., Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00061 (Dec. 29, 2011), https://www.regulations.gov/comment/FTC- 2022-0036-0059 (citing ‘‘[d]ealers engage[d] in packing’’ as an example of the common consumer complaints of car-sales-related fraud received by LSNJ’s legal advice hotline); Rosemary Shahan, Consumers for Auto Reliability and Safety, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00069 at 3 (Jan. 31, 2012), https:// www.regulations.gov/comment/FTC-2022-0036- 0069 (noting that ‘‘[m]any common auto scams do not generate complaints in proportion to how pervasive or costly the practices are, simply because the consumers generally remain unaware they have been scammed,’’ including as a result of ‘‘[l]oan packing’’); Mary W. Sullivan, Matthew T. Jones & Carole L. Reynolds, Fed. Trade Comm’n, ‘‘The Auto Buyer Study: Lessons from In-Depth Consumer Interviews and Related Research,’’ Supplemental Appendix: Redacted Interview Transcripts at 525 (2020) [hereinafter Auto Buyer Study: Appendix], https://www.ftc.gov/system/files/documents/ reports/buckle-navigating-auto-sales-financing/ bcpstaffreportautobuyerstudysuppappendix.pdf (Study participant 169810: consumer had ‘‘additional items’’ charges on contract that consumer could not identify); id. at 730, 740–42 (Study participant 188329: dealer did not tell consumer about GAP or service contract but consumer was charged $599 and $1,950 for those add-ons, respectively); Press Release, N.Y. State Att’y Gen., ‘‘A.G. Schneiderman Announces Nearly $14 Million Settlement with NYC and Westchester Auto Dealerships for Deceptive Practices that Resulted in Inflated Car Prices’’ (June 17, 2015), https://ag.ny.gov/press-release/2015/agschneiderman-announces-nearly-14-millionsettlement-nyc-and-westchester-auto (‘‘This settlement is part of the [New York] attorney general’s wider initiative to end the practice of ‘jamming,’ unlawfully charging consumers for hidden purchases by car dealerships.’’). 67 Under the Truth in Lending Act (‘‘TILA’’) and its implementing Regulation Z, required add-on products or services must be factored into the APR and the finance charge disclosed during the transaction. See 15 U.S.C. 1605, 1606, 1638; 12 CFR 226.4, 226.18(b), (d), (e), and 226.22. It is legally impermissible for dealers to include charges for such products in a consumer’s contract without disclosing them. See, e.g., Complaint ¶¶ 57–60, Fed. Trade Comm’n v. Stewart Fin. Co. Holdings, Inc., No. 1:03–CV–2648 (N.D. Ga. Sept. 4, 2003) (alleging violations for failure to include the cost of required add-on products in the finance charge and annual percentage rate disclosed to consumers). 68 See, e.g., Buckle Up, supra note 63, at 6; Fed. Trade Comm’n, Military Consumer Financial Workshop, Panel 1, Tr. 19:25–41 (July 19, 2017), https://www.ftc.gov/news-events/events-calendar/ military-consumer-workshop; Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles,’’ Public Roundtable, Session 2, Tr. at 40–41 (Aug. 2 2011), https://www.ftc.gov/newsevents/events/2011/08/road-ahead-sellingfinancing-leasing-motor-vehicles (noting that optional products and services are often already included in the monthly payment prices advertised or quoted); Christopher Kukla, Ctr. for Responsible Lending, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00071 at 10 (Feb. 1, 2012), https:// www.regulations.gov/comment/FTC-2022-0036- 0068 (discussing how dealers conceal packing by expressing an increase in price in terms of monthly payment); Att’ys General of 31 States & DC, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00112 at 5 (Apr. 13, 2012), https:// www.regulations.gov/comment/FTC-2022-0036- 0124 (discussing the ‘‘age-old auto salesperson’s trick’’ of quoting monthly payment prices without disclosing that the quote includes the cost of optional items that the customer has not yet agreed to purchase).

69 See, e.g., Complaint ¶¶ 9, 26, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv– 03945 (S.D.N.Y. May 21, 2020) (charging defendants with discriminating on the basis of race, color, and national origin by charging higher interest rates and inflated fees); Press Release, N.Y. State Att’y Gen., ‘‘Attorney General James Delivers Restitution to New Yorkers Cheated by Auto Dealership’’ (Nov. 17, 2020), https://ag.ny.gov/press-release/2020/ attorney-general-james-delivers-restitution-newyorkers-cheated-auto-dealership (dealership targeted Chinese speakers for unlawful payment packing or ‘‘jamming’’); Military Consumer Financial Workshop, Tr. 19:21 (July 19, 2017), https://www.ftc.gov/news-events/events/2017/07/ military-consumer-workshop (panelist discussing servicemembers experiencing payment packing); see also Fed. Trade Comm’n, ‘‘Staff Perspective: A Closer Look at the Military Consumer Financial Workshop’’ 2–3 (Feb. 2018), https://www.ftc.gov/ system/files/documents/reports/closer-lookmilitary-consumer-financial-workshop-federaltrade-commission-staff-perspective/military_ consumer_workshop_-_staff_perspective_2-2-18.pdf (explaining the unique situation of servicemembers whose steady paychecks make them attractive customers for dealers, while having no or minimal credit history, meaning they qualify for less advantageous credit terms and higher interest rate financing).

70 See, e.g., Buckle Up, supra note 63, at 6 (observing that the introduction of ‘‘add-ons during financing discussions caused several participants’ total sale price to balloon from the cash price’’); id. at 9 (observing that, for most consumers in the study, ‘‘add-ons did not come up until the financing process, if at all, after a long car-buying process and at a time when the consumer often felt pressure to close the deal’’); id. (noting that most study participants’ contracts included add-ons charges, but that many ‘‘were unclear what those add-ons included, and sometimes did not realize they had purchased any add-ons at all’’); id. at 7 (explaining situations where the consumer reached the financing office after negotiating with the sales staff and were then told that the agreed upon price was not compatible with key financing terms—for example, a promised rebate or discount could not be combined with an advertised interest rate). 71 Complaint ¶¶ 12–19, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020) (alleging deceptive and unauthorized add-on charges in consumers’ transactions); Complaint ¶¶ 59–64, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016) (alleging deceptive and unauthorized add-on charges in consumers’ transactions); Complaint ¶¶ 6, 9, TT of Longwood, No. C–4531 (F.T.C. July 2, 2015) (alleging misrepresentations regarding prices for added features); see also Auto Buyer Study, supra note 25, at 14.

72 Complaint ¶¶ 4–14, Nat’l Payment Network, Inc., No. C–4521 (F.T.C. May 4, 2015) (alleging failure to disclose fees associated with financing program; misleading savings claims in advertisements); Complaint ¶¶ 4–13, Matt Blatt Inc., No. C–4532 (F.T.C. July 2, 2015) (alleging failure to disclose fees associated with financing program; misleading savings claims); Buckle Up, supra note 63, at 10 (noting that some Auto Buyer Study participants did not fully understand material aspects of extended warranties or service plans they purchased and ‘‘were surprised to discover during the interview that their plans had unexpected limitations’’ or that ‘‘they had to pay out-of-pocket for repairs or services that were not covered’’; for example, one ‘‘consumer purchased a ‘Lifetime’ maintenance plan, only to discover later that he received a one-year plan that covered periodic oil changes’’). Cf. Consent Order ¶¶ 10–16, Santander to purchase those add-ons without knowing about or agreeing to them, or without knowing or agreeing to their costs or other key terms.66 Unscrupulous dealers are able to slip the often considerable additional costs for these items past consumers unnoticed and into purchase contracts through a variety of means, including by not mentioning them at all,67 or by focusing consumers’ attention on other aspects of the complex transaction, such as monthly payments, which might increase only marginally with the addition of prorated add-on costs, or may even be made to decrease if the financing term is extended.68 This type of conduct can target immigrants, communities of color, and servicemembers.69 In other instances, dealers might wait until late in the transaction to mention add-ons, and then do so in a misleading manner. For example, participants in an FTC qualitative study on consumers’ carbuying experiences cited situations where dealers waited until the financing stage to mention add-ons, after consumers believed they had agreed on terms, and even though many add-ons have nothing to do with financing and were not mentioned at all during the sales process or when prices were initially negotiated.70 According to FTC enforcement actions, dealers also have represented that add-ons are required when in fact they are not,71 have misrepresented the purported benefits of add-ons, and have failed to disclose material limitations.72 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00008 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 259

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations Consumer USA, Inc., CFPB No. 2018–BCFP–0008 (Nov. 20, 2018) (finding that defendant sold GAP product allegedly providing ‘‘full coverage’’ to consumers with loan-to-value ratios (‘‘LTVs’’) above 125%, when in fact coverage was limited to 125% of LTV).

73 Complaint ¶ 27, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv–01690 (N.D. Ill. Mar. 31, 2022).

74 The study is described in the Commission’s reports: Auto Buyer Study, supra note 25, and Buckle Up, supra note 63. Some industry commenters critiqued the FTC’s reliance on this qualitative study. The Commission notes that the study provides helpful qualitative insight from consumer interviews regarding their recent motor vehicle purchases and is one of the many sources the Commission has considered, including consumer complaints, enforcement actions, outreach and dialogue with stakeholders and consumer groups, among others, as described in this SBP and in the NPRM. 75 Auto Buyer Study: Appendix, supra note 66, at 130 (Study participant 152288); see also id. at 202– 03 (Study participant 180267: dealership included a charge for GAP in the final paperwork but not in retail sales contract); id. at 296 (Study participant 146748: consumer learned during interview with FTC that consumer purchased GAP: ‘‘maybe they’re just throwing that in there without telling you’’). 76 Individual commenter, Doc. No. FTC–2022– 0046–4648.

77 Individual commenter, Doc. No. FTC–2022– 0046–0016.

78 Individual commenter, Doc. No. FTC–2022– 0046–1216.

79 Individual commenter, Doc. No. FTC–2022– 0046–3615.

80 Individual commenter, Doc. No. FTC–2022– 0046–7366.

81 Individual commenter, Doc. No. FTC–2022– 0046–3693.

82 Individual commenter, Doc. No. FTC–2022– 0046–3678.

83 Individual commenter, Doc. No. FTC–2022– 0046–1479.

84 Individual commenter, Doc. No. FTC–2022– 0046–1878.

Indeed, as previously noted, in a recent FTC enforcement action, the Commission cited a survey finding that 83% of consumers from the named dealers were charged for add-on products or services that they did not authorize or as a result of deceptive claims.73 One participant in an FTC qualitative study of consumers’ car-buying experiences summed up these issues during an interview after having purchased a vehicle.74 The consumer purchased a $2,000 service contract that the dealer falsely said was free, and a $900 GAP agreement that the dealer falsely said was mandatory. The consumer only learned about these purchases during the study interview. This consumer remarked:

I feel I’ve been taken advantage of, to be honest with you. Even though I thought that I was getting a great deal with the interest rate, but I know [sic] see that they’re also very sneaky about putting stuff on your paperwork. They only let you skim through the paperwork that you have to sign and they just kind of tell you what it is. This is this, this is that, this is this, and then you just sign it away. You’re so tired, you’re so worn down, you don’t want to be there no more. You just want to get it done and over with. They take advantage of that. Yes, they still play this friendly card, you know, thank you for your business card kind of thing. Like I said, they never lose. They never lose.75 Similarly, in response to the Commission’s notice of proposed rulemaking, thousands of commenters described issues they faced when purchasing, financing, or leasing a vehicle. Many comments the Commission received in support of the NPRM were from self-identified military consumers and dealership employees. Examples of supportive comments include the following:

• As a young Marine stationed in a military town I was taken advantage of by a dealership when purchasing my first car. It set me back financially for years. I know of many young military people who purchased vehicle[]s and we[]re instantly so far upside down after leaving the dealership with thousands of dollars in add on junk charges . . . . Please make it more difficult for dishonest dealers like these to financially burden young Americans and Americans of any age for that matter.76 • Imagine going to a restaurant franchise and order[ing] a burger and fries for $10 and the franchise employees say[,] ‘Sorry that will be $25 dollars, there is a $10 restaurant adjustment price due to market conditions and $5 for us to place and document your order.’ You would walk away without hesitation because that would [be] absolutely ridiculous. Yet, dealerships are allowed to do exactly that. . . . IT IS TIME TO CHANGE AND PROTECT CONSUMERS[.]77 • As in many other areas, it is the vulnerable in our society who are probably most affected by such deceptive practices. . . . Sadly, it is often these very people who desperately need a dependable, affordable car for transportation to work, school, shopping, or medical care. To entice, pressure, or trick people into buying a car that is more than they can afford sets them up for financial failure, not only in possibly having a needed car repossessed, but in long-term damage to their credit. . . . In closing, I would be extremely happy to see rules such as those described above enacted, and don’t think these could come a day too soon. It’s a step in the right direction for the protection of the consumer.78 • None of us working here at the dealership in sales benefit from [unfair and deceptive practices]. We cringe as much as every customer and have to show up to work every[ ]day and hope we are not forced to screw someone with these BS products. . . . I would hope when [t]he regulators are making their decisions, they understand the positive implications this would have for dealership employees both financially and mentally.79 • Generally, I’m not a person in favor of government regulation. However, as a potential customer and cash buyer, I feel there is certainly a need to bring car dealers back into check. I’m just looking for a more honest and transparent process. I don’t want to be taken advantage of. I certainly don’t want my family members or [s]oldiers to be taken advantage of. Therefore, I feel it is in the best interest of future customers to support this regulation.80 • I cannot stress enough my support for these new rules. Currently, dealerships across the US, including the one I work for, have made the car buying process needlessly confusing, expensive, and frustrating by engaging in false advertising and hidden add-on products.81 • I can tell you after many years of car buying I have NEVER walked out of a dealership feeling good. Even worse, I’ve never purchased a car feeling like I fully understood what I was getting. . . . Looking forward to seeing the change happen SOON! 82 • When I buy a gallon of milk from the store, the price is written next to the milk. When I go pay, I pay the price advertised next to the milk. Would it be OK if I go up to pay and that gallon of milk had anywhere between 1% and 1,200% markup depending on the day, what you look like, what you drove to the store in, if you’re a man or a woman? 83 • We ended up having to drive 3 hours to the [vehicle we] wanted. Upon arriving to pick[ ]up the car we were told there was a [$]4,300 increase over MSRP. We were told if we didn’t take it they had someone else waiting to purchase it. We needed the car and didn’t have time to hunt down another one so ended up purchasing it. Very disappointed in the long and awful process.84 • The worst is dealing with car dealers. You never know what the real price is on a vehicle until you spend a few hours with them. Mandatory add[-] on[ ]s, market availability surcharges, doc fees that vary from dealer to dealer. . . . Then dealing with the finance manager who tr[ie]s to sell you everything you don’t[ ]need. They high pressure the consumer on purchasing extend[ed] warranties. There VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00009 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 260

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 85 Individual commenter, Doc. No. FTC–2022– 0046–0825.

86 Individual commenter, Doc. No. FTC–2022– 0046–4833.

87 Individual commenter, Doc. No. FTC–2022– 0046–1690.

88 Complaint, Fed. Trade Comm’n v. Rhinelander Auto Ctr., Inc., No. 3:23–cv–00737 (W.D. Wis. Oct. 24, 2023); Complaint, Fed. Trade Comm’n v. Passport Auto. Grp., Inc., No. 8:22–cv–02670–GLS (D. Md. Oct. 18, 2022); Complaint, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22–cv– 01690 (N.D. Ill. Mar. 31, 2022); Complaint, Traffic Jam Events, LLC, No. 9395 (F.T.C. Aug. 7, 2020); Complaint, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020); Complaint, Federal-Mogul Motorparts LLC, No. C–4717 (F.T.C. May 12, 2020); Complaint, LightYear Dealer Techs., LLC, No. C–4687 (F.T.C. Sept. 3, 2019); Complaint, Fed. Trade Comm’n v. Passport Imports, Inc., No. 8:18–cv–03118 (D. Md. Oct. 10, 2018); Complaint, Fed. Trade Comm’n v. Tate’s Auto Ctr. of Winslow, Inc., No. 3:18–cv– 08176–DJH (D. Ariz. July 31, 2018); Complaint, Cowboy AG, LLC, No. C–4639 (F.T.C. Jan. 4, 2018); Complaint, Fed. Trade Comm’n v. Norm Reeves, Inc., No. 8:17–cv–01942 (C.D. Cal. Nov. 3, 2017); Complaint, Asbury Auto. Grp., Inc., No. C–4606 (F.T.C. Mar. 22, 2017); Complaint, CarMax, Inc., No. C–4605 (F.T.C. Mar. 22, 2017); Complaint, West- Herr Auto. Grp., Inc., No. C–4607 (F.T.C. Mar. 22, 2017); Complaint, Fed. Trade Comm’n v. Volkswagen Grp. of Am., Inc., No. 3:16–cv–01534 (N.D. Cal. Jan. 31, 2017); Complaint, Fed. Trade Comm’n v. Uber Techs., Inc., No. 3:17–cv–00261 (N.D. Cal. Jan. 19, 2017); Complaint, Gen. Motors LLC, No. C–4596 (F.T.C. Dec. 8, 2016); Complaint, Jim Koons Mgmt. Co., No. C–4598 (F.T.C. Dec. 8, 2016); Complaint, Lithia Motors, Inc., No. C–4597 (F.T.C. Dec. 8, 2016); Complaint, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16– cv–07329 (C.D. Cal. Sep. 29, 2016); Complaint, United States v. New World Auto Imports, Inc., No. 3:16–cv–02401–K (N.D. Tex. Aug. 18, 2016); Complaint, Progressive Chevrolet Co., No. C–4578 (F.T.C. June 13, 2016); Complaint, BMW of N. Am., LLC, No. C–4555 (F.T.C. Oct. 21, 2015); Complaint, United States v. Tricolor Auto Acceptance, LLC, No. 3:15–cv–3002 (N.D. Tex. Sept. 15, 2015); Complaint, JS Autoworld, Inc., No. C–4535 (F.T.C. Aug. 13, 2015); Complaint, TC Dealership, L.P., No. C–4536 (F.T.C. Aug. 13, 2015); Complaint, Matt Blatt Inc., No. C–4532 (F.T.C. July 2, 2015); Complaint, TT of Longwood, Inc., No. C–4531 (F.T.C. July 2, 2015); Complaint, Fin. Select, Inc., No. C–4528 (F.T.C. June 2, 2015); Complaint, First Am. Title Lending of Ga., LLC, No. C–4529 (F.T.C. June 2, 2015); Complaint, City Nissan Inc., No. C– 4524 (F.T.C. May 4, 2015); Complaint, Jim Burke Auto., Inc., No. C–4523 (F.T.C. May 4, 2015); Complaint, Nat’l Payment Network, Inc., No. C– 4521 (F.T.C. May 4, 2015); Complaint, TXVT Ltd. P’ship, No. C–4508 (F.T.C. Feb. 12, 2015); Complaint, Fed. Trade Comm’n v. Regency Fin. Servs., LLC, No. 1:15–cv–20270–DPG (S.D. Fla. Jan. 26, 2015); Complaint, United States v. Billion Auto, Inc., No. 5:14–cv–04118–MWB (N.D. Iowa Dec. 11, 2014); Complaint, Fed. Trade Comm’n v. Ramey Motors, Inc., No. 1:14–cv–29603 (S.D. W. Va. Dec. 11, 2014); Complaint, Fed. Trade Comm’n v. Consumer Portfolio Servs., Inc., No. 14–cv–00819 (C.D. Cal. May 28, 2014); Complaint, Nissan N. Am., Inc., No. C–4454 (F.T.C. May 1, 2014); Complaint, TBWA Worldwide, Inc., No. C–4455 (F.T.C. May 1, 2014); Complaint, Bill Robertson & Sons, Inc., No. C–4451 (F.T.C. Apr. 11, 2014); Complaint, Paramount Kia of Hickory, LLC, No. C–4450 (F.T.C. Apr. 11, 2014); Complaint, Fed. Trade Comm’n v. Abernathy Motor Co., No. 3:14–cv–00063–BRW (E.D. Ark. Mar. 12, 2014); Complaint, Fowlerville Ford, Inc., No. C–4433 (F.T.C. Feb. 20, 2014); Complaint, Infiniti of Clarendon Hills, Inc., No. C– 4438 (F.T.C. Feb. 20, 2014); Complaint, Luis Alfonso Sierra, No. C–4434 (F.T.C. Feb. 20, 2014); Complaint, Mohammad Sabha, No. C–4435 (F.T.C. Feb. 20, 2014); Complaint, Norm Reeves, Inc., No. C–4436 (F.T.C. Feb. 20, 2014); Complaint, Ganley Ford West, Inc., No. C–4428 (F.T.C. Jan. 28, 2014); Complaint, Timonium Chrysler, Inc., No. C–4429 (F.T.C. Jan. 28, 2014); Complaint, Courtesy Auto Grp., Inc., No. 9359 (F.T.C. Jan. 7, 2014); Complaint, Franklin’s Budget Car Sales, Inc., No. C–4371 (F.T.C. Oct. 3, 2012); Complaint, Fed. Trade Comm’n v. Matthew J. Loewen, No. 2:12–cv–01207– MJP (W.D. Wash. July 13, 2012); Complaint, Key Hyundai of Manchester, LLC, No. C–4358 (F.T.C. May 4, 2012); Complaint, Billion Auto, Inc., No. C– 4356 (F.T.C. May 1, 2012); Complaint, Frank Myers AutoMaxx, LLC, No. C–4353 (F.T.C. Apr. 19, 2012); Complaint, Ramey Motors, Inc., No. C–4354 (F.T.C. Apr. 19, 2012); Complaint, Fed. Trade Comm’n v. Hope for Car Owners, LLC, No. 2:12–cv–00778– GEB–EFB (E.D. Cal. Mar. 27, 2012); Complaint, Fed. Trade Comm’n v. NAFSO VLM, Inc., No. 2:12–cv– 00781–KJM–EFB (E.D. Cal. Mar. 27, 2012); Complaint, Fed. Trade Comm’n v. Stewart Fin. Co. Holdings, Inc., No. 1:03–CV–2648 (N.D. Ga. Sept. 4, 2003); Complaint, Pacifico Ardmore, Inc., No. C– 3920 (F.T.C. Feb. 7, 2000).

89 Operation Steer Clear and Operation Ruse Control, brought with State law enforcement partners around the nation and Canada, encompassed 252 enforcement actions. See Press Release, Fed. Trade Comm’n, ‘‘Multiple Law Enforcement Partners Announce Crackdown on Deception, Fraud in Auto Sales, Financing and Leasing’’ (Mar. 26, 2015), https://www.ftc.gov/newsevents/press-releases/2015/03/ftc-multiple-lawenforcement-partners-announce-crackdown. 90 For example, the FTC has held public workshops: (1) in conjunction with the National Highway Traffic Safety Administration to examine the consumer privacy and security issues posed by automated and connected motor vehicles, see Fed. Trade Comm’n, ‘‘Connected Cars: Privacy, Security Issues Related to Connected, Automated Vehicles’’ (June 28, 2017), https://www.ftc.gov/news-events/ events-calendar/2017/06/connected-cars-privacysecurity-issues-related-connected; (2) to explore competition and related issues in the U.S. motor vehicle distribution system including how consumers and businesses may be affected by State regulations and emerging trends in the industry, see Fed. Trade Comm’n, ‘‘Auto Distribution: Current Issues & Future Trends’’ (Jan. 19, 2016), https:// www.ftc.gov/news-events/events-calendar/2016/01/ auto-distribution-current-issues-future-trends; (3) on military consumer financial issues, including automobile purchases, financing, and leasing, see Fed. Trade Comm’n, ‘‘Military Consumer Workshop’’ (July 19, 2017), https://www.ftc.gov/ news-events/events-calendar/military-consumerworkshop; and (4) through a series of three roundtables on numerous issues in selling, financing, and leasing automobiles, see Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles’’ (Apr. 12, 2011), https:// www.ftc.gov/news-events/events-calendar/2011/04/ road-ahead-selling-financing-leasing-motorvehicles; Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles’’ (Aug. 2, 2011), https://www.ftc.gov/news-events/eventscalendar/2011/08/road-ahead-selling-financingleasing-motor-vehicles; Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing & Leasing Motor Vehicles’’ (Nov. 17, 2011), https://www.ftc.gov/ news-events/events-calendar/2011/11/road-aheadselling-financing-leasing-motor-vehicles; see also Consumers for Auto Reliability and Safety, Comment Letter on Motor Vehicle Roundtables, Project No. P104811, at 6 (Apr. 1, 2012), https:// www.ftc.gov/sites/default/files/documents/public_ comments/public-roundtables-protectingconsumers-sale-and-leasing-motor-vehicles-projectno.p104811-00108/00108-82875.pdf (stating that the Director of the Navy-Marine Corps Relief Society in San Diego indicated before the California Assembly Committee on Banking and Finance that ‘‘the number one issue they are confronted with is used car dealers who are taking advantage of military personnel’’). These events, and others, have included speakers representing consumers, dealers, regulators, and other industry stakeholders. needs [to be] some sort of policing [of] these unscrupulous car dealers to protect the buyers.85 • This is a good start to making car purchasing a better experience. . . . I remember looking at a Lexus and being told by the dealership, the only one in the state, that [S]cotchguard and undercoating were mandatory and they refused to sell any vehicles without them. There were two Acura dealerships in town and one of them included ‘free’ lifetime oil changes that I didn’t learn about until negotiating the price and had already spent two hours in negotiations. All of these services/price adjustments were not disclosed at the start of the negotiation and were only revealed either in the manager’s office or when the purchase agreement was presented to me by the salesperson. After spending time on the test drive and negotiating the price, it felt that these last minute price adjustments were being revealed that late in the process so that I wouldn’t leave.86 • Please enact and enforce these regulations to protect vulnerable consumers from predatory business practices enjoyed by dealers. Our family experienced such practices when trying to purchase a vehicle in early 2022. It was only after five hours at the dealership that we discovered the dealer had added on a $3,000 market adjustment and $3,100 in other add-ons (nitrogen-filled tires, LoJack, paint protection) to MSRP. This raised the price by about $6,000 and caused us to use extra PTO over that week to find a new vehicle at a price within our budget. Greater transparency in the carbuying process is desperately needed to protect vulnerable consumers—who usually lack any bargaining power— against power dealer networks and their special interest groups. . . .87 C. Law Enforcement and Other Responses The Commission has taken action to protect consumers from deceptive and unfair acts or practices in the motor vehicle marketplace. As noted in the NPRM, the Commission has brought more than 50 auto law enforcement actions; 88 led two law enforcement sweeps, including one that involved 181 State enforcement actions; 89 published two reports on a qualitative study of consumer experiences while purchasing motor vehicles; and held workshops with various stakeholders to discuss the motor vehicle marketplace.90 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 261

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 91 The CFPB has brought at least 23 enforcement actions involving motor vehicles, financing, or addon products or services. See Consent Order ¶¶ 3, 13–57, Toyota Motor Credit Corp., CFPB No. 2023– CFPB–0015 (Nov. 20, 2023) (finding auto lender engaged in unfair or abusive acts or practices by making it unreasonably difficult for consumers to cancel unwanted add-ons; failing to ensure consumers received refunds of payments they had made for certain add-ons that had become void and worthless; and failing to provide refunds owed to consumers who canceled their vehicle service agreements);

Complaint ¶¶ 75–104, CFPB v. USASF Servicing, LLC, No. 1:23–cv–03433–VMC (N.D. Ga. Aug. 2, 2023) (alleging auto loan servicer illegally disabled and repossessed consumers’ vehicles, wrongfully double-billed consumers, misapplied payments, and failed to ensure refunds of unearned GAP premiums to which consumers were entitled); Consent Order ¶¶ 7–33, TMX Finance LLC, CFPB No. 2023–CFPB–0001 (Feb. 23, 2023) (finding auto lender understated and inaccurately disclosed the finance charge and annual percentage rate on loans and unfairly charged borrowers for a product that provided no benefit); Complaint ¶¶ 33–135, 171– 226, CFPB v. Credit Acceptance Corp., No. 1:23–cv– 00038 (S.D.N.Y. Jan. 4, 2023) (alleging indirect auto lender misrepresented key terms of loans provided to subprime and deep-subprime consumers and substantially assisted dealers in the deceptive sale of add-on products); Consent Order ¶¶ 7–22, Wells Fargo Bank, N.A., CFPB No. 2022–CFPB–0011 (Dec. 20, 2022) (finding bank incorrectly applied borrowers’ auto loan payments, erroneously assessed fees and interest, wrongly repossessed borrowers’ vehicles, and failed to ensure borrowers received refunds of unearned GAP fees at early payoff); Consent Order ¶¶ 4–55, Hyundai Capital America, CFPB No. 2022–CFPB–0005 (July 26, 2022) (finding auto finance company furnished inaccurate information about consumers to credit reporting agencies); Consent Order ¶¶ 4–14, 3rd Generation, Inc., CFPB No. 2021–CFPB–0003 (May 21, 2021) (finding subprime auto loan servicer charged interest on late payments of fees without the knowledge or consent of consumers); Consent Order ¶¶ 8–50, Santander Consumer USA Inc., CFPB No. 2020–BCFP–0027 (Dec. 22, 2020) (finding auto finance company provided inaccurate records to credit reporting agencies); Consent Order ¶¶ 11 –52, Nissan Motor Acceptance Corp., CFPB No. 2020–BCFP–0017 (Oct. 13, 2020) (finding auto finance company misrepresented financing extension agreements, repossessions, and limitations to consumer bankruptcy protections); Consent Order ¶¶ 8–22, Lobel Fin. Corp., CFPB No. 2020–BCFP–0016 (Sept. 21, 2020) (finding autoloan servicer unfairly charged delinquent consumers add-on charges in the form of Loss Damage Waiver premiums); Consent Order ¶¶ 6–30, Santander Consumer USA Inc., CFPB No. 2018– BCFP–0008 (Nov. 20, 2018) (finding auto finance company sold GAP to consumers with LTV over 125%, misrepresenting that such consumers would be fully covered with total loss); Consent Order ¶¶ 27–39, Wells Fargo Bank, N.A., CFPB No. 2018–BCFP–0001 (Apr. 20, 2018) (finding bank imposed duplicative or unnecessary forcedplaced auto loan insurance on consumers); Consent Order ¶¶ 12–23, Toyota Motor Credit Corp., CFPB No. 2016–CFPB–0002 (Feb. 2, 2016) (finding auto finance company engaged in discriminatory pricing markup for motor vehicle financing, without regard to creditworthiness); Consent Order ¶¶ 73–75, Y King S Corp., CFPB No. 2016–CFPB–0001 (Jan. 21, 2016) (finding used car dealer failed to disclose mandatory add-ons as financing charges); Consent Order ¶¶ 12–51, Interstate Auto Grp., Inc., CFPB No. 2015–CFPB–0032 (Dec. 17, 2015) (finding dealership and financing company reported information they knew or had reasonable cause to believe was inaccurate to credit reporting entities, harming consumer credit); Consent Order ¶¶ 7–90, Westlake Servs., LLC, CFPB No. 2015–CFPB–0026 (Sept. 30, 2015) (finding indirect auto financing entity used illegal debt collection tactics); Consent Order ¶¶ 8–23, Fifth Third Bank, CFPB No. 2015– CFPB–0024 (Sept. 28, 2015) (finding discrimination against loan applicants in credit applications based on characteristics such as race and national origin); Consent Order ¶¶ 9–24, Am. Honda Fin. Corp., CFPB No. 2015–CFPB–0014 (July 14, 2015) (same); Consent Order ¶¶ 4–60, DriveTime Auto. Grp., Inc., CFPB No. 2014–CFPB–0017 (Nov. 19, 2014) (finding buy-here-pay-here dealership made harassing debt collection calls and provided inaccurate credit information to credit reporting agencies); Consent Order ¶¶ 4–37, First Investors Fin. Servs. Grp., Inc., CFPB No. 2014–CFPB–0012 (Aug. 20, 2014) (finding auto financing company provided inaccurate records to credit reporting agencies); Consent Order ¶¶ 7–27, Ally Fin. Inc., CFPB No. 2013–CFPB–0010 (Dec. 20, 2013) (finding auto lender engaged in discriminatory pricing); Consent Order ¶¶ 14–29, U.S. Bank Nat’l Ass’n, CFPB No. 2013–CFPB–0004 (June 26, 2013) (finding bank failed to properly disclose all the fees charged to participants in the companies’ Military Installment Loans and Educational Services auto loans program, and misrepresented the true cost and coverage of add-on products financed along with the auto loans); Consent Order ¶¶ 10–22, Dealers’ Fin. Servs., LLC, CFPB No. 2013–CFPB– 0004 (June 26, 2013) (finding financing company made deceptive statements regarding the cost of add-on products and the scope of coverage of the vehicle service contract).

92 Operation Steer Clear and Operation Ruse Control, brought with State law enforcement partners around the nation and Canada, encompassed 252 enforcement actions. See Press Release, Fed. Trade Comm’n, ‘‘Multiple Law Enforcement Partners Announce Crackdown on Deception, Fraud in Auto Sales, Financing and Leasing’’ (Mar. 26, 2015), https://www.ftc.gov/newsevents/press-releases/2015/03/ftc-multiple-lawenforcement-partners-announce-crackdown. Separately, the California Attorney General’s office sued a dealership chain under State consumer protection laws for deceiving consumers about addon product charges and misrepresenting consumers’ income on credit applications; the alleged practices specifically targeted low-income consumers with subprime credit. Complaint ¶¶ 37–86, People v. Paul Blanco’s Good Car Co. Auto Grp., No. RG– 19036081 (Cal. Super. Ct. Sept. 23, 2019). 93 See, e.g., Cal. Veh. Code 11713.1(b), (c); Or. Admin. R. 137–020–0020(3)(c); Wis. Admin. Code Trans. 139.03(3); Ind. Code 24–4.5–3–202. 94 Or. Admin. R. 137–020–0020(3)(c); Official Commentary, Or. Admin. R. 137–020–0020(3)(c). 95 Cal. Veh. Code 11713.1(b), (c); Wis. Admin. Code Trans. 139.03(3).

96 Ind. Code 24–4.5–3–202(3)(e)(ix) (prohibiting the sale of any GAP coverage when the LTV is less than 80%); Cal. Civ. Code 2982.12(a)(5)(B) (prohibiting the sale of any GAP waiver in three scenarios, including when the amount financed for the vehicle exceeds the amount covered by the GAP waiver).

97 See Fed. Trade Comm’n, Business Guidance, ‘‘Automobiles,’’ https://www.ftc.gov/businessguidance/industry/automobiles (last visited Dec. 5, 2023).

98 See Fed. Trade Comm’n, ‘‘Buying and Owning a Car,’’ https://consumer.ftc.gov/shopping-anddonating/buying-and-owning-car (last visited Dec. 5, 2023).

99 See, e.g., Ill. Sec’y of State Police, Dealer Handbook (Apr. 2022), https://www.ilsos.gov/ publications/pdf_publications/sos_dop66.pdf; Wis. DOT—Div. of Motor Vehicles, Motor Vehicle Salesperson Manual—2020, https://wisconsin dot.gov/Documents/dmv/shared/salesmanual- 20.pdf; Enf’t Div. of the Tex. Dep’t of Motor Vehicles, Motor Vehicle Dealer Manual (2017), https://www.txdmv.gov/sites/default/files/bodyfiles/Motor_Vehicle_Dealer_Manual.pdf. As discussed in the NPRM, the Commission’s law enforcement partners have also brought actions addressing unfair, abusive, and deceptive practices in the motor vehicle industry. For example, the Consumer Financial Protection Bureau (‘‘CFPB’’) has taken action against third-party motor vehicle financing entities in matters that raise similar, and sometimes identical, claims of deceptive and unfair acts or practices as have been at issue in FTC enforcement actions.91 In addition, States have engaged in enforcement actions alleging similar dealer misconduct in the motor vehicle dealer marketplace, and have implemented legislative and regulatory measures to address corresponding consumer protection issues. With regard to law enforcement, State regulators and Attorneys General have participated in law enforcement sweeps with the FTC, and have filed hundreds of actions alleging unlawful conduct by motor vehicle dealerships across the country.92 Furthermore, with regard to legislative and regulatory efforts, at least four States have enacted consumer protection measures relating to pricing or add-ons by motor vehicle dealers.93 For example, to ‘‘ensure that dealers do not add in hidden or undisclosed costs after the price for a vehicle has been advertised,’’ Oregon promulgated a rule that requires dealerships to state an ‘‘offering price’’ that is the actual offer and amount the consumer can pay to own the vehicle, excluding only taxes and other specific items.94 California and Wisconsin have similarly enacted laws that make it unlawful for dealerships to advertise a total price without including additional costs to the purchaser outside the mandatory tax, title, and registration fees.95 Other States, such as Indiana, have enacted codes that prohibit the sale of add-ons in certain circumstances.96 The Commission and its law enforcement partners also regularly provide business guidance and consumer education regarding the motor vehicle marketplace. The Commission has compiled its motor vehicle business guidance into a portal on its website, with links to guidance documents, frequently asked questions, and legal resources.97 Likewise, the Commission provides a web page for consumers to learn more about buying, financing, and leasing motor vehicles.98 Several States have published similar such guidance manuals for motor vehicle dealers,99 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00011 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 262

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 100 See, e.g., Cal. Dept. of Just., ‘‘Buying and Maintaining a Car,’’ https://oag.ca.gov/consumers/ general/cars (last visited Dec. 5, 2023); Fla. Highway Safety & Motor Vehicles, ‘‘Buying from a Licensed Dealer,’’ https://www.flhsmv.gov/safetycenter/consumer-education/buying-vehicle-florida/ buying-licensed-dealer (last visited Dec. 5, 2023); Or. Dep’t of Just., ‘‘Buying a Vehicle,’’ https:// www.doj.state.or.us/consumer-protection/motorvehicles/buying-a-vehicle/ (last visited Dec. 5, 2023).

101 Complaint ¶ 17, Fed. Trade Comm’n v. Passport Auto. Grp., Inc., No. 8:22–cv–2670 (D. Md. Oct. 18, 2022).

102 Id. ¶ 18. Recent actions outside the auto marketplace, even in transactions that may not be as complex and time consuming as motor vehicle transactions, further illustrate unfair and deceptive practices related to advertising, add-ons, and hidden charges. In one such action, the court noted ‘‘the realities of the disparate bargaining power’’ between the corporate defendant and its customers, adding that customers ‘‘might have believed the [add-on] fees were mandatory,’’ and ‘‘might not have had the time’’ to negotiate or complain about them. Fed. Trade Comm’n v. FleetCor Techs., Inc., 1:19–cv–5727, 2022 WL 3350066, at *13 (N.D. Ga. Aug. 9, 2022) (granting the Commission’s motion to exclude the defendant’s expert testimony); see also Fed. Trade Comm’n v. FleetCor Techs., Inc., 620 F. Supp. 3d 1268, 1337 (N.D. Ga. 2022) (finding on summary judgment that (1) defendants did not tell consumers about fees at sign-up; (2) disclosures about fees in contractual documents were inadequate; and (3) defendants failed to get consent to add-on charges); id. at 1334 (concluding that defendants had ‘‘charged a slew of fees that: were never discoverable to customers [and] were obscured by undecipherable language’’); Complaint ¶¶ 41–43, Fed. Trade Comm’n v. Harris Originals of NY, Inc., No. 2:22–cv–4260 (E.D.N.Y. July 20, 2022) (alleging that a jewelry company charged military consumers for add-on products without their consent or under false pretenses); Complaint ¶¶ 61– 73, Fed. Trade Comm’n v. Benefytt Techs., Inc., No. 8:22–cv–1794 (M.D. Fla. Aug. 8, 2022) (alleging illegal add-on charges by healthcare companies); Complaint ¶¶ 1–4, Fed. Trade Comm’n v. First Am. Payment Sys., LP, No. 4:22–cv–654 (E.D. Tex. July 29, 2022) (alleging that a payment processing company misrepresented the terms and costs of its services, resulting in unexpected and unauthorized fees); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Trade Regulation Rule on Unfair or Deceptive Fees, 88 FR 77420, 77435–37 (released Oct. 11, 2023; published Nov. 9, 2023), https:// www.govinfo.gov/content/pkg/FR-2023-11-09/pdf/ 2023-24234.pdf.

103 Complaint ¶¶ 3–5, 11–18, 33–43, 48–51, Fed. Trade Comm’n v. Rhinelander Auto Ctr., Inc., No. 3:23–cv–00737 (W.D. Wis. Oct. 24, 2023). 104 Complaint ¶¶ 128–30, CFPB v. Credit Acceptance Corp., No. 1:23–cv–38 (S.D.N.Y. Jan. 4, 2023).

105 Complaint ¶ 3, Massachusetts v. Jaffarian’s Serv., Inc., No. 2277–cv–881 (Mass. Super. Ct. Sept. 15, 2022); Assurance of Discontinuance ¶¶ 7–9, In re Hometown Auto Framingham, Inc., No. 2384–cv –116 (Mass. Super. Ct. Jan. 17, 2023). 106 Complaint ¶ 5, Massachusetts v. Jaffarian’s Serv., Inc., No. 2277–cv–881 (Mass. Super. Ct. Jan. 17, 2023).

107 Consumer Fin. Prot. Bureau, ‘‘Supervisory Highlights: Issue 24, Summer 2021’’ 3–4 (June 2021), https://files.consumerfinance.gov/f/ documents/cfpb_supervisory-highlights_issue-24_ 2021-06.pdf (finding servicers added and maintained unnecessary collateral protection insurance (CPI) when consumers had adequate insurance and thus the CPI provided no benefit to the consumers, and also when consumers’ vehicles had been repossessed even though no actual insurance protection was provided after repossession).

108 Consumer Fin. Prot. Bureau, ‘‘Supervisory Highlights: Issue 28, Fall 2022’’ 4–5 (Nov. 2022), https://files.consumerfinance.gov/f/documents/ cfpb_supervisory-highlights_issue-28_2022-11.pdf (finding consumers paid off their vehicle financing early but servicers failed to ensure consumers received refunds for unearned fees related to addon products which no longer offered any possible benefit to consumers after payoff). 109 Cal. Civ. Code 2982.12. 110 Press Release, Off. of the Att’y Gen. of Cal., ‘‘Attorney General Bonta and Assemblymember Maienschein Announce Legislation to Strengthen Protections for Car Buyers’’ (Feb. 16, 2022), https:// oag.ca.gov/news/press-releases/attorney-generalbonta-and-assemblymember-maienscheinannounce-legislation.

111 Cal. Civ. Code 2982.12. 112 Id.

while others have provided online consumer education resources.100 While some commenters stated that existing Federal and State efforts are sufficient, recent Commission and partner actions indicate that misconduct has persisted despite prior law enforcement and other efforts, and despite the NPRM’s detailed description of chronic problems relating to bait-andswitch tactics and hidden add-on and other charges. For example, in a recent enforcement action, filed after publication of the NPRM, the Commission charged several auto dealer locations in an auto dealership group with misrepresenting the price of vehicles. According to the complaint, the dealers advertised one price to lure consumers to their dealerships, then charged them hundreds to thousands of dollars more than the advertised price by tacking on bogus extra fees for inspection, reconditioning, preparation, and certification.101 The action also addressed the practice of dealers charging Black and Latino consumers these fees more often and in higher amounts.102 Multiple actions by partners since publication of the Commission’s NPRM have involved auto add-ons. The Commission and the State of Wisconsin alleged that a dealership group, its current and former owners, and its general manager deceived consumers by tacking on hundreds or even thousands of dollars for add-ons without those consumers’ authorization or by leading the consumers to believe the add-ons were mandatory, and doing so disproportionately more frequently with American Indian customers.103 The CFPB and the New York State Office of the Attorney General alleged that a subprime auto lender knew or recklessly disregarded that dealers were tricking borrowers into purchasing add-on products without their knowledge or consent and had incentivized such behavior.104 In addition, the Commonwealth of Massachusetts has brought two recent cases involving unfair add-on pricing practices.105 In one such case, Massachusetts emphasized the dynamics of auto transactions that frequently lead to deceptive and unfair practices, particularly with respect to add-ons, noting that add-on products ‘‘are often sprung on consumers in the final steps of completing a transaction’’ after ‘‘multiple rounds of negotiation on the price of a car and/or car financing.’’ 106 Efforts to combat deceptive and unfair practices in the motor vehicle industry since the NPRM have gone beyond enforcement actions. The CFPB announced that it uncovered several unlawful practices through supervisory examinations, including auto loan servicers charging for add-ons that provide no benefit to the consumer 107 and failing to ensure consumers received refunds for add-on products that no longer offered any benefits.108 In addition, the State of California enacted new legislation that regulates a particular type of add-on product—GAP agreements.109 A press release introducing the legislation cited concerns about unfair practices in the sale of GAP agreements, stating that this add-on has little value and is often targeted at consumers with lower incomes and subprime credit.110 California’s law requires several disclosures related to GAP agreements, including disclosures pertaining to their financed cost and informing consumers that such products are optional.111 The law also prohibits the sale of GAP agreements that will not actually cover consumers’ debt.112 Despite the array of actions by the Commission and its partners, unfairness and deception continue in the motor vehicle marketplace, including (1) deceptive or unfair sales and advertising tactics and (2) hidden charges, particularly with respect to add-on products or services. To address the harm these issues inflict on consumers and on law-abiding dealers, the Final Rule, in general:

• Prohibits dealers from making misrepresentations regarding material information, including about the cost of the vehicle, the financing terms, and the availability of rebates or discounts; • Requires dealers to disclose the offering price of the vehicle—its full cash price, provided that dealers may exclude required government charges; that optional add-ons are not required; the total of payments for the vehicle when making a representation about monthly payment; and that a discussed lower monthly payment will increase VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00012 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 263

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 113 Regarding the thousands of comments received, the Commission notes that many commenters raised similar concerns or addressed overlapping issues. To avoid repetition, the Commission has endeavored to respond to issues raised in similar comments together. Responses provided in any given section apply equally to comments addressing the same subject in the context of other sections. Moreover, throughout the SBP, the Commission discusses justifications for the Final Rule that are informed by its careful consideration of all comments received, even where that discussion is not linked to a particular comment.

114 The proposed authority provision in the NPRM omitted the second reference to ‘‘unfair’’ acts or practices with regard to the proposed recordkeeping requirements; the Final Rule consistently refers to both ‘‘unfair’’ and ‘‘deceptive’’ acts or practices together.

115 One industry group argued that the proposed rule violated the APA because it did not comply with the FTC’s rule requiring publication of an Advance Notice of Proposed Rulemaking (‘‘ANPR’’), 16 CFR 1.10. Section 1.10, however, like the rest of subpart B of part 1 of the Commission’s Rules of Practice, applies only to ‘‘proceedings for the promulgation of rules as provided in section 18(a)(1)(B) of the Federal Trade Commission Act.’’ 16 CFR 1.7. The ANPR requirement in section 1.10 implements section 18(b)(2) of the FTC Act, which requires an ANPR when the Commission promulgates rules under the procedures set forth in that section. In this case, the FTC is acting under statutory authority under section 1029(d) of the Dodd-Frank Act, see NPRM at 42031, which authorizes the Commission to promulgate rules using the APA’s informal notice-and-comment procedure, see 5 U.S.C. 553, notwithstanding the additional procedural requirements set forth in section 18. Accordingly, this rulemaking is governed by subpart C of part 1 of the Commission’s Rules of Practice, which ‘‘sets forth procedures for the promulgation of rules under authority other than section 18(a)(1)(B) of the FTC Act.’’ 16 CFR 1.21. Neither subpart C nor the APA requires publication of an ANPR.

This is consistent with Commission practice in prior notices to issue or amend regulations, including with the Made in USA Labeling Rule, the Children’s Online Privacy Protection Act Rule, and the Telemarketing Sales Rule. See, e.g., Fed. Trade Comm’n, Notice of Proposed Rulemaking, Made in USA Labeling Rule, 85 FR 43162 (July 16, 2020), https://www.govinfo.gov/content/pkg/FR-2020-07- 16/pdf/2020-13902.pdf (issuing original notice of proposed rulemaking that was not preceded by an advance notice of proposed rulemaking); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Children’s Online Privacy Protection Rule, 64 FR 22750 (Apr. 27, 1999), https://www.govinfo.gov/ content/pkg/FR-1999-04-27/pdf/99-10250.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Telemarketing Sales Rule, 60 FR 8313 (Feb. 14, 1995), https://www.govinfo.gov/content/ pkg/FR-1995-02-14/pdf/95-3537.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Telemarketing Sales Rule, 78 FR 41200 (July 19, 2013), https://www.govinfo.gov/content/pkg/FR- 2013-07-09/pdf/2013-12886.pdf (issuing notice of proposed rulemaking for rule amendment that was not preceded by an advance notice of proposed rulemaking); Fed. Trade Comm’n, Proposed Rule, Children’s Online Privacy Protection Rule, 76 FR 59804 (Sept. 27, 2011), https://www.govinfo.gov/ content/pkg/FR-2011-09-27/pdf/2011-24314.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Telemarketing Sales Rule, 74 FR 41988 (Aug. 19, 2009), https://www.govinfo.gov/content/ pkg/FR-2009-08-19/pdf/E9-19749.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Children’s Online Privacy Protection Rule, 70 FR 2580 (Jan. 14, 2005), https://www.govinfo.gov/ content/pkg/FR-2005-01-14/pdf/05-877.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Telemarketing Sales Rule, 69 FR 67287 (Nov. 17, 2004), https://www.govinfo.gov/content/ pkg/FR-2004-11-17/pdf/04-25470.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Telemarketing Sales Rule, 69 FR 7330 (Feb. 13, 2004), https://www.govinfo.gov/content/pkg/FR- 2004-02-13/pdf/04-3287.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Telemarketing Sales Rule, 67 FR 4492 (Jan. 30, 2002), https://www.govinfo.gov/content/pkg/FR- 2002-01-30/pdf/02-1998.pdf (same); Fed. Trade Comm’n, Notice of Proposed Rulemaking, Children’s Online Privacy Protection Rule, 66 FR 54963 (Oct. 31, 2001), https://www.govinfo.gov/ content/pkg/FR-2001-10-31/pdf/01-27390.pdf (same). This is also true of regulation amendments pursuant to the authority under which this Final Rule is promulgated—that which Congress granted to the Commission under section 1029 of the Dodd- Frank Act, 15 U.S.C. 5519, pertaining to motor vehicle dealers. See, e.g., Fed. Trade Comm’n, Notice of Proposed Rulemaking, Used Motor Vehicle Trade Regulation Rule, 77 FR 74746, 74748 (Dec. 17, 2012), https://www.govinfo.gov/content/ pkg/FR-2012-12-17/pdf/2012-29920.pdf (‘‘Because the Dodd-Frank Act authorized the Commission to use APA procedures for notice and public comment in issuing or amending rules with respect to motor vehicle dealers, the FTC will not use the procedures set forth in Section 18 of the FTC Act, 15 U.S.C. 57a, with respect to these proposed revisions to the Used Car Rule and the Used Car Buyers Guide. Accordingly, the Commission is publishing this Notice of Proposed Rulemaking pursuant to Section 553 of the APA.’’); see also Fed. Trade Comm’n, Notice of Proposed Rulemaking, Privacy of Consumer Financial Information Rule Under the Gramm-Leach-Bliley Act (‘‘Privacy Rule’’), 84 FR 13150 (Apr. 4, 2019), https://www.govinfo.gov/ content/pkg/FR-2019-04-04/pdf/2019-06039.pdf (issuing notice of proposed rulemaking for rule amendment that was not preceded by an advance notice of proposed rulemaking). This same commenter argued the FTC had not complied with the ‘‘Principles of Regulation’’ enumerated in section 1(b) of Executive Order 12866. See Comment of Nat’l Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–8368 at 34–36 & n.123; E.O. 12866 3(b) (defining ‘‘Agency’’ to mean an authority of the United States ‘‘other than those considered to be independent regulatory agencies’’). This provision of the Executive Order does not apply to independent agencies such as the FTC. Regardless, the Commission did take into account the principles set forth in section 1(b), as is evident throughout the NPRM. See, e.g., NPRM at 42015– 17 (identifying problems in the marketplace); id. at 42028–42031 (soliciting comments on alternative approaches); id. at 42036–42044 (assessing costs and benefits).

The same commenter also argued that the Commission’s denial of its request to extend the comment period prejudiced the commenter’s ability to collect and provide data pertaining to the proposed rule and was inconsistent with the Commission’s grant of extensions in other rulemakings. As described in its letter, the Commission also received requests opposing an extension of the comment period. See Letter, Fed. Trade Comm’n, ‘‘Duration of the Public Comment Period in Matter No. P204800’’ (Aug. 23, 2022), https://www.ftc.gov/system/files/ftc_gov/pdf/ Matter%20No.%20204800%20-%20Letter% 20re%20Extension%20for%20publication.pdf. In the letter, the Commission noted its ongoing engagement with stakeholders on issues relating to the sale, financing, and lease of motor vehicles, since before its 2011 Federal Register notice inviting stakeholder feedback on these issues and continuing since that time. See Fed. Trade Comm’n, Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, 76 FR 14,014 (Mar. 15, 2011), https://www.federalregister.gov/ documents/2011/03/15/2011-5873/publicroundtables-protecting-consumers-in-the-sale-andleasing-of-motor-vehicles. The Commission determined that a sixty-day comment period, along with an additional twenty days following the public announcement and release of the NPRM and prior to its publication in the Federal Register, provided meaningful opportunity to comment. See also Steven J. Balla, ‘‘Public Commenting on Federal Agency Regulations: Research on Current Practices Continued the total amount the consumer will pay, if true;

• Prohibits dealers from charging for add-on products or services that provide no benefit to the consumer; and • Requires dealers to obtain express, informed consent from the consumer for any charge.

As discussed in the section-by section analysis in SBP III and in response to comments, the Commission is declining to finalize certain provisions proposed in the NPRM, including the provision that dealers must disclose a list of prices for all optional add-on products or services, and the provision that dealers must obtain certain signed declinations from consumers prior to charging for optional add-on products or services. The Commission also is finalizing the defined terms ‘‘Covered Motor Vehicle’’ and ‘‘Covered Motor Vehicle Dealer’’ to reflect edits to narrow the scope of these definitions compared to the scope of the terms ‘‘Motor Vehicle’’ and ‘‘Motor Vehicle Dealer’’ in the NPRM. III. Section-by-Section Analysis The following discussion provides a section-by-section analysis that states the provisions proposed in the NPRM, and discusses the comments received, the Commission’s responses to comments, and the provisions adopted in the Final Rule.113 A. § 463.1: Authority Section 463.1 states that the Final Rule is promulgated pursuant to section 1029 of the Dodd-Frank Act, and that it is an unfair or deceptive act or practice within the meaning of section 5(a)(1) of the FTC Act to violate, directly or indirectly, any provision of the Final Rule, including the recordkeeping requirements, which are necessary to prevent such unfair or deceptive acts or practices and to enforce this Rule.114 The prohibition against violating any applicable provision ‘‘directly or indirectly’’ applies to each section of part 463. As discussed in SBP I.A, section 1029 authorizes the FTC to prescribe rules under Sections 5 and 18(a)(1)(B) of the FTC Act with respect to motor vehicle dealers predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both.115 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00013 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 264

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations and Recommendations to the Administrative Conference of the United States’’ App. A (2011), https://www.acus.gov/sites/default/files/ documents/Consolidated-Reports-%2B- Memoranda.pdf (reporting data from a pool of 703 comment periods associated with actions by dozens of Federal agencies, and finding that the average duration of comment periods for proposed agency actions was 38.7 days, and 45.1 days for actions that are economically significant). 116 15 U.S.C. 57a(a)(1)(B) (the Commission ‘‘may include requirements prescribed for the purpose of preventing’’ unfair or deceptive acts or practices). 117 §§ 463.3(b), 463.4(c), 463.5(a). 118 Individual commenter, Doc. No. FTC–2022– 0046–7445 at 10–11.

119 § 463.3(b) (emphasis added). 120 See §§ 463.2(k) (defining Offering Price), 463.4(a) (requiring disclosure of Offering Price); see also § 463.3(p) (prohibiting misrepresentations regarding the disclosures required by the Final Rule).

121 See NPRM at 42044, 42046 (proposed §§ 463.2(b), 463.4(b), 463.5(b)). The Final Rule defines with specificity certain unfair or deceptive acts or practices; the Final Rule provisions are also ‘‘prescribed for the purpose of preventing such acts or practices.’’ 116 B. § 463.2: Definitions 1. Overview The proposed rule included definitions for the following terms: ‘‘Add-on’’ or ‘‘Add-on Product(s) or Service(s)’’; ‘‘Add-on List’’; ‘‘Cash Price without Optional Add-ons’’; ‘‘Clearly and Conspicuously’’; ‘‘Dealer’’ or ‘‘Motor Vehicle Dealer’’; ‘‘Express, Informed Consent’’; ‘‘GAP Agreement’’; ‘‘Government Charges’’; ‘‘Material’’ or ‘‘Materially’’; ‘‘Motor Vehicle’’; and ‘‘Offering Price.’’ In the definition-bydefinition analysis in SBP III.B.2, the Commission discusses each definition proposed in the NPRM, relevant comments that are not otherwise addressed in the discussion of the corresponding substantive provisions of the Final Rule, and the definition the Commission is finalizing. 2. Definition-by-Definition Analysis (a) Add-On or Add-On Product(s) or Service(s) The proposed rule defined ‘‘Add-on’’ or ‘‘Add-on Product(s) or Service(s)’’ as ‘‘any product(s) or service(s) not provided to the consumer or installed on the vehicle by the motor vehicle manufacturer and for which the Motor Vehicle Dealer, directly or indirectly, charges a consumer in connection with a vehicle sale, lease, or financing transaction.’’ This term appeared in the following definitions and substantive provisions of the rule proposal: the definitions of ‘‘Add-on List’’ and ‘‘Cash Price without Optional Add-ons’’; the Prohibited Misrepresentations provision at proposed § 463.3(b); the add-on list disclosure provision at proposed § 463.4(b); the requirement to disclose that add-ons are not required at proposed § 463.4(c); the prohibition against charging for add-ons that provide the consumer no benefit at proposed § 463.5(a); and the proposed provision relating to undisclosed or unselected add-ons at § 463.5(b). As discussed in the following paragraphs, in response to stakeholder comments, the Commission declines to finalize certain of these provisions; in the Final Rule, this term appears in paragraph (a) of the Prohibited Misrepresentations section (§ 463.3); the Disclosure Requirements provision in paragraph (c) of § 463.4; and the provision in § 463.5(a) titled ‘‘Dealer Charges for Add-ons and Other Items’’ and subtitled ‘‘Add-ons that provide no benefit.’’ For the following reasons, the Commission adopts the definition of ‘‘Add-on’’ or ‘‘Add-on Product(s) or Service(s)’’ largely as proposed, with conforming modifications to reflect changes to the defined terms ‘‘‘Covered Motor Vehicle’ or ‘Vehicle’’’ and ‘‘‘Covered Motor Vehicle Dealer’ or ‘‘Dealer’’’ as described in more detail in the discussion of § 463.2(e) and (f), in SBP III.B.2(e) and (f). The Commission received several comments relating to the scope of its proposed definition for ‘‘Add-on’’ or ‘‘Add-on Product(s) or Service(s).’’ Industry association and other commenters recommended that the Commission broaden the definition to include manufacturer-provided products or services, expressing concern that exclusion of such products or services would put other companies that provide such items at a competitive disadvantage. Products or services provided by manufacturers, however, are already covered by several provisions of the Final Rule. Under the substantive provisions the Commission is finalizing, dealers are prohibited from making misrepresentations regarding material information, including about the ‘‘costs or terms of purchasing, financing, or leasing a Vehicle’’ (§ 463.3(a)); must disclose the vehicle’s true ‘‘Offering Price,’’ which includes any amounts dealers charge for items already installed or provided by the manufacturer (§§ 463.4(a) and 463.2(k)); and are required to obtain ‘‘Express, Informed Consent’’ for charges for any item (§§ 463.5(c) and 463.2(g)). The additional substantive add-on-specific provisions 117 address harms associated with products or services not provided to the consumer or installed on the vehicle by the motor vehicle manufacturer. Commenters did not provide evidence that the proposed provisions covering manufacturerprovided products or services would be insufficient to address consumer harm. Accordingly, the Commission has determined not to include manufacturer-provided products or services within this defined term. The Commission will continue to monitor this issue to determine whether additional action is warranted. One individual commenter expressed concern that, under the Commission’s proposed definition, dealers could raise the price of a vehicle by advertising additional products or services, such as ‘‘free lifetime benefits’’ with the vehicle, and that dealers could mislead consumers by charging more for the vehicle based on a supposedly ‘‘free’’ add-on.118 The Commission notes that the Rule the Commission is finalizing contains several provisions relating to this concern. For example, dealers are prohibited from making misrepresentations under § 463.3, including misrepresentations regarding ‘‘costs, limitation, benefit, or any other aspect’’ of add-ons.119 Furthermore, dealers are required to disclose a vehicle’s offering price, which must include charges for required add-ons; this disclosure will allow consumers to know the true price of the vehicle and comparison shop before selecting and visiting a particular dealership.120 Several dealership association commenters expressed concern that the proposed definition was too broad, contending that it might apply to hundreds of items and include fees, such as a processing or document fee, that a dealer charges a consumer. As discussed in SBP III.B.2(b), III.D.2(b), and III.E.2(b), upon careful review of comments, including comments regarding the breadth of this requirement, the Commission has determined not to finalize the provision that would have required listing all optional add-ons—the ‘‘Add-on List’’ definition and the associated requirement that dealers disclose such a list—as well as proposed § 463.5(b) relating to undisclosed or unselected add-ons.121 The remaining substantive provisions that use the term ‘‘Add-ons’’ prohibit misrepresentations (§ 463.3(b)); require dealers to disclose, if true, that add-ons are not required (§ 463.4(c)); and prohibit charges for add-ons that provide the consumer no benefit (§ 463.5(a)). The law already prohibits misrepresentations, regardless of the product or service at issue; dealers that offer consumers additional products or services are already required to ask VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00014 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 265

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 122 Comment of Serv. Cont. Indus. Council, Guaranteed Asset Prot. All., & Motor Vehicle Prot. Prods. Ass’n, Doc. No. FTC–2022–0046–8113 at 13– 14.

123 Id. at 13.

124 See, e.g., English v. Gen. Elec. Co., 496 U.S. 72, 79 (1990).

125 See 15 U.S.C. 1012(b). 126 See Union Labor Life Ins. Co. v. Pireno, 458 U.S. 119, 129 (1982) (setting forth test for whether an activity constitutes the ‘‘business of insurance’’); Humana Inc. v. Forsyth, 525 U.S. 299, 307–08 (1999) (establishing criteria for whether a Federal law operates to ‘‘invalidate, impair, or supersede’’ State law).

127 The Supreme Court has refused to interpret the McCarran Ferguson Act to invalidate Federal law when applied to remedy a misrepresentation and undo the harm caused by alleged deception. See SEC v. Nat’l Sec., Inc., 393 U.S. 453, 462 (1969). Moreover, lower courts have rejected precisely the concern raised by the commenter about credit life insurance. See Fed. Trade Comm’n. v. Dixie Fin. Co., 695 F.2d 926, 930 (5th Cir. 1983) (McCarran Ferguson Act does not preclude FTC investigation of ‘‘whether the sale of insurance is a precondition to the arrangement of credit’’); Fed. Trade Comm’n v. Mfrs. Hanover Consumer Servs., Inc., 567 F. Supp. 992, 94 (E.D. Pa. 1983) (same). consumers if they want such products, rather than suggesting that such products or services are mandatory, when they are not; and any hardship associated with refraining from charging for products or services that provide consumers no benefits are outweighed by the harms to consumers and competition from permitting this practice, as explained in the analysis of § 463.5(a).

Commenters including an industry association suggested limiting the definition to products or services sold at the ‘‘point of vehicle purchase’’ to clarify that indirect charges, such as the inclusion of a one-year subscription to a satellite radio service, need not be separately itemized.122 The industry association commenter suggested that, as proposed, the definition would include charges for which dealers and consumers ‘‘would otherwise not account.’’ 123 The Commission has determined not to finalize the add-on list and form requirements in proposed §§ 463.4(b) and 463.5(b). For the provisions being finalized, excluding subscription charges, or including only items added to the vehicle at the ‘‘point of vehicle purchase,’’ would narrow the definition of ‘‘Add-on’’ and the corresponding requirements in a manner that would allow for deceptive or unfair practices, including by allowing dealers to represent a price that is not the offering price, or to deceptively state that add-ons are required. In the example provided by the commenter, if the satellite radio subscription service is mandatory, it needs to be included in the offering price of the vehicle, as required by § 463.4(a) of the Final Rule; if it is not mandatory, the dealer needs to disclose, when making any representations about the service, that it is not required under § 463.4(c). Further, regardless of whether such a product or service is mandatory or optional, dealers must follow other aspects of the Final Rule, including by not making any misrepresentations about the subscription under § 463.3 and by obtaining the express, informed consent of the consumer for the associated charges under § 463.5(c). Another industry association commenter contended that add-ons sold in the marine industry are typically different than those offered in the context of automobile sales and described in the NPRM. While all motor vehicle dealers must refrain from engaging in deceptive or unfair conduct relating to add-ons, the Commission is excluding recreational boats and marine equipment from the Final Rule’s definition of ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle,’ ’’ as discussed in additional detail in the definition-by-definition analysis of § 463.2(e) in SBP III.B.2(e). An industry association commenter and comments from a number of dealership associations noted that certain State laws already regulate the sale of add-ons, including, for example, laws in many States that regulate vehicle sales contracts or deceptive sales practices generally or that regulate insurance products. To the extent that the Final Rule’s add-on provisions may duplicate State law, commenters have provided no evidence that any such duplication in the provisions that incorporate this defined term—which prohibit misrepresentations, require disclosures in the event add-ons are not required, and prohibit charges for addons from which the consumer would not benefit—will harm consumers or competition. Moreover, the Final Rule provides additional remedies that will benefit consumers who encounter conduct that is already illegal under State or Federal law, including by adding a mechanism for the Commission to redress consumers injured by a dealer’s violation of the rule, and will assist law-abiding dealers that presently lose business to competitors that act unlawfully. Under the Final Rule, State laws may provide more or less specific requirements as long as such requirements are not inconsistent with part 463, as set forth at § 463.9, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency.124 A few dealership association commenters expressed concern that the proposed definition of ‘‘Add-on Products or Services’’ would include insurance-related products, such as credit life and credit disability insurance, and as such, could implicate the McCarran-Ferguson Act’s reversepreemption of certain Federal laws that ‘‘invalidate, impair, or supersede’’ State laws enacted ‘‘for the purpose of regulating the business of insurance.’’ 125 Commenters have provided no evidence that the Rule will invalidate, impair, or supersede State laws enacted for the purpose of regulating the business of insurance.126 To the contrary, the Final Rule addresses deceptive or unfair conduct— it prohibits dealers, inter alia, from making misrepresentations regarding material information about add-ons, from failing to disclose when add-ons are not required, and from charging for add-ons from which the consumer would not benefit. Nor has the Commission been presented with evidence that the Rule’s other substantive provisions (prohibiting misrepresentations; requiring disclosures of a vehicle’s offering price and about total of payments; and requiring consumers’ express, informed consent before charging them) invalidate, impair, or supersede State laws enacted for the purpose of regulating insurance.127 A number of industry and dealership association commenters contended that, as proposed, this definition may extend to products or services that are provided by the manufacturer but that are installed by a distributor of motor vehicles, or alternatively, by the dealer, at the instruction of the manufacturer. Relatedly, a State governmental association commenter expressed concern that the proposed definition could create confusion with regard to the sale of used vehicles, where a prior owner of a vehicle may have added a product to the vehicle. The commenter contended that a motor vehicle dealer selling the used vehicle may be unaware of the added product, and further, that listing any such items may confuse buyers.

To the extent the commenters’ concerns stem from the proposed provisions related to add-on lists and proposed § 463.5(b)’s provisions related to separate disclosures, the Commission is not finalizing those provisions. Under the provisions being finalized, if a product is provided to the dealer by the manufacturer or another entity, and a consumer chooses to have the product VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00015 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 266

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 128 The language requirements, as they relate to obtaining express, informed consent, are further explained in the discussion of § 463.5(c) in SBP III.E.2(c).

installed and pay for it, the dealer may install it and charge for it, as long as the dealer complies with the provisions of the Final Rule, including by disclosing that the product is not required and by obtaining the consumer’s express, informed consent for the charge. If the manufacturer requires the dealer to install the product or if the dealer chooses to install the product, and the dealer requires any consumer to pay charges for it, the amount of the charge must be included in the vehicle’s offering price, and the dealer must comply with other aspects of the Final Rule, including the express, informed consent requirement. Relatedly, regarding used vehicles, if a prior owner of such a vehicle installed an add-on, and the dealer that subsequently sells such a vehicle requires any consumer to pay charges for the add-on, the amount of those charges must be included in the vehicle’s offering price and the dealer must comply with other aspects of the Final Rule, including the express, informed consent requirement at § 463.5(c). If, alternatively, the dealer does not require any consumers to pay for the pre-installed add-on, then the dealer does not have to add that amount to the vehicle’s offering price, and there is no charge for that add-on for which the dealer must obtain express, informed consent. Thus, the definition of ‘‘Add-on’’ and the Rule requirements being finalized address deceptive or unfair price and add-on disclosures and hidden charges without requiring dealers to list or itemize charges that they do not impose on consumers. For the reasons explained in this section, the Commission is finalizing the definition of ‘‘Add-on’’ or ‘‘Add-on Product(s) or Service(s)’’ largely as proposed, with conforming modifications to reflect changes to the defined terms ‘‘‘Covered Motor Vehicle’ or ‘Vehicle’’’ and ‘‘‘Covered Motor Vehicle Dealer’ or ‘Dealer’’’ as described in more detail in the discussion of § 463.2(e) and (f), in SBP III.B.2(e) and (f).

(b) Add-On List The NPRM proposed defining the term ‘‘Add-on List,’’ which appeared in the associated Add-on List disclosure provision at proposed § 463.4(b), as well as in the recordkeeping provision at proposed § 463.6(a)(2). Based on the following, the Commission has determined not to include this definition in its Final Rule. Several commenters supported the substantive add-on list proposal and its associated definition, and commenters including consumer advocacy organizations urged the Commission to finalize additional related restrictions or disclosures, such as requiring add-on prices to be fixed and non-negotiable, or requiring a distinct add-on list for each vehicle sold. Other commenters, including dealership associations, raised concerns that, as proposed, the add-on list definition could impose significant economic burdens on dealerships for a disclosure that, in some circumstances, might be too voluminous to be optimally meaningful to consumers, or permit price ranges that could be too broad to prevent abuses and effectively inform consumers.

After careful consideration, and in light of the concerns raised by commenters, the Commission has determined not to include the add-on list disclosure provision at proposed § 463.4(b) or the recordkeeping provision at proposed § 463.6(a)(2) in its Final Rule, and therefore will not include a definition of the term ‘‘Addon List’’ in its Final Rule. Here, as elsewhere, the Commission remains committed to promoting fair, nondeceptive, and competitive markets for consumer products and services; it will continue to monitor the marketplace for add-on-related acts or practices that are unfair or deceptive, and will evaluate whether to propose additional measures pertaining to such products and services.

(c) Cash Price Without Optional Add- Ons The NPRM proposed defining the term ‘‘Cash Price without Optional Addons,’’ which appeared in the proposed provision addressing undisclosed or unselected add-ons at § 463.5(b). Based on the following, the Commission is declining to finalize this definition. A number of commenters favored the proposed provision and definition, and several, including consumer advocacy organizations, urged the Commission to include additional requirements, such as requiring the proposed disclosure documents associated with this proposed definition to be available in different languages, while others, including a dealership association, raised concerns that the definition and relevant provision were burdensome or confusing for dealers.

As explained in additional detail in SBP III.E.2(b) with respect to § 463.5(b), in light of commenter concerns that the proposed provision using this term would increase costs for legitimate dealers and add to the time and paperwork for consumers in an already lengthy, paperwork-heavy transaction, the Commission has elected not to include a Cash Price without Optional Add-ons disclosure requirement in its Final Rule. Thus, after careful consideration, and in light of the concerns raised by commenters, the Commission has determined not to include a definition of ‘‘Cash Price without Optional Add-ons’’ in its Final Rule.

(d) Clearly and Conspicuously The proposed rule defined the term ‘‘Clearly and Conspicuously’’ as ‘‘in a manner that is difficult to miss (i.e., easily noticeable) and easily understandable,’’ including in all of seven enumerated ways, listing proposed requirements for ‘‘any communication that is solely visual or solely audible,’’ ‘‘[a] visual disclosure,’’ ‘‘[a]n audible disclosure,’’ and ‘‘any communication using an interactive electronic medium,’’ and providing, inter alia, that such disclosures ‘‘must use diction and syntax understandable to ordinary consumers and must appear in each language in which the representation that requires the disclosure appears’’ and ‘‘must not be contradicted or mitigated by, or inconsistent with, anything else in the communication.’’ Based on the following, the Commission is finalizing this definition largely as proposed, with a modification to clarify that the definition applies whether the term appears as an adjective or an adverb, by adding the parentheses in the following manner to the defined term: ‘‘Clear(ly) and Conspicuous(ly).’’ Some consumer advocacy organization commenters favored the Commission’s proposed definition while also suggesting that the Commission include a provision requiring translation of any deal consummating documents, including buyer’s orders and retail installment sales contracts, into the language in which the negotiations were conducted. This issue, however, is addressed by § 463.5(c) of the Rule, which requires express, informed consent for each item charged.128 As explained in additional detail in the paragraph-by-paragraph analysis of § 463.5(c) in SBP III.E.2(c), if a deal-consummating document is provided in a language that the consumer does not understand, and the document’s contents are not otherwise clearly understood by the consumer, then the consumer is in no position to give unambiguous assent to the charges described therein. The Commission therefore has determined not to add VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00016 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 267

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 129 16 CFR 14.9 is an enforcement policy statement that provides information to advertisers about clear and conspicuous disclosures in foreign language advertisings and sales materials, including ensuring the language of the disclosure matches the language in the publication. See 16 CFR 14.9. 130 See Appear (defs. 1b, 4, 6), Merriam- Webster.com Dictionary, https://www.merriamwebster.com/dictionary/appear (last visited Dec. 5, 2023); see also Order ¶¶ 2–3, Asbury Auto. Grp., Inc., No. C–4606 (F.T.C. Mar. 22, 2017) (identical usage in definition provision); Order ¶ 2, Lithia Motors, Inc., No. C–4597 (F.T.C. Dec. 8, 2016) (same); Order ¶¶ 2–3, Jim Koons Mgmt. Co., No. C– 4598 (F.T.C. Dec. 8, 2016) (same). 131 17 CFR 162.2.

such a provision to its ‘‘Clear(ly) and Conspicuous(ly)’’ definition. However, the Commission will continue to monitor the marketplace and determine whether further language requirements or additional measures are warranted to address deceptive or unfair practices— particularly those that target or otherwise disproportionately impact language-minority communities. Commenters, including consumer advocacy organizations, expressed concern that proposed § 463.2(d)(5) may be read to apply only to certain disclosures with triggering representations and only to disclosures that are in writing. These commenters also requested that the Commission incorporate into its Final Rule the FTC’s policy statement regarding foreign language advertising and sales materials, which is separately codified at 16 CFR 14.9.129 In response, the Commission notes that to be clear and conspicuous, the disclosure must be ‘‘easily understandable,’’ as stated in the definition. If a disclosure is being made in a language the consumer does not understand, it does not meet this requirement. Further, the disclosures highlighted by the commenters are indeed subject to the language requirements of § 463.2(d)(5), which requires that disclosures ‘‘appear in each language in which the representation that requires the disclosure appears.’’ With regard to the offering price disclosure in § 463.4(a)(1), the applicable ‘‘representation that requires the disclosure’’ is the ‘‘advertisement that references . . . a specific Vehicle’’; thus, for example, if an advertisement that references a specific vehicle is in Spanish, the offering price disclosure must also be in Spanish. Similarly, in § 463.4(a)(2), the applicable representation that requires the disclosure is an ‘‘advertisement that represents . . . any monetary amount or financing term for any Vehicle.’’ In § 463.4(a)(3), the applicable representation is ‘‘any communication . . . that includes a reference . . . regarding a specific Vehicle, or any monetary amount or financing term for any Vehicle.’’ In § 463.4(c) and (d), ‘‘any representation’’ regarding an add-on product or service or a monthly payment for any vehicle, respectively, triggers the language requirement of § 463.2(d)(5). The monthly payments comparison disclosure in § 463.4(e) is required when there is a ‘‘comparison between payment options . . . that includes discussion of a lower monthly payment.’’ Thus, the language requirements in § 463.2(d)(5) apply. In response to this concern regarding the applicability of § 463.2(d)(5) to disclosures that are not in writing, the Commission notes that its use of the word ‘‘appear’’ in § 463.2(d)(5) incorporates common meanings, such as ‘‘to show up,’’ ‘‘to come into existence,’’ or ‘‘to become evident or manifest,’’ which cause this provision to apply whether the representation requiring the disclosure appears visually, orally, or otherwise.130 Where the Commission instead intended a provision to be limited to a visual disclosure, as in § 463.2(d)(2), the Rule states so explicitly.

In response to the request that the Commission incorporate into this Rule its policy statement regarding foreign language advertising and sales materials, separately codified at 16 CFR 14.9, the Commission emphasizes that the enforcement statement sets out what is already impermissible under current law and is consistent with the requirements the Commission is finalizing. To the extent dealers take actions that are inconsistent with Commission statements about such law, they are risking enforcement proceedings by the Commission or others. Accordingly, the Commission has determined not to add to the Rule further requirements regarding foreign language advertising. The Commission will continue to monitor the market to determine whether further action is warranted.

Industry association commenters raised concerns about how the Commission’s proposed definition interacts with other Federal laws, such as Regulations Z and M, which implement the Truth in Lending Act and the Consumer Leasing Act, respectively, and contended that it conflicts with a clear and conspicuous definition in Commodity Futures Trading Commission regulations.131 Industry and dealership association commenters contended that State advertising standards already address what constitutes ‘‘clear and conspicuous’’ advertising and provide guidance on disclosures, such that the FTC’s proposal will cause confusion or possible conflict with State law. The Commission’s definition of ‘‘Clear(ly) and Conspicuous(ly)’’ is not inconsistent with the existing Federal legal requirements raised by these commenters. Dealers can comply with these laws to the extent they apply as well as with the requirements that follow from the Commission’s definition. Regarding State law, commenters did not provide examples of actual conflicts. Further, to the extent there is truly an inconsistency between the operation of the Commission’s definition and any State law, the Commission notes that the definition is based on decades of Commission experience policing deceptive and unfair conduct; addresses harmful practices including those related to hidden disclosures and charges; and that § 463.9 of the Final Rule sets out the Rule’s relation to State laws. Other industry association commenters also contended that the proposed definition of ‘‘Clearly and Conspicuously’’ would be overly broad and challenging for compliance, but did not explain why or suggest alternative language. In addition, some dealership association commenters requested more guidance to understand the definition. The Commission’s definition spells out, in seven subparts, what clear and conspicuous means, using simple terms that provide additional information about how dealers can make a disclosure in a manner that is easily understandable and easily noticeable to the consumer. The definition elaborates basic, common-sense principles, including that visual disclosures be in a size that consumers will easily notice and that audible disclosures be in a volume, speed, and cadence such that consumers will easily hear it. Thus, for example, disclosures in an illegible font, or that consumers cannot hear, are not clear and conspicuous. The Commission also notes that it did not mandate specific fonts, volumes, or other prescriptive measures. Thus, dealers have the flexibility to determine the best way to meet the definition’s requirements for their consumers under the circumstances.

A dealership association commenter contended that the proposed definition does not include a reasonableness standard and may be interpreted as prohibiting any limitations and exclusions, given the requirement in proposed § 462.3(d)(7) that a disclosure must not be contradicted or mitigated by or inconsistent with anything else in the communication. The commenter further asked whether a statement such as ‘‘with approved credit’’ would VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00017 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 268

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 132 Comment of Ohio Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–6657 at 4. 133 See FTC Policy Statement on Deception, supra note 42, at 2–5.

134 Complaint ¶¶ 5–7, Progressive Chevrolet Co., No. C–4578 (F.T.C. June 13, 2016) (alleging ads touting attractive terms deceptively failed to disclose high credit score requirement). 135 Removatron Int’l Corp. v. Fed. Trade Comm’n, 884 F.2d 1489, 1496–97 (1st Cir. 1989); see also Fed. Trade Comm’n v. Brown & Williamson Tobacco Corp., 778 F.2d 35, 42–43 (D.C. Cir. 1985) (finding that a disclosure in virtually illegible form, placed in an inconspicuous corner of Barclay advertisements, did not eliminate deception); see Fed. Trade Comm’n v. Cap. Choice Consumer Credit, Inc., 2003 U.S. Dist. LEXIS 29086, at *5 (S.D. Fla. June 2, 2003) (finding that, where advertisements promised a general purpose credit card, such as VISA or MasterCard, ‘‘fine print on reverse side’’ of ad clarifying that the credit card was a ‘‘merchandise card and not a major bank card’’ was inadequate to modify net impression); Fed. Trade Comm’n v. Cyberspace.com LLC, 453 F.3d 1196, 1200 (9th Cir. 2006) (rejecting defendant’s argument that truthful fine print notices on reverse side of checks, invoices, and marketing inserts cured deception that check/invoice was a refund rather than offer for services); Fed. Trade Comm’n v. Alcoholism Cure Corp., No. 3:10–cv– 266–J–34JBT, 2011 WL 13137951, at * 51 (M.D. Fla. Sept. 16, 2011) (finding that ‘‘not MD’’ disclaimers were inadequate to dispel net impression regarding professional qualifications of defendant and other employees as advertised); Fed. Trade Comm’n v. Wash. Data Res., 856 F. Supp. 2d 1247, 1274–75 (M.D. Fla. 2012) (rejecting defendants’ argument that retainer agreement contained sufficient disclaimer to dispel a misrepresentation about whether a home loan was guaranteed). 136 The Commission has included such requirements elsewhere. See, e.g., Order ¶ 6, United States v. Sunkey Publ’g, Inc., No: 3:18–cv–1444– HNJ (N.D. Ala. Sept. 6, 2018). 137 See. e.g., Palmer v. Champion Mortg., 465 F.3d 24, 28 (1st Cir. 2006) (applying an objective standard in evaluating Truth in Lending Act claim regarding clear and conspicuous disclosure); Smith v. Check-N-Go of Ill., Inc., 200 F.3d 511, 515 (7th Cir. 1999) (same); Zamarippa v. Cy’s Car Sales, Inc., 674 F.2d 877, 879 (11th Cir. 1982) (same); Bustamante v. First Fed. Sav. & Loan Ass’n, 619 F.2d 360, 364 (5th Cir. 1980) (same); see also Herrera v. First N. Sav. & Loan Ass’n, 805 F.2d 896, 900 (10th Cir. 1986) (resolving question of clear and conspicuous disclosure under Truth in Lending Act as a legal, rather than factual, matter); Dixey v. Idaho First Nat’l Bank, 677 F.2d 749 (9th Cir. 1982) (same).

138 Complaint ¶¶ 6–14, Jim Burke Auto., Inc., No. C–4523 (F.T.C. May 4, 2015); Complaint ¶¶ 6, 9, TT of Longwood, Inc., No. C–4531 (F.T.C. July 2, 2015); Complaint ¶ 13, City Nissan Inc., No. C–4524 (F.T.C. May 4, 2015); Complaint ¶¶ 17–19, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20– cv–03945 (S.D.N.Y. May 21, 2020); Complaint ¶¶ 4–9, 12–15, 18–20, Billion Auto, Inc., No. C– 4356 (F.T.C. May 1, 2012) (alleging false ads promising to pay off consumers’ existing motor vehicle debt and failing to disclose legally required financing and leasing terms); see also Complaint ¶¶ 57–60, Fed. Trade Comm’n v. Stewart Fin. Co. Holdings, Inc., No. 1:03–CV–2648 (N.D. Ga. Sept. 4, 2003) (alleging violations for failure to include the cost of required add-on products in the finance charge and annual percentage rate disclosed to consumers).

139 See FTC Policy Statement on Deception, supra note 42, at 2–5 (describing application of reasonable consumer standard).

140 See, e.g., Decision and Order, JS Autoworld, Inc., No. C–4535 (F.T.C. Aug. 13, 2015); Decision and Order, Nat’l Payment Network, Inc., No. C– 4521 (F.T.C. May 4, 2015); Decision and Order, Matt Blatt Inc., No. C–4532 (F.T.C. July 2, 2015); Decision and Order, Ganley Ford West, Inc., No. C– 4428 (F.T.C. Jan. 28, 2014). impermissibly mitigate an offer of low financing under this proposed definition.132 The Commission responds as follows. The standard is an objective one, evaluated from the perspective of a reasonable consumer.133 The definition does not prohibit all advertising that contains limitations and exclusions, but it does provide that if dealers are advertising offers that are limited in some way, they may not misrepresent such offers. Thus, if a dealer presents consumers with an unqualified representation of low financing terms, those terms must be available to typical consumers. Alternatively, a dealer may offer low financing terms to consumers with particular credit characteristics if that requirement is presented in a manner that does not deceive reasonable consumers. For example, a dealer may offer ‘‘0% annual percentage rate (APR) for consumers with a credit score above 800.’’ By contrast, it would be deceptive if the dealer offered ‘‘0% APR,’’ and then separately disclosed in fine print that such terms are only available to consumers with a credit score above 800, because the qualifying disclosure is inconsistent with an offer of ‘‘0% APR’’ that contained no limitations and thus indicated that 0% APR is available to the typical consumer regardless of credit score.134 Further, the Commission notes that to qualify as clear and conspicuous, ‘‘disclaimers or qualifications in any particular ad are not adequate to avoid liability unless they are sufficiently prominent and unambiguous to change the apparent meaning of the claims and to leave an accurate impression. Anything less is only likely to cause confusion by creating contradictory double meanings.’’ 135 Lastly, another dealership association commenter asked how the proposed definition translates to visual, audible, and electronic media disclosures and expressed concern about subjectivity, characterizing the terms ‘‘easily’’ understood and ‘‘unavoidable’’ within the proposed definition as subjective and open to different interpretations, particularly in the context of websites and internet promotions. Here, the Commission declines to mandate more prescriptive language regarding, for example, font sizes, what volumes are to be used, and where exactly the language should appear on a website, such as on an overlay with mandated color, size, and location.136 As courts 137 have recognized, whether a disclosure is clear and conspicuous is an objective standard rather than a subjective one. While more prescriptive language would provide additional objective criteria, the Commission is concerned such language might constrain dealers from determining the best way to meet the definition’s requirements for their consumers under the circumstances involved, and might require dealers that are already making clear and conspicuous disclosures to change their existing disclosure materials. The Commission reiterates that the definition of ‘‘Clear(ly) and Conspicuous(ly)’’ elaborates basic, common-sense principles, such as requiring visual disclosures in a size consumers can see and audible disclosures in a volume they can hear. Regarding the requirement that internet disclosures be unavoidable, this language requires evaluating an objective standard—whether or not consumers could have avoided the disclosure. In addition, the disclosure must be easily noticeable and easily understandable, as set forth expressly in the definition. Disclosures that do not meet this standard include those that are buried in other text, including as illustrated by many FTC actions against dealers.138 Regarding the requirement that disclosures be ‘‘easily’’ noticeable and understandable, the standard is also an objective one, evaluated from the perspective of a reasonable consumer. Determining how reasonable consumers are likely to respond may be resolved on the basis of the advertisement, context, or disclosure itself, or based on extrinsic evidence, such as consumer complaints.139 To this end, as noted previously, the definition enumerates in seven subparts the meaning of clear and conspicuous using simple terms that provide additional guidance on how dealers may make disclosures that are easily understandable and easily noticeable to the consumer. After carefully considering the comments, the Commission adopts § 463.2(d) with a modification to clarify, through the addition of parentheses— ‘‘Clear(ly) and Conspicuous(ly)’’—that the definition applies whether the term is used as an adjective or adverb. Consistent with the Commission’s experience addressing unfair or deceptive conduct, the Commission has defined the term ‘‘Clear(ly) and Conspicuous(ly)’’ to include disclosures that are easily understandable and easily noticeable, while also providing dealers with additional information on how to meet those requirements.140 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00018 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 269

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 141 According to the National Highway Traffic Safety Administration, ‘‘Public road means any road under the jurisdiction of and maintained by a public authority and open to public travel.’’ 23 CFR 1300.3.

142 Comment of Structured Fin. Ass’n, Doc. No. FTC–2022–0046–7646 at 3. 143 The Marine Retailers Association of the Americas requested that transactions in excess of $70,000 be excluded from coverage, as an alternative to excluding marine transactions altogether. See Comment of Marine Retailers Ass’n of the Ams., Doc. No. FTC–2022–046–9291 at 4. (e) Motor Vehicle (Finalized as ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle’ ’’) The proposed rule defined the term ‘‘Motor Vehicle’’ as ‘‘(1) any selfpropelled vehicle designed for transporting persons or property on a street, highway, or other road; (2) Recreational boats and marine equipment; (3) Motorcycles; (4) Motor homes, recreational vehicle trailers, and slide-in campers, as those terms are defined in §§ 571.3(b) and 575.103(d) of title 49, Code of Federal Regulations, or any successor thereto; and (5) Other vehicles that are titled and sold through Dealers.’’ The Commission has determined to finalize the definition with the modifications discussed in the following paragraphs.

The Commission received several comments regarding the substance and scope of this proposed definition. A number of industry association commenters requested that certain vehicle types, including marine vehicles, motorcycles, RVs, and other recreational vehicles be excluded from coverage. These commenters contended that the dealerships that sell such vehicles function differently from automobile dealerships, and that recreational vehicles are discretionary, rather than essential, purchases. After careful consideration, the Commission is excluding recreational boats and marine equipment; motorcycles; and motor homes, recreational vehicle trailers, and slide-in campers from the definition of ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle.’ ’’ Moving forward, the Commission will continue to monitor for unfair and deceptive practices to determine whether further action is warranted to protect consumers, through law enforcement, a future rulemaking, or other measures. The Commission notes that no dealer may misrepresent material terms; deceive customers about prices, add-ons, or payments; charge for products that provide no benefit; or charge consumers without express, informed consent. To the extent that dealers engage in such conduct, they are in violation of the FTC Act.

Another commenter contended it was unclear whether all-terrain vehicles, gocarts, snowmobiles, scooters, electric bicycles, and golf carts were covered by the proposed definition. In response, the Commission has modified the first enumerated subpart of the definition to refer only to vehicles designed for use on a ‘‘public’’ street, highway, or road, and to expressly exclude scooters, electric bicycles, and golf carts. The definition of ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle’ ’’ in the Final Rule does not cover all-terrain vehicles, go-carts, or snowmobiles because such vehicles are not designed for use on a ‘‘public’’ street, highway, or road.141 A number of industry association commenters claimed that the proposed definition conflicts with definitions of motor vehicle under various State laws, and one such commenter requested that, rather than finalize a definition of ‘‘Motor Vehicle,’’ the Commission defer to the definitions promulgated by each State’s department of motor vehicles. The commenters did not explain how the Rule’s definition may actually conflict with any laws, or how any alleged duplication would harm consumers or competition. To the extent that States have broader or narrower definitions, it is not clear why motor vehicle dealers covered by the Rule cannot comply with the Rule’s provisions and applicable State laws. Moreover, the Final Rule provides additional remedies that will benefit consumers who encounter conduct that is already illegal under State or Federal law, including by adding a mechanism for the Commission to redress consumers injured by a dealer’s violation of the rule, and will assist lawabiding dealers that presently lose business to competitors that act unlawfully. Section 463.9 provides further discussion of State laws. Thus, after careful consideration of the comments, the Commission is finalizing the definition of ‘‘Motor Vehicle’’ with modifications, including adding the word ‘‘Covered’’ to the definition to reflect the fact that the definition is narrower than the term ‘‘Motor Vehicle’’ in the NPRM and adding ‘‘or Vehicle’’ to the definition to clarify that all references in the Rule to the term ‘‘Covered Motor Vehicle’’ and ‘‘Vehicle’’ refer to the defined term. (f) Dealer or Motor Vehicle Dealer (Finalized as ‘‘ ‘Covered Motor Vehicle Dealer’ or ‘Dealer’ ’’) The proposed rule defined the term ‘‘Dealer’’ or ‘‘Motor Vehicle Dealer’’ as ‘‘any person or resident in the United States, or any territory of the United States, that: (1) Is licensed by a State, a territory of the United States, or the District of Columbia to engage in the sale of motor vehicles; (2) Takes title to, holds an ownership interest in, or takes physical custody of motor vehicles; and (3) Is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both.’’ Based on the following, the Commission is finalizing this definition in the Final Rule with modifications for clarity.

Many stakeholders commented in support of the proposed rule and expressed no concern over this definition. Other commenters expressed views that the Commission examines in the following paragraphs. A few industry association commenters contended that parts of the proposed definition may have captured certain financial entities, such as financial entities that maintain licenses to engage in the sale of motor vehicles, and requested that the Commission make clear that any rule does not apply to such entities. In response, the Commission notes that only entities that meet all three components of the definition are covered ‘‘Dealers.’’ Thus, an entity that maintains an applicable license to engage in the sale of Covered Motor Vehicles but is not, for example, predominantly engaged in the sale or leasing of motor vehicles would not be a covered ‘‘Dealer.’’ Another industry association commenter similarly requested a ‘‘carveout’’ from any definition of ‘‘Dealer’’ for trusts and trusts’ investors.142 This commenter asserted that trusts and their investors do not satisfy two of the definition’s components and did not describe how any part of the definition creates concerns or is unclear. The Commission reiterates that if an entity meets the three parts of the ‘‘Covered Motor Vehicle Dealer’’ definition, then it is covered; if an entity does not meet these three parts, it is not covered. The Commission sees no benefit to adding language stating that entities that do not meet the definition are not covered. Other commenters, including vehicle association commenters, claimed that dealerships specializing in RV, marine, motorcycles, and other recreational vehicles, including certain high-end recreational vehicles,143 should be excluded from coverage, generally contending that such dealerships operate differently from automobile dealerships, and that these types of vehicles are used for different purposes than are automobiles. As explained in the section-by-section analysis of the definition of ‘‘Covered Motor Vehicle’’ in SBP III.B.2(e), after considering stakeholder comments, the Commission VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00019 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 270

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 144 The Oxford Advanced American Dictionary defines ‘‘servicing’’ as ‘‘the act of checking and repairing a vehicle, machine, etc. to keep it in good condition’’; see also 15 U.S.C. 5519(b)(3) (referring to ‘‘the sale, financing, leasing, rental, repair, refurbishment, maintenance, or other servicing of motor vehicles, motor vehicle parts, or any related or ancillary product or service’’). 145 Used Motor Vehicle Trade Regulation Rule (‘‘Used Car Rule’’), 81 FR 81664, 81667 (Nov. 18, 2016).

146 See 12 U.S.C. 5519(a), (f). 147 Section 1029(d) of the Dodd-Frank Act defines ‘‘motor vehicle dealer’’ as ‘‘any person or resident in the United States, or any territory of the United States, who—(A) is licensed by a State, a territory of the United States, or the District of Columbia to engage in the sale of motor vehicles; and (b) takes title to, holds an ownership in, or takes physical custody of motor vehicles.’’ 15 U.S.C. 5519(f)(2). Parts (A) and (B) of this definition are identical to parts (1) and (2) of the definition of ‘‘ ‘Covered Motor Vehicle Dealer’ or ‘Dealer’ ’’ in the Final Rule.

Section 1029(d) of the Dodd-Frank Act states that the Commission ‘‘is authorized to prescribe rules under sections 5 and 18(a)(1)(B) of the Federal Trade Commission Act in accordance with section 553 of title 5, United States Code, with respect to a person described in subsection (a).’’ 15 U.S.C. 5519(d). Section 1029(a) in turn, provides the CFPB ‘‘may not exercise any rulemaking, supervisory, enforcement or any other authority . . . over a motor vehicle dealer that is predominantly engaged in the sale and servicing of motor vehicles, the leasing and servicing of motor vehicles, or both.’’ 15 U.S.C. 5519(a). The last clause is identical to part (3) of the definition in the Final Rule. Several commenters requested that the Commission allow consumers to buy vehicles directly from manufacturers. Nothing in the Rule prohibits consumers from doing so. 148 See, e.g., Person, Black’s Law Dictionary (11th ed. 2019) (defining ‘‘person’’ to include ‘‘[a] human being’’ and ‘‘[a]n entity (such as a corporation) that is recognized by law as having most of the rights and duties of a human being.’’); Person, Merriam- Webster.com Dictionary, https://www.merriamwebster.com/dictionary/person (last visited Dec. 5, 2023) (defining ‘‘person’’ to include ‘‘human’’ and ‘‘one (such as a human being, a partnership, or a corporation) that is recognized by law as the subject of rights and duties’’); see also 12 U.S.C. 5481(19) (Dodd-Frank Act statutory authority for the Final Rule defining ‘‘person’’ as ‘‘an individual, partnership, company, corporation, association (incorporated or unincorporated), trust, estate, cooperative organization, or other entity’’); 1 U.S.C. 1 (Dictionary Act defining ‘‘person’’ to include ‘‘corporations, companies, associations, firms, partnerships, societies, and joint stock companies, as well as individuals’’). The application of covered motor vehicle dealer and dealer to entities also is consistent with these terms’ use in the NPRM and commenter understanding of these terms in the course of public comment. is removing marine, motorcycle, RV, and certain other vehicles from the definition in § 463.2(e), and to reflect this change, finalizing the defined term as ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle,’ ’’ thereby excluding from the Final Rule entities who otherwise would have qualified as ‘‘Dealers’’ solely based on their sale and servicing, or leasing and servicing, of such vehicles. The Commission underscores that, regardless of the definition of ‘‘Covered Motor Vehicle’’ under the Final Rule, unfair and deceptive practices remain unlawful under the FTC Act. The Commission will continue to monitor all vehicle markets to determine whether additional action is warranted to protect consumers. Some dealership association commenters argued that, under the Commission’s proposal, this definition exempted dealers subject to the jurisdiction of the CFPB. Other such commenters similarly contended that, under the proposal, used car dealers that do not engage in extensive post-sale repairs do not ‘‘service’’ vehicles or that do not have separate service departments may have been excluded from coverage, contending further that excluding such dealers would put other dealers at a competitive disadvantage. Contrary to these commenters’ assertions, the definition does not contain such exclusions. By its plain terms, the definition applies to dealers that meet its three enumerated components. Nowhere does the definition limit coverage of dealers based on CFPB jurisdictional considerations. Likewise, the definition does not condition coverage on whether a dealership has a service department or include any other requirement or limitation beyond those enumerated in § 463.2(f). By its plain meaning, the term ‘‘servicing’’ covers, for instance, ‘‘checking and repairing a vehicle, machine, etc. to keep it in good condition.’’ 144 As the Commission has previously stated, the term ‘‘servicing’’ ‘‘captures activities undertaken by essentially all used car dealers.’’ 145 Thus, the definition does not place dealers with separate servicing departments at a competitive disadvantage, and the Commission need not remove the term ‘‘servicing of motor vehicles’’ from the Final Rule. One such commenter further contended that the proposed definition did not cover certain entities, including certain direct sellers or manufacturers or others not licensed in a particular State, or lenders who offer add-on products such as GAP agreements and debt suspension products. As previously discussed, the Final Rule applies to all dealers that meet the three parts of this definition.146 To the extent that the definition does not apply to specific entities, this reflects the scope and bounds of the rulemaking authority Congress delegated to the Commission under the Dodd-Frank Act.147 Finally, some industry and dealership association commenters posited that the proposal conflicted with Federal and State law or duplicated the regulatory authority of State enforcement agencies. These commenters did not provide information regarding how duplicative laws prohibiting misrepresentations, requiring disclosures, or prohibiting charges for items that would not benefit the consumer or for items without express, informed consent would create harmful consequences, and the Commission is not aware of any laws that allow such conduct by those that the Rule defines as ‘‘Covered Motor Vehicle Dealer[s].’’ Moreover, the Final Rule provides additional remedies that will benefit consumers who encounter conduct that is already illegal under State or Federal law, including by adding a mechanism for the Commission to redress consumers injured by a dealer’s violation of the Rule, and will assist law-abiding dealers that presently lose business to competitors that act unlawfully. To the extent the Rule may overlap with State law, dealers can comply with these laws and also with the requirements that follow from the operation, in the Rule, of the Commission’s definition. To the extent there is truly an inconsistency between the provisions of the Final Rule and a State law, § 463.9 sets out the Rule’s relation to State laws. Thus, after careful consideration of the comments, the Commission is finalizing the definition of ‘‘ ‘Covered Motor Vehicle Dealer’ or ‘Dealer’ ’’ with modifications for clarity. The definition in the Final Rule incorporates the phrase ‘‘including any individual or entity’’ to confirm that the term ‘‘person,’’ like all undefined terms in this part, is used according to its ordinary meaning and includes individuals and corporate entities and adds the word ‘‘Covered’’ to the definition to reflect the narrowed scope of ‘‘Covered Motor Vehicle.’’ 148 (g) Express, Informed Consent The proposed rule defined the term ‘‘Express, Informed Consent’’ as ‘‘an affirmative act communicating unambiguous assent to be charged, made after receiving and in close proximity to a Clear and Conspicuous disclosure, in writing, and also orally for in-person transactions’’ of ‘‘(1) What the charge is for’’ and ‘‘(2) The amount of the charge, including, if the charge is for a product or service, all fees and costs to be charged to the consumer over the period of repayment with and without the product or service.’’ The proposed rule also included in this definition three examples of what does not constitute express, informed consent: ‘‘(i) A signed or initialed document, by itself; (ii) Prechecked VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00020 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 271

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 149 Comment of Ga. Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–10806 at 4. 150 See FTC Policy Statement on Deception, supra note 42, at 1–2, 5; see also Fed. Trade Comm’n v. Fleetcor Techs., Inc., 620 F. Supp. 3d 1268, 1303 (N.D. Ga. 2022); Fed. Trade Comm’n v. Crescent Pub. Grp., Inc., 129 F. Supp. 2d 311, 321 (S.D.N.Y. 2001); Thompson Med. Co., Inc., 104 F.T.C. 648, 816 (1984).

151 Some commenters, including certain industry associations, requested that the Rule include additional definitions, including for the terms ‘‘charged,’’ ‘‘item,’’ ‘‘discount,’’ ‘‘rebate,’’ ‘‘trade-in value,’’ and ‘‘online service.’’ In response, the Commission notes that for terms not defined in the Rule, the plain meaning of the terms apply. boxes; or (iii) An agreement obtained through any practice designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice.’’ In both the NPRM and in the provisions the Commission is finalizing, this definition is used exclusively in § 463.5(c). As such, comments regarding the definition are examined in the discussion of that provision in SBP III.E.2(c). As stated therein, the Commission is finalizing this definition substantively as proposed. (h) GAP Agreement The proposed rule defined the term ‘‘GAP Agreement’’ as ‘‘an agreement to indemnify a vehicle purchaser or lessee for any of the difference between the actual cash value of the insured’s vehicle in the event of an unrecovered theft or total loss and the amount owed on the vehicle pursuant to the terms of a loan, lease agreement, or installment sales contract used to purchase or lease the vehicle, or to waive the unpaid difference between money received from the purchaser’s or lessee’s motor vehicle insurer and some or all of the amount owed on the vehicle at the time of the unrecovered theft or total loss.’’ The proposed definition also noted that this included ‘‘products or services otherwise titled ‘Guaranteed Automobile Protection Agreement,’ ‘Guaranteed Asset Protection Agreement,’ ‘GAP insurance,’ or ‘GAP Waiver[ ].’ ’’ This term appeared in two sections of the rule proposal: in the provision regarding dealer charges for add-ons from which the consumer would not benefit at proposed § 463.5(a), and in the recordkeeping provision at proposed § 463.6(a)(4). Comments regarding the proposed definition are examined in the discussion of § 463.5(a) in SBP III.E.2(a). As stated therein, the Commission is finalizing this definition substantively as proposed, with typographical modifications to correct a misplaced period in the original proposal and a modification removing the extraneous term ‘‘insured’s’’ from the phrase ‘‘actual cash value of the insured’s Vehicle.’’ In addition, the Final Rule capitalizes the defined term ‘‘Vehicle’’ to conform with the revised definition of ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle’ ’’ at § 463.2(e). (i) Government Charges The proposed rule defined ‘‘Government Charges’’ as ‘‘all fees or charges imposed by a Federal, State or local government agency, unit, or department, including taxes, license and registration costs, inspection or certification costs, and any other such fees or charges.’’ This term appeared in two provisions of the rule proposal: in the proposed definition of ‘‘Offering Price’’ at § 463.2(k), which pertains to the proposed offering price disclosure provision at § 463.4(a); as well as in the proposed provision relating to undisclosed or unselected Add-ons at § 463.5(b). As explained in further detail in the paragraph-by paragraph analysis of § 463.5(b) in SBP III.E.2(b), the Commission has determined not to finalize § 463.5(b), and as such will refrain from examining this proposed definition in relation to that provision. Comments regarding the proposed definition are examined in the discussion of § 463.4(a) in SBP III.D.2(a). As stated therein, the Commission is finalizing this definition substantively as proposed, with a typographical modification to include a serial comma for consistency.

(j) Material or Materially The proposed rule defined ‘‘Material’’ or ‘‘Materially’’ as ‘‘likely to affect a person’s choice of, or conduct regarding, goods or services.’’ This term appeared in the prohibited misrepresentations provisions at § 463.3(b) and (g), and in the recordkeeping provision at § 463.6(a). As described in detail in the section-by-section analysis of § 463.3 in SBP III.C, the Final Rule modifies the introductory paragraph of § 463.3 from the Commission’s original proposal to add the word ‘‘Material,’’ such that the Commission’s materiality standard applies to all subparts of § 463.3. The Final Rule accordingly removes the word ‘‘Material’’ from § 463.3(b) and (g) so as to avoid duplication. Based on the following, the Commission is finalizing this definition, now at § 463.2(j), substantively as proposed. A dealership association commenter noted that the proposed definition did not use the term ‘‘significance,’’ and asserted that ‘‘Material’’ information should be significant and not ‘‘rooted in personal preference.’’ 149 The Commission notes that this definition adopts the meaning of the term as articulated through decades of enforcement actions 150 instead of using a different term such as ‘‘significance,’’ and does not use the term ‘‘personal preference’’ or rely on ‘‘personal preference’’ any more than the phrase ‘‘likely to affect’’ or ‘‘significant’’ does. Thus, the Commission is finalizing this definition substantively as proposed. (k) Offering Price The proposed rule defined ‘‘Offering Price’’ as ‘‘the full cash price for which a Dealer will sell or finance the motor vehicle to any consumer, excluding only required Government Charges.’’ This term appeared in two provisions of the rule proposal: in the proposed offering price disclosure provision at § 463.4(a), as well as in the proposed provision relating to undisclosed or unselected add-ons at § 463.5(b). As explained in further detail in the paragraph-byparagraph analysis of § 463.5(b) in SBP III.E.2(b), the Commission has determined not to finalize § 463.5(b), and as such, will refrain from examining this proposed definition in relation to that provision. Comments regarding the proposed definition are examined in the discussion of § 463.4(a) in SBP III.D.2(a).151 As stated therein, the Commission is finalizing this definition largely as proposed, with a modification to clarify that dealers may, but need not, exclude required government charges from a motor vehicle’s offering price. In addition, the definition in the Final Rule substitutes ‘‘Vehicle’’ for ‘‘motor vehicle’’ to clarify that the term conforms with the revised definition of ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle’ ’’ at § 463.2(e).

C. § 463.3: Prohibited Misrepresentations 1. General Comments The proposed rule set forth prohibitions against certain misrepresentations by motor vehicle dealers. Based on the following, the Commission has determined to finalize these prohibitions, with minor revisions.

The following paragraphs discuss comments relating to § 463.3 generally and Commission responses to such comments, followed by comments relating to each paragraph of § 463.3 and Commission responses to such comments.

The NPRM proposed prohibiting dealers from making any misrepresentation, expressly or by implication, regarding specific listed categories. The Commission received many comments regarding this VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00021 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 272

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 152 See Motor Vehicle Dealers Trade Regulation Rule, Comment Docket, https:// www.regulations.gov/document/FTC-2022-0046- 0001/comment.

153 Individual commenter, Doc. No. FTC–2022– 0046–0036.

154 Individual commenter, Doc. No. FTC–2022– 0046–0099.

155 Individual commenter, Doc. No. FTC–2022– 0046–0906.

156 Individual commenter, Doc. No. FTC–2022– 0046–1878.

157 Individual commenter, Doc. No. FTC–2022– 0046–3686.

158 Individual commenter, Doc. No. FTC–2022– 0046–4752.

159 Individual commenter, Doc. No. FTC–2022– 0046–5580.

160 Individual commenter, Doc. No. FTC–2022– 0046–2378.

161 Individual commenter, Doc. No. FTC–2022– 0046–3693.

162 Individual commenter, Doc. No. FTC–2022– 0046–4959.

163 Individual commenter, Doc. No. FTC–2022– 0046–0017.

164 Individual commenter, Doc. No. FTC–2022– 0046–0034.

165 Individual commenter, Doc. No. FTC–2022– 0046–0005.

166 Individual commenter, Doc. No. FTC–2022– 0046–1935.

proposal, including comments supporting such a provision, comments urging the Commission to broaden the provision, and comments urging the Commission to limit or forgo the provision.

Thousands of commenters expressed support for the proposed rule.152 Many of these commenters specifically expressed concern about misleading advertisements and deceptive pricing. Many individual commenters cited examples of such conduct from their own experiences purchasing or leasing vehicles, and many commenters with experience operating or working for a dealership shared their observations or experiences. For example: • I have been looking for a car at MSRP and most dealers[’] websites will list it at that price. [T]hen when you drive there the[y] will say well there is a market adjustment from 5,000 to 20,000 dollars. [N]ow . . . you need a car and have wasted 3–4 hours and picked out what you thought was your next car.153 • I am currently in discussions with two dealerships for a new car. Both assure me there is absolutely no dealer markup, come to find out they are adding 3/5k of ‘‘mandatory’’ add-ons respectively once I get in the door.154 • The last vehicle I purchased 2 years ago was a nightmare. Drove 5 hrs[.] to a dealer in Southern California. I called the dealer and confirmed the price on their website was what I was going to pay. When I arrived there, they had a list of $2500 [i]n additional charges that were not disclosed when I called and before I started driving. Purchasing a vehicle shouldn’t be such a stressful process.155 • Most recently I started looking myself for a new lease, and looked at the RAV 4 prime. Went to my local dealer after seeing an ad on their site for $450 a month. Not only did they not honor the deal, but wouldn’t even discuss that it was on their own site. I was told the SE model was [$5000] over MSRP and the XSE was [$8000] over.156 • I have contacted 10 different car dealerships in the past month looking to purchase a new or used SUV. 9 out of the 10 dealerships I contacted online or visited in-person in California changed or lied about the online advertised price of the vehicle I was inquiring about or said the car was sold or not available and tried to sell me a more expensive vehicle.157 • Once I was led to the F&I office I was told that I HAD to buy a $995 paint protection product that I didn[’]t want or need. I asked to see the contract for this product which clearly stated in bold letters ‘ACCEPTANCE OF THIS CONTRACT IS VOLUNTARY AND DOES NOT AFFECT THE FINANCING OF THE VEHICLE’ I pointed this out to the salesman and told him that I didn’t want this product[.] [H]e looked me in the eyes with my wife present and said ‘‘You have to buy it[.]’’ 158 • At the dealership, the salesman offered a price of $38,000, over $8,000 more than the advertised price. When I challenged the extra cost, he said the advertisement included every possible rebate and discount and no one could receive them together (some were exclusionary with other discounts).159 • While there are good honorable dealerships, far too many play games. Rarely is the price of [a] car advertised online or via mail EVER the actual price. Far too often in the F&I office the finance manager tries to [gloss] over add[-]ons that they just arbitrarily added on without telling you OR state I cannot get your loan approved without an extended warranty as an example I experienced. . . . I worked for a Toyota dealership many years ago and left the industry because it made me sick seeing the games played taking advantage of people. Change is needed and sooner than later.160 • I work as a salesperson at a local Nissan dealership. . . . Currently, dealerships across the US, including the one I work for, have made the car buying process needlessly confusing, expensive, and frustrating by engaging in false advertising and hidden add-on products. While these practices are very unscrupulous, they are incredibly effective at what they are designed to do: drive revenue for the store. If these regulations are passed, they would certainly take a significant toll on my personal finances. But the longer I work in my position, the more I realize that no one should be allowed to engage in such exploitative conduct in the course of running a business.161 • I am in the auto industry and work at a very transparent and honest dealership. I think most of these rules are great. I hear horror stories about honest people seeing a car advertised for one price, only to be told there are additional a[d]d-ons and markups once they arrive. I think this is unfair. I’m also shocked every time I hear about a dealership charging for mandatory window etching and nitrogen filled tires. I even know of reputable dealerships that add GPS tracking and theft recovery devices to every new car, even though these cars come with GPS theft recovery from the manufacturer. Stopping these practices will help restore consumers’ faith in car dealerships, save them money, and lead to a more honest and ethical industry. . . .162 Other commenters expressed support for transparent pricing generally, stating, for example:

• A consumer should be able to see a price, walk into a dealership, and pay that price. Plain and simple, just like ANY OTHER RETAILER.’’ 163 • If I walk into Best Buy and see a price they HAVE to sell it to me for that price or cheaper. These rules are long over due.164 • I believe if they advertise a car, it should be available for sale—at the advertised price—just as a supermarket can’t advertise a price for something they don’t have, or add a ‘coupon redemption fee’ to it. I believe these rules are an extremely reasonable approach to a long-standing problem and urge you to adopt them.165 • I used to work in the retail auto industry and these proposed rules will help everyone (including the dealers who are fighting them). Consumers will benefit from the transaction transparency, and over the long term even the shady dealers will benefit by treating consumers fairly and developing long term relations.166 • These regulations would be the best thing to happen for consumer protection since the Mo[n]roney Label. I not only have had to navigate and negotiate erroneous fees at dealers, but I’ve also VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00022 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 273

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 167 Individual commenter, Doc. No. FTC–2022– 0046–10441.

168 See, e.g., Complaint, CarMax, Inc., No. C–4605 (F.T.C. Mar. 22, 2017) (alleging Defendants misled consumers by representing that the used motor vehicles Defendants sold had been subject to rigorous inspection but omitting important safety information about recalls); Complaint, West-Herr Auto. Grp., Inc., No. C–4607 (F.T.C. Mar. 22, 2017) (alleging Defendants failed to disclose, or disclose adequately, that used motor vehicles it sold were subject to open recalls for safety issues); Complaint, Asbury Auto. Grp., Inc., No. C–4606 (F.T.C. Mar. 22, 2017) (alleging deceptive failure to disclose material information about the safety of used motor vehicles sold by Defendants); Complaint ¶¶ 20–24, Fed. Trade Comm’n v. Passport Imports, Inc., No. 8:18– cv–03118 (D. Md. Oct. 10, 2018) (alleging Defendants misled consumers by mailing ‘‘Urgent Recall’’ notices that were similar to and had the same color scheme as notices manufacturers are required by the U.S. Department of Transportation’s NHTSA to use when sending information about vehicle recalls, even though in the ‘‘vast majority of instances’’ the recipients’ cars were not subject to an open recall).

169 One commenter expressed concern that the prohibited misrepresentations would cause dealerships to provide less information, because discussing pricing and quotes would result in providing further documentation for every conversation. However, as the FTC Act already prohibits misrepresentations, and given that pricing and financing information are among the most salient aspects of a consumer’s shopping for a vehicle, the Commission considers it unlikely that § 463.3 would result in less information or the creation of additional documentation. 170 Under section 19(a)(1) of the FTC Act, the Commission may sue in Federal district court ‘‘any person, partnership, or corporation’’ that ‘‘violates any rule under [the FTC Act] respecting unfair or deceptive acts or practices.’’ 15 U.S.C. 57b(a)(1). Where such liability is found, under section 19(b) a court may ‘‘grant such relief as [it] finds necessary to redress injury . . . resulting from the rule violation,’’ including the ‘‘rescission or reformation of contracts, the refund of money or return of property, [or] the payment of damages.’’ Id. 57b(b). A few commenters requested that the Rule go further in providing remedies, including by allowing for a private right of action to enforce Rule violations. The Commission notes that, depending on State law, consumers may be able to use State statutes that prohibit unfair or deceptive practices to challenge conduct that violates this Rule. There is nothing in the FTC Act or this Rule that would preclude consumers from exercising any such legal rights under State law. The Commission will continue to monitor the market to determine whether additional steps are needed. 171 See NPRM at 42045 (proposed § 463.3(b), (g)). 172 NPRM at 42019.

173 FTC Policy Statement on Deception, supra note 42, at 5 & nn.47–55. worked at dealers whose transparency and forthrightness put them at a disadvantage. Many dealers advertise vehicles that can not [sic] be purchased or leased at the advertised price due to deceptive adverts either not disclosed or in a print so fine it can’t be read. Please pass this ruling. My grandma shouldn’t have to pay more than someone else just because she’s not a good negotiator.167 Consumer advocacy organization commenters and individual commenters urged the FTC to include additional specific provisions in § 463.3, including a prohibition against misrepresentations regarding the safety, mechanical or structural condition, odometer reading, or history of a vehicle. Similarly, commenters including a municipal regulator urged the Commission to specifically prohibit misrepresentations regarding certification of used vehicles, citing enforcement actions it brought against dealers that misrepresented used vehicles as ‘‘certified pre-owned’’ or ‘‘manufacturer certified.’’ The FTC takes seriously deception relating to the safety or condition of a vehicle and the practice of charging consumers more based on false claims or reassurances.168 Depending on the claim made by the dealership and the specific facts at issue, deceptive conduct in either of these areas may be covered by the enumerated misrepresentation paragraphs the Commission is finalizing, such as by § 463.3(a) if it relates to the terms of the purchase, lease, or financing. The FTC will continue to monitor dealer misrepresentations to determine whether additional action is needed. In addition, a number of credit union commenters requested that the Commission explicitly address misrepresentations involving dealers’ refusal to accept outside financing to purchase a vehicle. These commenters cited several examples of consumers being told that they could not use outside financing, that they would not receive a lower interest rate from an outside financial institution, or that a particular interest rate was the best rate the consumer can get. The Rule already covers such conduct. For example, § 463.3(a) of the Rule, which prohibits dealers from misrepresenting the cost or terms of financing a vehicle, covers these and other misrepresentations regarding financing, including the availability of outside or ‘‘indirect’’ financing terms, or the costs of such financing as compared to those of any dealer-provided financing. Two individual commenters posited that any language prohibiting misrepresentations should explicitly include the word ‘‘omissions,’’ in order to ensure that dealers do not sneak in additional costs without consumers’ consent or understanding. The Commission appreciates this concern, and notes that the Rule has many provisions prohibiting such misconduct, including the required disclosures regarding price, add-ons, and total amount of payments in § 463.4 of the Final Rule, as well as the requirement in § 463.5(c) to obtain consumers’ express, informed consent before charging for any items.

Other commenters, including dealership associations, individual commenters, and a United States Representative, questioned whether certain of the proposed misrepresentation provisions were duplicative of other laws, such as the Truth in Lending Act (‘‘TILA’’), the Consumer Leasing Act (‘‘CLA’’), or State regulations, and in some instances whether compliance with State regulations should act as a safe harbor. The Commission notes that another statute—the FTC Act—already prohibits misrepresentations in or affecting commerce, and to the extent there is duplication between the FTC Act and other existing statutes pertaining to deception, there is no evidence that duplicative misrepresentation prohibitions have harmed consumers or competition.169 The Commission further notes that the Final Rule provides additional remedies that will benefit consumers who encounter conduct that is otherwise already illegal under Federal law, and will aid law-abiding dealers that lose business to competitors that act unlawfully.170 State laws may provide more or less specific requirements as long as those requirements are not inconsistent with part 463, as set forth in § 463.9, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency. Because dealers are already prohibited from engaging in ‘‘deceptive acts or practices’’ under the FTC Act, dealers should be able to comply with these provisions without the need for a safe harbor. Industry association commenters also claimed that the prohibited misrepresentation proposal ignored the materiality prong of the Commission’s deception standard, and further observed that some of the prohibited misrepresentations in the proposed rule explicitly included a materiality requirement,171 while others did not. As the NPRM made clear, the Commission’s proposed misrepresentation section, at § 463.3, addressed misrepresentations that are all material.172 The Commission need not explicitly specify materiality in its description of these misrepresentations; indeed, the Commission has long considered certain categories of information, express claims, and intended implied claims to be presumptively material.173 Nevertheless, rather than using the term ‘‘Material’’ in certain individual enumerated paragraphs, the Commission has determined to modify the introductory text of § 463.3 from the Commission’s original proposal in order VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00023 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 274

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 174 The Final Rule prohibits misrepresentations in specific categories. In contrast, some FTC rules go further by prohibiting misrepresentations of ‘‘any material aspect’’ of the transaction. See, e.g., Mortgage Assistance Relief Services Rule, 16 CFR 322.3(b); Telemarketing Sales Rule, 16 CFR 310.3(a)(2)(x).

175 FTC Policy Statement on Deception, supra note 42, at 2 (citing Am. Home Prods., 98 F.T.C. 136, 374 (1981), aff’d, 695 F.2d 681, 687 (3d Cir. 1982) (evaluation of the entire document); Warner Lambert, 86 F.T.C. 1398, 1489–90 (1975), aff’d 562 F.2d 749 (D.C. Cir. 1977), cert. denied, 435 U.S. 950 (1978) (juxtaposition of phrases); Firestone Tire & Rubber Co., 81 F.T.C. 398, 456 (1972), aff’d, 481 F.2d 246 (6th Cir.), cert. denied, 414 U.S. 1112 (1973) (nature of the claim); see also Kraft, Inc. v. Fed. Trade Comm’n, 970 F.2d 311, 319 (7th Cir. 1992) (‘‘Commission may rely on its own reasoned analysis to determine what claims, including implied ones, are conveyed in a challenged advertisement, so long as those claims are reasonably clear from the face of the advertisement.’’).

176 FTC Policy Statement on Deception, supra note 42, at 2 n.8.

177 The interpretation or reaction does not have to be the only one; when a seller’s representation conveys more than one meaning to reasonable consumers, one of which is false, the seller is liable for the misleading interpretation. See FTC Policy Statement on Deception, supra note 42, at 3. Further, an interpretation will be presumed reasonable if it is the one the respondent intended to convey. Id.

178 The FTC’s Policy Statement on Deception and scores of FTC cases make clear that both express and implied claims can be deceptive. See, e.g., ECM Biofilms, Inc. v. Fed. Trade Comm’n, 851 F.3d 599 (6th Cir. 2017) (affirming Commission’s finding that an additive manufacturer’s unqualified biodegradability claim conveyed an implied claim that its plastic would completely biodegrade within five years); POM Wonderful LLC, No. C–9344 (F.T.C. Jan. 10, 2013) (Opinion of the Commission), aff’d as modified, POM Wonderful, LLC v. Fed. Trade Comm’n, 777 F.3d 478 (D.C. Cir. 2015) (finding that company’s advertisements would reasonably be interpreted by consumers to contain an implied claim that POM products treat, prevent, or reduce the risk of certain health conditions and for some ads that these effects were clinically proven); Kraft, Inc. v. Fed. Trade Comm’n, 970 F.2d 311 (7th Cir. 1992) (affirming finding of deception where Kraft ads juxtaposed references to the milk contained in Kraft singles and the calcium content of the milk, the combination of which implied that each Kraft single contained the same amount of calcium as five ounces of milk). 179 FTC Policy Statement on Deception, supra note 42, at 2; Int’l Harvester Co., 104 F.T.C. 949, 1057–58 (1984).

180 See Fed. Trade Comm’n v. Freecom Commc’ns, 401 F.3d 1192, 1202 (10th Cir. 2005) (‘‘Because the primary purpose of § 5 is to protect the consumer public rather than punish the wrongdoer, the intent to deceive the consumer is not an element of a § 5 violation.’’). 181 See Fed. Trade Comm’n v. Figgie Int’l, Inc., 994 F.2d 595, 605–06 (9th Cir. 1993) (holding that section 19 of the FTC Act does not require proof of individual consumer reliance; rather, there is a ‘‘presumption of actual reliance’’ that arises once the Commission has proved that a defendant made material misrepresentations, that they were widely disseminated, and that consumers purchased the defendant’s product).

to specifically prohibit misrepresentations regarding material information about the enumerated paragraphs. As such, the Commission is also removing what would otherwise be redundant references to the term ‘‘Material’’ within paragraphs (b) and (g) of § 463.3.

A national dealership association incorrectly asserted that this section is problematic because there is no requirement that the representation or omission be material or be viewed from the perspective of a consumer acting reasonably under the circumstances. As adopted in the final rule, this section adds the term ‘‘Material,’’ stating that it is an unfair or deceptive practice for any motor vehicle dealer to make any misrepresentation, expressly or by implication, regarding material information about the specific categories enumerated in § 463.3.174 The Commission is not aware of situations where dealers have made misrepresentations expressly or by implication regarding material information about these specific categories that are not deceptive or unfair, nor did commenters describe any such situations.

The Commission further notes that, by the terms of this section, a court must find that the dealer made an express or implied misrepresentation regarding material information for § 463.3 to be violated. For an express or implied misrepresentation regarding material information to be made in violation of the FTC Act and this Rule, there must be a representation that misleads consumers acting reasonably under the circumstances regarding material information. Whether such a representation has occurred depends on the facts. In the case of implied representations, whether a representation has occurred is often evident from an examination of the representation itself, including, for example, an evaluation of the document in which a representation is made, the juxtaposition of language in that document, the nature of the representation, and the nature of the transaction.175 In other situations, extrinsic evidence that it is reasonable for consumers to reach the implied representation may be helpful, such as consumer testimony, surveys, or other reliable evidence of consumer interpretation.176 For example, if a dealer offers discounted coffee for customers who visit its dealership before 10 a.m. and honors that offer, but makes no representations, expressly or by implication, about discounted cars, the dealer will not have violated § 463.3(d), which prohibits express or implied misrepresentations regarding rebates and discounts, even if a consumer holds an unreasonable belief that the offer was for discounted cars. On the other hand, if a dealership’s advertisement depicts a car with a consumer standing next to it holding a cup of coffee, and states, ‘‘10% discount available before 10 a.m.,’’ such an advertisement can convey several representations that may mislead reasonable consumers,177 including that the car is available at a 10% discount.

Commenters including industry associations opined on the term ‘‘implied,’’ contending for example that the idea that a misrepresentation can be implied is overly broad, and a dealership association commenter expressed concern that the inclusion of ‘‘implied’’ creates too much uncertainty. As has been recognized under the law for decades, however, representations can mislead consumers, even without making express claims.178 Take, for example, an advertisement that shows a picture of a new sedan for sale. Even if the advertisement does not expressly state that consumers could use the vehicle to drive at speeds higher than 25 miles per hour, there is an implied representation that a product is fit for the purposes for which it is sold.179 Thus, limiting the Rule to prohibit only express misrepresentations would significantly hamper its usefulness to consumers.

One industry association commenter further argued that the proposed rule created a new deception standard that ignored intent and reliance. This argument, however, misstates the law, which does not require intent 180 or reliance 181 to establish deception. Thus, the Commission is finalizing the introductory paragraph of § 463.3 largely as proposed, with a modification stating that it applies to misrepresentations regarding material information. For consistency with other parts of the Rule, the Commission is also removing the shorthand ‘‘FTC Act’’ that appeared in parentheses after ‘‘the Federal Trade Commission Act’’ in the introductory paragraph of the proposed rule. For clarity and consistency with the revised definition of ‘‘Covered Motor Vehicle Dealer’’ (at § 463.2(f) and discussed in SBP III.B.2(f)), the Commission is adding the word ‘‘Covered’’ to ‘‘Motor Vehicle Dealer’’ in the introductory paragraph. Finally, without changing any substantive requirements for covered entities, the Commission is adding the following sentence to the end of § 463.3, at newly designated paragraph (q): ‘‘The requirements in this section also are prescribed for the purpose of preventing the unfair or deceptive acts or practices VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00024 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 275

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 182 Examples of ‘‘costs or terms of purchasing, financing, or leasing a vehicle’’ include, among other things, express or implied representations regarding a vehicle’s total cost, down payments, interest rates, repayment schedules, the price for added features, other charges, certainty or finality of terms, and the availability of discounts. The Commission has brought numerous enforcement actions where, for example, dealers have misrepresented the total price a consumer could pay for vehicles, or concealed a required down payment or other restrictions on the offer. See, e.g., Complaint ¶¶ 10–11, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020) (alleging false ads stating a certain price but charging consumers higher prices); Complaint ¶¶ 38–46, Fed. Trade Comm’n v. Tate’s Auto Ctr. of Winslow, Inc., No. 3:18–cv–08176–DJH (D. Ariz. July 31, 2018) (alleging false ads touting attractive terms but concealing (i) ads were for lease offers only and required substantial initial payment, (ii) discounts were subject to material limitations, or (iii) other legally required disclosures); Complaint ¶¶ 7–16, Cowboy AG, LLC, No. C–4639 (F.T.C. Jan. 4, 2018) (alleging false ads touting attractive terms, but concealing substantial down payments, offers were for leases and not purchases, material eligibility restrictions, and other legally required disclosures).

183 Some commenters repeat this and similar questions, regarding what types of disclosures are required, through provision (o); the same response applies—provisions (a) through (o) do not affirmatively require particular disclosures. As with all misrepresentations prohibited by the Rule, and under section 5 of the FTC Act, misrepresentations are barred whether they are made expressly or by implication.

184 See Trade Regulation Rule Concerning Preservation of Consumers’ Claims and Defenses, 16 CFR 433.2 [hereinafter Holder Rule]. 185 The National Automobile Dealers Association commissioned a survey, released in May of 2023, that asserted the Commission’s proposed rule would lead to an increase in consumer transaction time. Edgar Faler et al., Ctr. for Auto. Rsch., ‘‘Assessment of Costs Associated with the Implementation of the Federal Trade Commission Notice of Proposed Rulemaking (RIN 2022—14214), CFR part 463’’ (2023), https://www.cargroup.org/ wp-content/uploads/2023/05/CAR-Report_CFR- Part-463_Final_May-2023.pdf. This survey was released more than seven months after the closure of the comment period for the notice of proposed rulemaking on September 12, 2022, and is not part of this rulemaking record. These facts notwithstanding, the Commission observes that each respondent to this survey was presented with a leading statement at the beginning of the survey asserting, inter alia, that the proposed rule would impose ‘‘new duties [that] are expected to create additional monitoring, training, forms, and compliance review responsibilities as well as a modification of record keeping systems and coordination with outside IT and other vendors’’ and ‘‘increase the time of a motor vehicle transaction, inhibit online sales, limit price disclosures, and increase customer confusion and frustration.’’ Id. at 34, 36 (introductory instructions on the survey instrument sent to respondents). In addition, this survey did not explain its selection process or criteria for the 60 dealers it surveyed, nor why only 40 such dealerships provided fully completed survey responses. Moreover, the survey report attributed much of this estimated increase to proposed rule provisions that the Commission is not finalizing.

defined in this part, including those in §§ 463.4 and 463.5.’’ The Commission examines each paragraph of § 463.3, including by examining related comments and Commission responses to those comments. The Commission then discusses the corresponding provisions of the Final Rule.

2. Paragraph-by-Paragraph Analysis of § 463.3 (a) The Costs or Terms of Purchasing, Financing, or Leasing a Vehicle Proposed § 463.3(a) prohibited misrepresentations regarding the cost or terms of purchasing, financing, or leasing a vehicle. The Commission is finalizing this provision largely as proposed, with the minor modification of capitalizing the defined term ‘‘Vehicle’’ to conform with the revised definition at § 463.2(e) (explained in SBP III.B.2(e)). As previously discussed, the addition of ‘‘material’’ to the introductory paragraph of § 463.3 will apply to this paragraph and to all paragraphs of § 463.3 that follow. A number of commenters expressed support for this proposed provision, contending, inter alia, that it would level the playing field for car buyers and address unfair and deceptive practices related to financing terms and conditions.

The Commission received a number of industry association comments requesting that the Commission clarify the operation of proposed § 463.3(a), including for example, by clarifying whether it would require dealers to discuss all purchase, finance, or lease terms, or whether it would require dealers to read aloud all the terms of the buyer’s order and finance or lease agreement. Dealership association commenters expressed a related concern that this proposed provision lacked specific guidance on dealer compliance. To begin, misrepresentations regarding ‘‘costs or terms of purchasing, financing, or leasing a vehicle’’ refer to the ordinary plain meaning of the words used in the provision.182 Second, as the language in the introductory paragraph of § 463.3 makes clear, its paragraphs— including paragraph (a) of § 463.3— prohibit misrepresentations regarding material information. By its terms, this paragraph requires no particular affirmative disclosures, whether written or oral; rather, this paragraph obligates dealers to refrain from misrepresentations regarding material information about the costs or terms of purchasing, financing, or leasing a vehicle.183 The Commission received comments from industry associations requesting that the Final Rule provide a safe harbor from liability stemming from dealers’ violations of the Rule to vehicle credit contract assignees, who take or receive these contracts subject to all claims and defenses consumers could assert against the dealer under the Commission’s Trade Regulation Rule Concerning Preservation of Consumers’ Claims and Defenses, also known as the ‘‘Holder Rule.’’ 184 The Rule, however, does not create liability for these entities under the Holder Rule where it did not previously exist; the Rule addresses conduct that is unfair or deceptive under the FTC Act. When enacting the Holder Rule, the Commission did not include a safe harbor or exceptions involving any specific deceptive or unfair conduct, and the Commission declines to do so through this Rule. A comment from a motor vehicle industry association argued that this provision would likely be inapplicable, or less impactful, with regard to RV sales because the RV industry rarely offers leases, if at all, and because RV sales are usually not financed through RV manufacturer-controlled financing companies. To the extent that specific provisions do not apply to specific entities, such provisions do not impose any obligations upon those entities. Nevertheless, as explained in the analysis of the ‘‘Covered Motor Vehicle’’ definition, § 463.2(e), the Commission is excluding recreational vehicle dealers from the definition of ‘‘Covered Motor Vehicle.’’ After carefully considering the comments, the Commission is finalizing paragraph (a) of § 463.3 with the minor modification of capitalizing ‘‘Vehicle.’’ This provision prohibits misrepresentations regarding ‘‘[t]he costs or terms of purchasing, financing, or leasing a Vehicle.’’ Misrepresentations of the price, discounts, or other terms are likely to cause consumers to waste time pursuing unavailable or inapplicable offers and to spend more money on a vehicle rather than undergoing the hours-long process to begin the vehicle search and shopping process anew at another dealership. Prohibiting these misrepresentations will save consumers time and money and ensure that dealers compete on a level playing field.185 (b) Any Costs, Limitation, Benefit, or Any Other Aspect of an Add-On Product or Service Proposed § 463.3(b) prohibited misrepresentations concerning any costs, limitation, benefit, or any other material aspect of an add-on product or service. Section 463.3(b) of the Final Rule adopts this provision without substantive modification. As described in detail in SBP III.C.1, the Commission VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00025 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 276

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 186 See FTC Policy Statement on Deception, supra note 42, at 2, 5; see also Fed. Trade Comm’n v. Crescent Publ’g Grp., Inc., 129 F. Supp. 2d 311, 321 (S.D.N.Y. 2001).

187 E.g., Cost, Cambridge Dictionary, https:// dictionary.cambridge.org/us/dictionary/english/cost (‘‘Cost’’ is defined as ‘‘the amount of money needed to buy, do, or make something’’); Limitation, Cambridge Dictionary, https://dictionary. cambridge.org/us/dictionary/english/limitation (‘‘Limitation’’ is defined as ‘‘something that controls or reduces something’’); Benefit, Cambridge Dictionary, https://dictionary.cambridge.org/us/ dictionary/english/benefit (‘‘Benefit’’ is defined as ‘‘a helpful or good effect, or something intended to help’’).

188 See, e.g., Complaint ¶¶ 26–27, 70–71, Fed. Trade Comm’n v. N. Am. Auto. Servs., Inc., No. 1:22-cv-01690 (N.D. Ill. Mar. 31, 2022) (alleging deceptive and unauthorized add-on charges; unfair discrimination against minority consumers); Complaint ¶¶ 12–19, Fed. Trade Comm’n v. Liberty Chevrolet, Inc., No. 1:20–cv–03945 (S.D.N.Y. May 21, 2020) (alleging deceptive and unauthorized addon charges in consumers’ transactions); Complaint ¶¶ 59–64, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16-cv-07329 (C.D. Cal. Sept. 29, 2016) (deceptive and unauthorized add-on charges in consumers’ transactions); Complaint ¶¶ 4–14, Nat’l Payment Network, Inc., No. C–4521 (F.T.C. May 4, 2015) (alleging failure to disclose fees associated with financing program; misleading savings claims in advertisements); Complaint ¶¶ 4– 13, Matt Blatt Inc., No. C–4532 (F.T.C. July 2, 2015) (alleging failure to disclose fees associated with financing program; misleading savings claims). Cf. Consent Order ¶¶ 10–16, Santander Consumer USA, Inc., CFPB No. 2018–BCFP–0008 (Nov. 20, 2018) (finding defendant sold GAP product allegedly providing ‘‘full coverage’’ to consumers with loan-to-value ratios (‘‘LTVs’’) above 125%, when in fact coverage is limited to 125% of LTV). 189 See, e.g., Consumer Fin. Prot. Bureau, ‘‘Supervisory Highlights: Issue 12, Summer 2016’’ 5 (June 2016), https://files.consumerfinance.gov/f/ documents/Supervisory_Highlights_Issue_12.pdf (finding that one or more auto lenders deceptively advertised the benefits of their GAP agreement products, leaving the impression that these products would fully cover the remaining balance of a consumer’s loan in the event of vehicle loss when, in fact, the product only covered amounts below a certain loan to value ratio). 190 It is well-settled that, if one makes a claim that, absent additional information, would mislead a consumer acting reasonably under the circumstances about a material fact, such conduct would violate the law. See FTC Policy Statement on Deception, supra note 42, at 2; Int’l Harvester Co., 104 F.T.C. 949, 1057–58 (1984). is modifying § 463.3 from the Commission’s original proposal to include the term ‘‘Material’’ in the introductory paragraph rather than in paragraphs (b) or (g) of § 463.3. Section 463.3(b) of the Final Rule therefore deletes reference to the term ‘‘Material.’’ The Commission received a number of comments expressing support for prohibiting misrepresentations about add-ons, including comments that requested specific additional add-onrelated misrepresentation prohibitions. For example, an auto dealer commenter expressed support for prohibiting misrepresentations about whether or not a car has add-ons already installed. Consumer advocacy organization commenters recommended that the Commission include a new paragraph in § 463.3 prohibiting misrepresentations regarding the consumer’s right to cancel add-on products or services. This provision, however, already covers such conduct: It prohibits misrepresentations regarding material information about any costs, limitation, benefit, or any other aspect of an add-on product or service. ‘‘Material’’ means likely to affect a consumer’s conduct or choices.186 A consumer’s right to cancel is likely to affect the consumer’s conduct regarding an add-on product or service. Thus, § 463.3(b) includes representations about a consumer’s right to cancel an add-on product or service. A number of dealership association commenters argued that the language used in this provision is vague or confusing. The terms ‘‘Material’’ and ‘‘Add-on Product or Service,’’ however, are specifically defined in § 463.2. The remaining terms in this provision are commonly used and can be understood according to their plain meaning.187 The NPRM examined misrepresentations regarding the coverage and costs of addons, and enforcement actions by the Commission and other agencies have documented many instances of such misrepresentations.188 Examples of the type of conduct prohibited include misrepresenting whether add-ons are required in order to purchase or lease a vehicle, including by representing that such charges are required when in fact they are not, or misrepresenting that advertised prices do not include fees beyond routine taxes and fees only to subsequently require the purchase of add-ons; misrepresenting what is, or is not, covered by, among others, an extended warranty, service or maintenance plan, or GAP agreement; 189 and misrepresenting that consumers have provided express, informed consent to be charged for addons.

Commenters including a number of motor vehicle dealership associations requested that the Commission clarify how extensive disclosures would need to be to satisfy this provision. One such commenter requested that the Commission explain what conduct would be required under this paragraph, and expressed concern that, if the paragraph required disclosures, such a requirement would affect the length of the transaction. Another industry association commenter suggested that, in the event dealers provide consumers with a verbal or written disclosure stating that such products have costs, limitations, or benefits, and stating information about other material aspects, the Commission modify its proposal to shift to consumers the burden of proving any relevant dealer misrepresentation. An individual commenter expressed support for applying § 463.3(a) and (b) to dealer advertisements of free lifetime benefits programs and requiring dealers to make disclosures about any costs, limitations, benefits, or any other aspect of an addon product or service. The Commission notes that paragraphs (a) and (b) of § 463.3 already apply to free lifetime benefits programs. Regarding disclosures, the Commission is concerned about including additional disclosure requirements beyond the few areas included in the Rule, or shifting the burden to consumers to hunt for and decipher disclosures, given that the auto finance and lease process is already lengthy, complex, document-heavy, and dense. Accordingly, as discussed in regard to § 463.3(a), these provisions do not mandate set disclosures or allow for disclosures to be used as a shield when there are misrepresentations to consumers; rather, they prohibit express or implied misrepresentations.190 Several dealership association commenters pointed to State laws that, they contended, may already prohibit misrepresentations about add-ons or may otherwise protect consumers. As discussed previously, to the extent there may be duplication between the provisions the Commission is finalizing and other laws, there is no evidence that duplicative misrepresentation prohibitions have harmed consumers or competition. Moreover, the Final Rule provides additional remedies that will benefit consumers who encounter conduct that is already illegal under State or Federal law and will assist lawabiding dealers that presently lose business to competitors that act unlawfully. Under § 463.9, States may provide more or less specific requirements relating to motor vehicle dealers so long as those requirements are not inconsistent with part 463, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency. Based on a review of the comments and the responses discussed, the Commission adopts paragraph (b) of § 463.3 without substantive modification. As discussed in SBP III.C.1, the Commission has determined to modify the introductory paragraph of § 463.3 from the Commission’s original proposal so that each paragraph of § 463.3 prohibits misrepresentations regarding material information. As such, the Commission is finalizing a version of § 463.3(b) that removes what would VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00026 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 277

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 191 The FTC has alleged that misrepresentations that particular terms are available for financing or for a lease violate the FTC Act. See Complaint ¶¶ 38–39, Fed. Trade Comm’n v. Tate’s Auto Ctr., No. 3:18–cv–08176–DJH (D. Ariz. July 31, 2018) (alleging false ads touting attractive terms but concealing ads were for lease offers only); Complaint ¶¶ 10, 13, TC Dealership, L.P., No. C– 4536 (F.T.C. Aug. 13, 2015) (same); Complaint ¶¶ 9–12, Cowboy AG, LLC, No. C–4639 (F.T.C. Jan. 4, 2018) (same); Complaint ¶¶ 36–38, United States v. New World Auto Imports, Inc., No. 3:16–cv– 02401–K (N.D. Tex. Aug. 18, 2016) (alleging misrepresentation that terms were for financing instead of leasing); Complaint ¶¶ 28–37, 44, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016) (alleging advertisements with key terms that were not generally available).

192 Section 463.3(d) (emphasis added). 193 See, e.g., Rebate, Cambridge Dictionary, https://dictionary.cambridge.org/us/dictionary/ english/rebate (last visited Dec. 5, 2023) (defining ‘‘rebate’’ as ‘‘an amount of money that is returned to you, especially by the government, for example when you have paid too much tax’’ or ‘‘an amount of money that is paid back to you after you have paid too much’’); Discount, Cambridge Dictionary, https://dictionary.cambridge.org/us/dictionary/ english/discount (last visited Dec. 5, 2023) (‘‘[A] reduction in the usual price’’). 194 See NPRM section IV.C, 87 FR at 42020 (proposed § 463.3(d) prohibited misrepresentations concerning ‘‘[t]he availability of any rebates or discounts that are factored into the advertised price but not available to all consumers,’’ and the NPRM explained ‘‘[w]hen dealers advertise rebates and discounts, or offer prices that factor in such rebates and discounts, but in fact those rebates and discounts are not available to the typical consumer, but only a select set of customers, such conduct induces the consumer to select and transact with the dealer under false pretenses’’). 195 See, e.g., Complaint ¶¶ 6–13, Jim Burke Auto., Inc., No. C–4523 (F.T.C. May 4, 2015) (alleging promises of prices and discounts not generally available to consumers); Complaint ¶¶ 6, 9, TT of Longwood, Inc., No. C–4531 (F.T.C. July 2, 2015) (alleging promises of prices and discounts not generally available to consumers); Complaint ¶¶ 8– 9, JS Autoworld, Inc., No. C–4535 (F.T.C. Aug. 13, 2015) (alleging false ads touting prices but concealing discounts with material eligibility limitations); Complaint ¶¶ 7–9, TC Dealership, L.P., No. C–4536 (F.T.C. Aug. 13, 2015) (alleging false ads touting attractive prices but concealing Continued otherwise be redundant explicit reference to the term ‘‘Material.’’ This provision prohibits misrepresentations regarding ‘‘[a]ny costs, limitation, benefit, or any other aspect of an Addon Product or Service.’’ Misrepresentations regarding add-ons are likely to affect a consumer’s conduct, including the consumer’s decision to purchase the product or service.

(c) Whether Terms Are, or Transaction Is, for Financing or a Lease Proposed § 463.3(c) prohibited misrepresentations regarding whether the terms are, or the transaction is, for financing or a lease. Upon review and consideration of public comments, the Commission is finalizing paragraph (c) of § 463.3 without modification from the Commission’s original proposal. A few industry association and individual commenters posited that this proposed provision was unnecessary, either because other statutes or regulations, including TILA and some State regulations, address this issue, or because vehicle manufacturers already monitor such misrepresentations. As noted in SBP III.C.1, even given the possibility of overlap between this provision and existing Federal or State law, there is no evidence that duplicative misrepresentation prohibitions have harmed consumers or competition. Further, given that the conduct covered by this provision is already unlawful under the FTC Act and may duplicate other laws, or be prohibited by manufacturer rules, it should not be difficult to follow this provision.191 Accordingly, after careful consideration, the Commission adopts paragraph (c) of § 463.3 as proposed. Misrepresentations regarding whether terms are, or a transaction is, for financing or a lease are likely to affect a consumer’s conduct, including by causing consumers to enter into a monetary transaction for a product they do not want, or, if the true circumstances are revealed prior to consummation of the transaction, to waste time traveling to, and potentially spending hours at, the dealership. (d) The Availability of Any Rebates or Discounts That Are Factored Into the Advertised Price but Not Available to All Consumers Proposed § 463.3(d) prohibited misrepresentations concerning the availability of any rebates or discounts that are factored into the advertised price but not available to all consumers. Upon review and consideration of public comments, the Commission is finalizing paragraph (d) of § 463.3 without modification from the Commission’s original proposal. Comments in support of this proposed provision, including those from a group of State attorneys general and from two United States Senators, generally contended that the proposed provision would increase the transparency of the purchase transaction by requiring dealers to be honest when they advertise the availability of discounts. An individual commenter suggested that the Commission modify proposed § 463.3(d) to require dealers to disclose all representations regarding rebates or discounts in writing, in a clear and conspicuous manner. The Commission notes this paragraph prohibits misrepresentations regardless of the medium. Further, this paragraph focuses on misrepresentations; disclosures regarding price, add-ons, and total of payments are addressed in the discussion of § 463.4, as is a discussion of why the Commission has determined not to include additional disclosure requirements in this Final Rule. The same commenter also requested that the Final Rule text include examples of situations where discounts or rebates may not be available. The Commission describes examples here rather than adding them to the Final Rule text, as it would be difficult to anticipate all such examples and the text would become unwieldy. Examples include where an advertised rebate or discount applies only to the most expensive version of a particular vehicle make and model or is only available to consumers with high credit scores. The Commission received comments from a dealership association and an individual commenter asking for additional detail about proposed § 463.3(d), pointing to a State regulation that includes disclosures and asking which types of rebates the provision covers. Here, the Commission notes that, as the language in § 463.3(d) states, this provision applies to ‘‘any rebates and discounts’’ advertised by dealers, and is not limited to any particular type of rebate or discount.192 The terms in this provision may be interpreted according to their plain meaning, as they are commonly used and understood.193 Additionally, the language of this provision, the NPRM, and Commission enforcement actions provide further context. In proposing § 463.3(d) to specifically address the availability of discounts and rebates, the Commission included additional language (‘‘that are factored into the advertised price but not available to all consumers’’) to describe the manner in which such misrepresentations often occur: a dealer represents an advertised price which includes a discount or rebate that is not generally available to consumers.194 The NPRM’s discussion of proposed § 463.3(d) described both a scenario in which a dealer advertised a rebate or discount separately, and one in which rebates or discounts are factored into the advertised price but the rebates and discounts are not available to a typical consumer. The conduct in either such scenario would violate this provision and, depending on the circumstances, may violate other provisions the Commission is finalizing, such as paragraph (a) of § 463.3. Enforcement actions cited in the NPRM provide further illustration of deceptive practices involving rebates and discounts.195 The Commission declines VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00027 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 278

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations discounts were subject to material eligibility limitations and trade-in requirement); Complaint ¶¶ 4–5, Timonium Chrysler, Inc., No. C–4429 (F.T.C. Jan. 28, 2014) (alleging dealership advertised internet prices and dealer discounts but failed to disclose consumer would have to qualify for multiple rebates not generally available to them); Complaint ¶¶ 4–5, Ganley Ford West, Inc., No. C– 4428 (F.T.C. Jan. 28, 2014) (alleging dealership advertised discounts on vehicle prices, but failed to disclose discounts were only available on the most expensive models).

196 See, e.g., Decision and Order, Timonium Chrysler, Inc., No. C–4429 (F.T.C. Jan. 28, 2014). 197 See Complaint ¶¶ 4–5, Ganley Ford West, Inc., No. C–4428 (F.T.C. Jan. 28, 2014) (alleging false ads touting price discount but concealing offer was limited to certain high-end models). 198 See Complaint ¶¶ 8–9, JS Autoworld, Inc., No. C–4535 (F.T.C. Aug. 13, 2015) (alleging false ads touting prices but concealing discounts with material eligibility limitations); Complaint ¶¶ 7–9, TC Dealership, L.P., No. C–4536 (F.T.C. Aug. 13, 2015) (alleging false ads touting attractive prices but concealing discounts were subject to material eligibility limitations and trade-in requirement); Complaint ¶ 14, TXVT Ltd. P’ship, No. C–4508 (F.T.C. Feb. 12, 2015) (alleging false ads failed to disclose that it would match consumers’ income tax refunds only up to $1,000); Complaint ¶¶ 4–5, Timonium Chrysler, Inc., No. C–4429 (F.T.C. Jan. 28, 2014) (alleging false ads touting pricing and discounts but concealing material qualifications and restrictions); Complaint ¶¶ 6, 9, TT of Longwood, Inc., No. C–4531 (F.T.C. July 2, 2015) (alleging promises of prices and discounts not generally available to consumers); Complaint ¶¶ 6– 13, Jim Burke Auto., Inc., No. C–4523 (F.T.C. May 4, 2015) (alleging promises of prices and discounts not generally available to consumers); see also Auto Buyer Study, supra note 25, at 8 (‘‘A number of [study] participants were attracted by promotional offers in ads that they did not qualify for, but did not realize that they did not qualify until they got to the dealer. Some did not learn that they did not qualify until they got to the financing stage of the transaction.’’).

199 The commenter also expressed concern about misrepresentations regarding the refundability of deposits and recommended that the Commission include language in § 463.3(e) addressing this issue. Because representations and practices regarding the refundability of deposits are related to the costs or terms of purchasing, financing, or leasing a vehicle, this issue is covered by § 463.3(a). Thus, the Commission declines to adopt the commenter’s recommendation.

to add additional requirements, such as disclosure requirements, to its Final Rule, given the already lengthy, complex, and document-heavy nature of auto transactions.

A number of dealership association commenters contended that the proposed paragraph would prohibit dealers from displaying beneficial information to consumers or would prohibit dealers from advertising rebates and incentives of limited availability. In addition, commenters including one such dealership association requested that the Commission adopt an approach the commenter contended is used in some States: allowing dealers to display, below the advertised sales price, a rebate or incentive that is not available to all purchasers. Moreover, a number of industry association and dealership association commenters argued that the proposed paragraph was more stringent than, and inconsistent with, the Commission’s prior articulation of the deception standard, further noting the existence of Commission orders that prohibit defendants from representing that a price, discount, rebate, or other incentive is available, unless it is in fact available to all or unless a defendant provides a clear and conspicuous disclosure of any qualifications or restrictions. Section 463.3(d) prohibits misrepresentations; it does not prohibit a dealer from advertising, in a truthful manner, rebates or discounts with limitations. Thus, this paragraph allows for the representation of limited offers, as long as such representation is truthful, and any limitations are clear and conspicuous to consumers. The paragraph is also consistent with the Commission’s prior enforcement order practice in this area, which both prohibits misrepresentations regarding rebates and prohibits representations regarding rebates without disclosing any material qualifications or restrictions.196 The paragraph simply contains one of these prohibitions but not the second. A dealership association commenter expressed concern that this proposed provision would penalize dealers if consumers were to confuse a rebate or discount offered for one vehicle with a vehicle that does not contain such an offer. As under current law, dealers are prohibited under § 463.3(d) from both express and implied misrepresentations. If, for example, a dealer states or implies that a discount is available on several types of vehicles when, in truth, the discount is only available on one such type of vehicle, such conduct would violate this paragraph. If, alternatively, the dealer does not state or imply that a discount is available for several types of vehicles, and offers a discount for one type of vehicle, this conduct would not violate this paragraph, as long as the dealer makes no other express or implied misrepresentations. After careful review of the comments, the Commission is adopting paragraph (d) of § 463.3 as proposed. When dealers advertise rebates or discounts in a misleading manner, including when such rebates or discounts are not available to the typical consumer, or apply only to the most expensive versions of the make and model,197 such conduct induces consumers to select and transact with the dealer under false pretenses.198 (e) The Availability of Vehicles at an Advertised Price Proposed § 463.3(e) prohibited misrepresentations regarding the availability of vehicles at an advertised price. Upon reviewing the comments pertaining to this provision, the Commission is finalizing paragraph (e) of § 463.3 largely as proposed, with the minor modification of capitalizing the defined term ‘‘Vehicles.’’ One individual commenter recommended that proposed § 463.3(e) be expanded to prohibit certain specific misrepresentations about advertised vehicle availability, including whether any specific vehicle is already reserved for another consumer; whether the availability is subject to a requirement that the consumer pay a deposit; and regarding the amount of time until the vehicle becomes available. Another individual commenter recommended that the Rule require disclosure of how long each vehicle has been in the dealer’s inventory, to prevent dealers from misrepresenting that a vehicle recently became available. Here, the Commission notes that, to the extent any such misrepresentations regarding the availability of vehicles were made with express or implied reference to the price of the vehicle, each would be prohibited by § 463.3(e).199 Furthermore, to the extent such misrepresentations included reference to the subject of another paragraph of § 463.3, they would be prohibited by the Final Rule. For example, if an advertisement were to make a claim about the monthly payment for a specific vehicle, but the vehicle is not actually available, it would be covered under the bar against misrepresentations regarding costs or terms in paragraph (a) of § 463.3. In addition, under the Final Rule, dealers are also subject to disclosure requirements under § 463.4, including the requirement at § 463.4(a) to disclose the vehicle’s offering price in any advertisement that references a specific vehicle, or any monetary amount or financing term for any vehicle. And if a dealer discloses the offering price for a vehicle, but the vehicle is not available to consumers, § 463.3(e) applies. Beyond this, the Commission will continue to monitor whether other misrepresentations regarding availability are being made without reference to price, or to the subject of another paragraph of § 463.3, to determine whether additional action is warranted.

The Commission received comments from a number of dealership associations and individuals requesting that the Final Rule limit dealers’ responsibility for unanticipated delays, or otherwise expressing concern about VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 279

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 200 FTC Policy Statement on Deception, supra note 42, at 1 n.5 (‘‘Advertising that lacks a reasonable basis is also deceptive.’’) (citing Firestone Tire & Rubber Co., 81 F.T.C. 398, 451–52 (1972) (additional citations omitted)); see Fed. Trade Comm’n v. US Sales Corp., 785 F. Supp. 737, 748 (N.D. Ill. 1992) (‘‘Apart from challenging the truthfulness of an advertiser’s representations, the FTC may challenge the representation as unsubstantiated if the advertiser lacked a reasonable basis for its claims.’’); see also Fed. Trade Comm’n v. Am. Screening, LLC, 4:20–CV– 01021–RLW (E.D. Mo. July 14, 2022) (granting summary judgment for the FTC upon finding that American Screening’s claim that its COVID–19 protective equipment was available and would ship quickly was false and lacked a reasonable basis); Fed. Trade Comm’n v. John Beck Amazing Profits, LLC, 865 F. Supp. 2d 1052 (C.D. Cal. 2012) (finding that the defendants’ representations were unsubstantiated in violation of section 5, because Defendants conceded that during the time period in which their infomercial was aired they did not have evidence supporting their representations that consumers who purchased their product would be able to earn money easily and because survey results revealed that less than one percent of consumers actually generated any revenue or profits); Fed. Trade Comm’n v. Elegant Sols., Inc., 8:19–cv–01333–JVS–KES (C.D. Cal., July 6, 2020) (finding that defendants made false or unsubstantiated representations, including representing that consumers would be enrolled in a repayment plan that may be forgiven after a specific number of years even though there were no Federal loan forgiveness programs with those repayment terms).

201 Fed. Trade Comm’n, ‘‘FTC Policy Statement Regarding Advertising Substantiation,’’ (appended to In re Thompson Med. Co., Inc., 104 F.T.C. 648, 839 (1984)); Fed. Trade Comm’n v. John Beck Amazing Profits, LLC, 865 F. Supp. 2d 1052, 1067 (C.D. Cal. 2012).

202 Fed. Trade Comm’n, ‘‘FTC Policy Statement Regarding Advertising Substantiation,’’ (appended to In re Thompson Med. Co., Inc., 104 F.T.C. 648, 839 (1984)); see Fed. Trade Comm’n v. Am. Screening, LLC, 4:20–CV–01021–RLW (E.D. Mo., July 14, 2022) (granting FTC’s motion for summary judgment and finding that Defendants’ representations that it had protective equipment in stock and would ship it to consumers within seven to ten business days were material to consumers seeking such equipment during a global pandemic). 203 This provision would not prohibit dealers from advertising a vehicle with limitations on availability in a truthful manner, such that any limitations are clear and conspicuous to the consumer. For example, dealers should not affirmatively represent that a vehicle is available on its lot without a reasonable basis that the vehicle is on the lot or without clearly and conspicuously noting that the vehicle will be made available after transfer from an affiliate’s lot. 204 Comment of Tex. Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–8102 at 21; see 43 Tex. Admin. Code 215.247(2) (2023). how dealers would be able to comply with this proposed provision. One industry association commenter stated that unanticipated delays could result from factors beyond the reasonable control of the dealer, such as shipping or production issues. Other dealership association commenters contended that, because of supply chain disruptions, adjustments to inventory and other information may not always be displayed on a retailer’s website instantaneously.

As is the case under current law, under this provision, dealers may not make claims about the availability of vehicles at an advertised price without a reasonable basis at the time the claims are made.200 Objective claims about products or services represent, explicitly or by implication, that an advertiser has a reasonable basis to support those claims.201 Consumers would be less likely to be affected by claims for products and services if they knew the advertiser did not have a reasonable basis for believing them to be true.202 If a dealer has a reasonable basis to make a claim about the availability of vehicles at the time the claim is made, the dealer would not be in violation of the provision if a vehicle later becomes unavailable because of circumstances that a dealer could not reasonably anticipate or control.

A few dealership association commenters claimed that promulgation of § 463.3(e) would cause regulatory confusion because State guidelines or rules already address issues about the availability of vehicles, including, for example, by requiring dealers to note the location of the vehicle.203 As described in SBP III.C.1, States may provide more or less specific requirements relating to motor vehicle dealers so long as those requirements are not inconsistent with part 463, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency. To the extent there are actual inconsistencies, § 463.9 is clear that this Rule’s prohibition against misrepresentations controls.

After careful consideration of the comments, the Commission is adopting paragraph (e) of § 463.3 largely as proposed, with the minor modification of capitalizing the defined term ‘‘Vehicles.’’ This paragraph prohibits dealers from promoting low prices for specific vehicles, but then later misrepresenting, among other things, that the advertised vehicle is no longer available or no longer available at the advertised price. Such misrepresentations are likely to induce consumers to waste their time traveling to a particular dealership to pursue a specific offer on a specific vehicle when the offer or vehicle itself may not actually be available.

(f) Whether Any Consumer Has Been or Will Be Preapproved or Guaranteed for Any Product, Service, or Term Proposed § 463.3(f) prohibited misrepresentations regarding whether a consumer has been or will be preapproved or guaranteed for any product, service, or term. Upon reviewing public comments, the Commission is finalizing paragraph (f) of § 463.3 without modification from the Commission’s original proposal. One dealership association commenter recommended that compliance with a State law that prohibits certain misleading statements, such as ‘‘we finance anyone’’ and ‘‘no credit rejected’’ and similar statements, should function as a safe harbor against liability under this proposed paragraph.204 Yet, while compliance with the State law cited may require dealers to refrain from using certain frequently misleading statements, as described by the commenter, that law does not generally prohibit all misrepresentations regarding material information about consumer preapprovals or guarantees; even if it did, there is no evidence that duplicative laws prohibiting misrepresentations harm consumers or competition, and no evidence of benefits to consumers or competition in allowing one such law to act as a safe harbor against another such law. Further, given that current law already prohibits deceptive conduct generally, dealers should be able to comply with the Commission’s Rule, which provides further protections for consumers and law-abiding dealers. Thus, the Commission declines to adopt the recommended safe harbor. Therefore, after careful consideration, the Commission is finalizing paragraph (f) of § 463.3. Misrepresentations regarding preapproval or guarantees for a product, service, or term—as with misrepresentations about availability and price, described previously—are likely to impact consumers’ conduct with regard to motor vehicle sales, financing, or leasing transactions, including by inducing consumers to waste time pursuing illusory offers. (g) Any Information on or About a Consumer’s Application for Financing Proposed § 463.3(g) prohibited dealers from misrepresenting any material information on or about a consumer’s application for financing. After carefully reviewing public comments, the Commission is adopting paragraph (g) of § 463.3 without substantive modification. As with § 463.3(b), the only adopted modification is the deletion of the term ‘‘Material,’’ which nonetheless applies to the operation of each of the misrepresentation paragraphs in § 463.3, including paragraph (g), through the addition of the term in the introductory paragraph of § 463.3.

VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00029 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 280

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 205 Individual commenter, Doc. No. FTC–2022– 0046–7445 at 12.

206 See Complaint ¶¶ 18–36, Fed. Trade Comm’n v. Tate’s Auto Ctr. of Winslow, Inc., No. 3:18–cv– 08176–DJH (D. Ariz. July 31, 2018); Consumer Fin. Prot. Bureau, ‘‘Supervisory Highlights: Issue 30, Summer 2023’’ 5 (July 2023), https://files.consumer finance.gov/f/documents/cfpb_supervisoryhighlights_issue-30_2023-07.pdf (finding that dealers ‘‘fraudulently included’’ in financing documents add-ons, such as undercoating, that were not actually present on the vehicle, creating ‘‘improperly inflated loan amounts’’ that caused consumers to pay improper additional interest). The Commission received a number of comments regarding this provision, including comments that expressed support for prohibiting misrepresentations about a consumer’s application for financing. A credit union commenter requested that, in addition to this proposal, the Commission consider implementing a requirement to clearly and conspicuously disclose any potential financing limitations prior to vehicle purchase negotiations, contending that such a measure would better enable consumers to choose a motor vehicle dealer and financing option that best serves their needs. To the extent a dealer misrepresents a consumer’s financing options or limitations, including prior to or during the process of selling, leasing, or arranging financing for a vehicle, such conduct is prohibited by this provision, and depending on the circumstances, may also violate other provisions of the Rule. For example, as discussed in this paragraph-by-paragraph analysis, § 463.3(a) of the Final Rule prohibits misrepresentations regarding the cost or terms of financing a vehicle; this prohibition includes misrepresentations about available vehicle financing. Furthermore, this provision pertains to misrepresentations; comments pertaining to proposed disclosures regarding price, add-ons, and total of payments are examined in the Commission’s discussion of § 463.4, wherein the Commission explains its determination not to finalize any additional disclosure requirements not included in its NPRM.

An individual commenter, while expressing support for regulation of such misrepresentations, also noted concern for the ‘‘grave consequences of falsifying information on a customer’s application for financing,’’ and urged the Commission to consult with other law enforcement agencies to further address such problems.205 The Commission appreciates the concern and the seriousness of falsifying information on a consumer’s application for financing, and coordinates regularly with other law enforcement agencies regarding areas of shared jurisdiction and responsibility, including motor vehicle sales and financing. The Commission will continue to monitor financing application falsification issues to determine whether any additional action, beyond § 463.3(g), is needed. A number of dealership association commenters contended that the proposed language was vague and did not adequately explain the type of behavior this paragraph would prohibit. Relatedly, some dealership association commenters contended that this provision lacked specific guidance about what a motor vehicle dealer must or must not disclose. This provision, however, utilizes terms which are commonly used and understood, and which may be interpreted according to their plain meaning. Read together with the introductory paragraph of § 463.3, § 463.3(g) prohibits misrepresentation . . . regarding material information about ‘‘[a]ny information on . . . a consumer’s application for financing.’’ By its terms, this prohibition includes any misrepresentations of material information on a financing application. For example, dealers would make misrepresentations in violation of this provision by including, on a consumer’s application that is submitted to a thirdparty financing institution, consumer income information that is different from what the consumers have stated to the dealer that the consumers actually earn, or by representing a different down payment amount than the amount the consumer has actually provided, or by misrepresenting that the vehicle is being sold or leased with certain add-on products.206 Moreover, as described in detail with regard to other paragraphs of § 463.3, this provision does not require any particular affirmative disclosures, instead obligating dealers to refrain from certain misrepresentations. One dealership association commenter questioned whether a dealer would be held responsible for a customer’s false statement about his or her income. If a consumer falsely states they have a higher income, that consumer would not be misled into thinking he has a higher income. If, however, a consumer’s application falsely states a higher income because a dealer has altered the information, that consumer would be misled into thinking that the application they are signing accurately reflects the information the consumer provided, and § 463.3(g) would be violated. Additionally, if a dealer advises a consumer to include other sources of payment as income or advises the consumer to list a higher income in other ways, such conduct may mislead the consumer into thinking that it is proper to calculate income for auto retail installment contracts in a particular way, and there may be a violation of § 463.3(g). After careful review and consideration of the comments, the Commission adopts paragraph (g) of § 463.3 without substantive modification, prohibiting misrepresentations regarding material information about any information on or about a consumer’s application for financing. It is likely to affect a consumer’s choices if the consumer knows a dealer is misrepresenting the consumer’s income, or other aspects of financing applications. If, for example, a consumer knew the truth—that the dealer is inflating the consumer’s income such that the consumer would not otherwise obtain financing for a particular vehicle—the consumer might opt to finance a less expensive car, rather than risking repossession. Material misrepresentations on consumers’ financing paperwork are also likely to cause consumers substantial injury, including by causing them to take on debt beyond that which the financing company would have approved, and increasing the risk of repossession and harmful consequences to consumers’ credit. Consumers cannot avoid the injury from dealers misrepresenting the information consumers provide them, and this practice provides no countervailing benefits to consumers or competition. (h) When the Transaction Is Final or Binding on All Parties (i) Keeping Cash Down Payments or Trade-In Vehicles, Charging Fees, or Initiating Legal Process or Any Action If a Transaction Is Not Finalized or If the Consumer Does Not Wish To Engage in a Transaction Proposed § 463.3(h) prohibited dealers from misrepresenting when the transaction is final or binding on all parties. Proposed § 463.3(i) prohibited dealers from making misrepresentations about keeping cash down payments or trade-in vehicles, charging fees, or initiating legal process or any action if a transaction is not finalized or if the consumer does not wish to engage in a transaction. After careful review and consideration of the comments, the Commission is finalizing paragraphs (h) and (i) of § 463.3 with the minor modification of capitalizing the defined term ‘‘Vehicles’’ in § 463.3(i) to conform with the revised definition at § 463.2(e). Some commenters, including a group of State attorneys general and consumer VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00030 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 281

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 207 Complaint ¶¶ 67–72, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16–cv–07329 (C.D. Cal. Sept. 29, 2016); State ex rel. Dewine v. Dads Car Lot Inc., No. 13–cv–4036, 2014 BL 468717, at * 1 (Ohio Com. Pl. June 6, 2014) (finding defendant violated State consumer sales practices act by including ‘‘spot delivery’’ document that allowed defendant to keep ‘‘all funds on deposit’’); Att’ys Gen. of 31 States & DC, Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00112 at 4 (Apr. 13, 2012), https://www.ftc.gov/sites/default/files/ documents/public_comments/public-roundtablesprotecting-consumers-sale-and-leasing-motorvehicles-project-no.p104811-00112/00112- 82927.pdf (recommending, among other rules aimed at deterring yo-yo sales, FTC adopt rules that would require dealers to disclose the consumer’s ‘‘right to walk away’’ if financing is rejected and, in the context of spot delivery, to disclose financing has not been finalized as well as the responsibilities and potential consequences for consumers); Legal Aid Just. Ctr., Comment Letter on Public Roundtables: Protecting Consumers in the Sale and Leasing of Motor Vehicles, Project No. P104811, Submission No. 558507–00066 at 26, 29 (Jan. 30, 2012), https://downloads.regulations.gov/FTC-2022- 0036-0062/attachment_2.pdf (explaining that in a yo-yo sale the dealer misrepresents to the consumer that credit has been finalized, when in fact the dealer treats the sale as contingent, retaining the ability to call off or seize the vehicle later; a ‘‘yo-yo case can result in substantial distress to the person who has been tricked’’; and ‘‘[t]he harm to the marketplace occurs when the consumer believes a credit sale has been completed and stops shopping for a car on credit’’); Nat’l Consumer L. Ctr., ‘‘In Harm’s Way—At Home: Consumer Scams and the Direct Targeting of America’s Military and Veterans’’ 41 (May 2003), https://filearchive.nclc. org/special_projects/military/report-scams-facingmilitary.pdf (listing ‘‘Spot Delivery’’ or ‘‘yo-yo sales’’ among scams commonly aimed at military members).

208 See Orkin Exterminating Co., Inc., 108 F.T.C. 263 (1986), aff’d sub nom. Orkin Exterminating Co. v. F.T.C., 849 F.2d 1354 (11th Cir. 1988) (finding that defendant’s practice of unilaterally raising consumers’ annual renewal fees where the consumers’ contracts contained a ‘‘lifetime guarantee’’ as to the amount of the fee was unfair under section 5 of the FTC Act); see also First Amended Complaint ¶¶ 59–61, Fed. Trade Comm’n v. BF Labs, Inc., No. 4:14–cv–00815 (W.D. Mo. May 14, 2015) (alleging as unfair defendants’ practice of unilaterally failing to provide paid-for services while refusing to refund consumers’ upfront payments).

209 Fed. Trade Comm’n, ‘‘FTC Policy Statement Regarding Advertising Substantiation,’’ (appended to In re Thompson Med. Co., Inc., 104 F.T.C. 648, 839 (1984)); Fed. Trade Comm’n v. John Beck Amazing Profits, LLC, 865 F. Supp. 2d 1052, 1067 (C.D. Cal. 2012).

210 On May 31, 2023, the Commission received a petition for rulemaking under 16 CFR 1.31 regarding yo-yo financing. Petition for Rulemaking Concerning the Finality of a Car Purchase (Yo-Yo Financing), Doc. No. FTC–2023–0035–0002. The Commission will address this petition separately. advocacy organizations, generally supported prohibiting misrepresentations about when the transaction is final or binding on all parties but urged the Commission to include additional requirements or prohibitions. For instance, several commenters, including consumer advocacy organizations and individual commenters, requested that the Commission add to its Final Rule a provision requiring dealers to include, in every consumer credit contract, a finality clause stating that the transaction is final as soon as the consumer credit contract is signed, or alternatively, a provision requiring dealers to include in retail installment contracts a clause prohibiting financingcontingent sales. Commenters including a group of State attorneys general recommended that the Commission require any dealer that does not ultimately secure financing under previously presented terms to unwind the transaction, return any down payment in full, and return any tradedin vehicle. Such commenters also recommended that the Commission implement restrictions, such as requiring dealers to be reasonably certain that a consumer will qualify for quoted financing terms; requiring a written disclosure that the consumer must sign advising the consumer that financing is not final; or setting a short deadline by which the dealer must either arrange financing or cancel the transaction. Other commenters, including a State consumer protection agency, also supported requiring the contractual contingency to be disclosed conspicuously and limiting the contingency to a short period of time. A number of these commenters, including consumer advocacy organizations, provided examples of how spot delivery transactions can harm consumers. The provision’s prohibitions and requirements address many of these commenters’ concerns regarding spot delivery and yo-yo financing. Spot delivery and yo-yo financing refer to situations where a dealer delivers a vehicle to a consumer on the spot before the financing or leasing has been finalized, leads a consumer to believe that the transaction is final, and then later directs the consumer to return the vehicle and engages in certain tactics, such as failing to return the consumer’s trade-in vehicle while refusing to honor the finance or lease transaction, or pressuring the consumer to enter into a new transaction.207 Paragraphs (h) and (i) of § 463.3 prohibit misrepresentations regarding the finality of the transaction and return of down payments and tradein vehicles. Under these provisions, if a consumer is under the impression that the transaction is final, and the dealer subsequently causes the consumer to return the vehicle to the lot because the transaction was not final, or the dealer takes or threatens to take possession of the vehicle but refuses to return the down payment or trade-in vehicle, the dealer has violated either § 463.3(h), by misrepresenting the finality of the transaction, or § 463.3(i), by falsely representing, expressly or by implication, that the dealer has a legal basis to keep the down payment or trade-in vehicle in the event the transaction is not finalized, or both.208 Regarding the recommendation to include a requirement that dealers be reasonably certain that consumers will qualify for quoted financing terms, the Rule the Commission is finalizing already contains several provisions in addition to § 463.3(h) and (i) that address this conduct. For example, the Rule prohibits misrepresentations regarding material information about the costs or terms of financing (§ 463.3(a)), or about whether any consumer has been or will be preapproved or guaranteed for any product, service, or term (§ 463.3(f)). As explained in the paragraph-by-paragraph analysis of § 463.3(e) in SBP III.C.2(e), existing law requires dealers to have a reasonable basis for their claims. Objective claims about products or services represent, explicitly or by implication, that an advertiser has a reasonable basis to support those claims.209 Thus, to avoid misrepresentation, dealers must reasonably believe that consumers will qualify for quoted financing terms, or that the transaction will be finalized on the terms presented, in order to represent such terms to consumers. Regarding additional provisions that would require certain contractual measures, such as finality clauses or prohibitions against financingcontingent sales, the Commission is concerned that requiring specific contract provisions would obligate dealers that are not engaged in spot delivery to change their contracts even though their customers do not experience harm stemming from spot delivery practices. Before requiring any such changes, the Commission has determined to continue to monitor the market to evaluate whether additional steps are warranted.210 Some commenters, including dealership associations, requested that the Commission clarify how dealers could document compliance with these proposed provisions, such as how dealers could establish that appropriate disclosures had been made. One such commenter, for instance, asked whether written agreements required by State law were sufficient to satisfy the requirements of these provisions. As noted elsewhere in this paragraph-byparagraph analysis of § 463.3 in SBP III.C.2, these provisions do not require any particular affirmative disclosures, instead obligating dealers to refrain from VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00031 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 282

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 211 See NPRM at 42020–21. Individual commenter, Doc. No. FTC–2022–0046–9469 at 5–6. 212 One commenter questioned whether this section would prohibit a dealer from retaining a down payment on a special order vehicle where the customer refuses to take delivery of the vehicle. Comment of Minn. Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–8670 at 10. Sections 463.3(h) and (i) prevent misrepresentations, including misrepresenting that a dealer can keep a down payment when a dealer does not have a legal basis to do so. If the dealer does not make a misrepresentation, this provision would not be violated.

213 See SBP I.A, n.3.

certain misrepresentations. Section 463.6 discusses records dealers need to keep to demonstrate compliance with the requirements of the Final Rule, and enumerates five such categories of records, including copies of finance and lease documents signed by the consumer, whether or not final approval is received for a financing or lease transaction. The Commission declines to include in this Final Rule additional requirements regarding any specific documents dealers must keep in order to demonstrate compliance with § 463.3(h) or (i).

One individual commenter requested that the Commission include in the CFR the examples of harmful conduct related to yo-yo financing that it published in the NPRM.211 The Commission has determined that each such example describes conduct that violates this rulemaking. Rather than adding them to the text of the Final Rule, the Commission repeats those examples in this paragraph-by-paragraph analysis of § 463.3(h) and (i), in order to avoid voluminous modifications to the Rule text itself.

Commenters including a dealership association asserted that the issue of when a contract is final or binding is one of State law, and thus it is within the purview of each State to determine when a contract is final or binding, arguing that § 463.3(h) therefore should be removed from the Final Rule. Another such commenter contended that even courts experienced in contract interpretation have difficulty determining when an agreement is final, and that dealers therefore are likely to transgress this prohibition in proposed § 463.5(h) accidentally. This provision, however, requires that a dealer’s express or implied representations regarding material information be truthful, which is consistent with current law and with the Commission’s authority to prohibit unfair or deceptive acts or practices. Moreover, under § 463.9, this Rule does not affect State law pertaining to contracts so long as State law is not inconsistent with part 463, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency.212 In the case of § 463.3(h), for example, an inconsistency would include State law allowing material misrepresentations regarding whether transactions are final; the Commission is unaware of any such law. Further, to the extent dealers are concerned they may transgress this prohibition because courts have had difficulty interpreting their contracts, then, as they should be doing under current law prohibiting misrepresentations, dealers should carefully consider the net impression they are conveying with the language they use, both in their contracts and in the context in which these contracts are presented, as such language may confuse consumers as well. Several dealership association commenters claimed that State law already prohibits misrepresentations about spot delivery transactions or otherwise protects consumers in such transactions. One such commenter asserted that Massachusetts law prohibits spot deliveries, and cautioned the FTC not to create uncertainty with its Rule such that one might think spot deliveries are allowed in Massachusetts. Another such commenter asked whether this provision applies in addition to State law or instead of it. Other commenters, including consumer advocacy organizations, asserted that less than half of the States have statutes, regulations, or administrative pronouncements about yo-yo transactions; that there are significant variations in such law from State to State; and that State regulation often does not provide sufficient protections for consumers. As described throughout the paragraph-by-paragraph analysis of § 463.3 in SBP III.C.2, State law may provide more or less specific requirements than those under the Final Rule as long as those requirements are not inconsistent with part 463, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency. As for any States that prohibit spot delivery, such prohibitions are consistent with the provisions of this Rule. Finally, as to whether additional provisions are warranted to protect consumers, the Commission will continue to monitor the market to make this determination. Commenters including an industry association contended that the Commission should not take action to disrupt spot delivery transactions to consumers, stating that there may be reasons to keep down payments even when consumers are not permitted to keep the vehicle, or claiming that although abusive spot deliveries have occurred, they are not a systemic problem in the marketplace. The Commission, however, need not show that abusive spot deliveries are systemic in order to finalize these provisions barring misrepresentations.213 Further, these misrepresentation prohibitions do not alter requirements under current law prohibiting dealers from making express or implied misrepresentations. After careful consideration of the recommendations and record, the Commission has determined to finalize paragraphs (h) and (i) of § 463.3 largely as proposed, with the minor modification of capitalizing the defined term ‘‘Vehicles’’ in § 463.3(i). The Commission notes, however, that it has significant concerns about consumer harm due to yo-yo financing and will continue to examine these issues even as it finalizes these prohibitions against certain misrepresentations. Misrepresentations about when the transaction is final or binding on all parties, as well as about keeping down payments or trade-in vehicles, charging fees, or initiating legal process or any action, are likely to affect consumer conduct, including regarding whether to enter into a new transaction with less beneficial terms for the consumer, and are likely to mislead consumers. (i) Keeping Cash Down Payments or Trade-In Vehicles, Charging Fees, or Initiating Legal Process or Any Action If a Transaction Is Not Finalized or If the Consumer Does Not Wish To Engage in a Transaction Proposed § 463.3(i) is discussed with § 463.3(h).

(j) Whether or When a Dealer Will Pay Off Some or All of the Financing or Lease on a Consumer’s Trade-in Vehicle Proposed § 463.3(j) prohibited misrepresentations regarding whether or when a motor vehicle dealer will pay off some or all of the financing or lease on a consumer’s trade-in vehicle. The Commission is finalizing paragraph (j) of § 463.3 largely as proposed, with minor modifications—substituting ‘‘Dealer’’ for ‘‘Motor Vehicle Dealer’’ and capitalizing ‘‘Vehicle’’—to conform with the revised definitions of ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle’ ’’ and ‘‘ ‘Covered Motor Vehicle Dealer’ or ‘Dealer’ ’’ at § 463.2(e) and (f). The Commission received several comments in response to this paragraph, including from individual commenters who expressed support for prohibiting dealers from misrepresenting whether they would pay off outstanding balances VerDate Sep<11>2014 19:33 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00032 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 283

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 214 See, e.g., Individual commenter, Doc. No. FTC–2022–0046–3770 (‘‘I agree that these changes need to take place. No one should have to pay what was owed on a trade in after the dealership said they would pay off the trade in . . . .’’). 215 For example, commenters stated that occasionally the previous finance or lease source will not provide a timely payoff for a traded vehicle or will refuse to accept a payoff claiming more money is due; or a previous finance or lease source may accept a payoff, but will refuse to credit its former customer’s account and release the title promptly. In addition, an industry association commenter requested that the Commission narrow this prohibition to specifically address the fact patterns giving rise to it that the Commission sets forth in the NPRM, and, in so doing recognize that it is in a dealer’s business interest to pay off the existing loan quickly so that the vehicle can be more easily and quickly retailed. 216 See paragraph-by-paragraph analysis of § 463.3(e) in SBP III.C.2(e) (discussing deception and reasonable basis).

217 See Individual commenter, Doc. No. FTC– 2022–0046–7905 at 1.

218 See Comment of State of S.C. Dep’t of Consumer Affs., Doc. No. FTC–2022–0046–7891 at 6.

219 Individual commenter, Doc. No. FTC–2022– 0046–2364 (‘‘Many favorable ([i.e.] 5 star) Dealer reviews I have read appear suspect with generic, similar wording (or no wording at all) seemingly provided to offset lower Dealer ([i.e.] 1 star) ratings. I recommend that for [§ 463.3(k)] the following (or similar) be appended: Additionally, consumer reviews may not be created, editorialized, modified or removed by any Dealer or third party acting at the direction of any Dealer. Consumer reviews should be modifiable or removable by the originating author.’’).

remaining on a trade-in vehicle.214 Other commenters, including an industry association and dealership associations, requested that the Commission limit dealer responsibility under this provision for unanticipated delays stemming from circumstances beyond a dealer’s reasonable control, arguing that proposed § 463.3(j) made no exception for unanticipated delays such as a previous financing source declining to accept a payoff or refusing to release the vehicle title after receiving a payoff.215 The Commission notes that, as is the case under current law, under this provision, dealers are not permitted to make claims about whether or when they will pay off some or all of the financing or lease on a consumer’s trade-in vehicle if the truth of those claims depends on circumstances outside their control and the dealer does not possess a reasonable basis for such claims.216 An individual commenter contended that requiring additional disclosures about this provision would confuse the consumer.217 This provision, however, does not necessitate any affirmative disclosures from dealers. Instead, it prohibits dealers from misleading consumers about whether or when they will pay off some or all of the financing or lease on a consumer’s trade-in vehicle.

One State consumer protection agency commenter requested that the Commission require, in situations where a buyer’s credit information or trade-in vehicle are evidently insufficient to support a deal, that the dealer require additional down payment or other security, or affirmatively disclose that the dealer is not responsible for paying off liens.218 Without further information on the costs and benefits of such a proposal, the Commission declines to add such requirements to this Final Rule. The Commission notes, however, that the Rule prohibits dealers from misleading consumers regarding when trade-in vehicles have negative equity and from otherwise failing to obtain the consumer’s express, informed consent prior to charging the consumer for any item, including any amounts associated with trading in a vehicle. The Commission will continue to monitor this area to determine whether any such additional measures are warranted to protect consumers or competition. The Commission also received a number of comments from dealership associations arguing that existing State and Federal laws address dealers’ obligations in connection with informing consumers how much each consumer is responsible for financing. The Commission notes that commenters presented no actual conflicts between this provision and other laws, and to the extent duplicative laws prohibit misrepresentations in this area, the Commission has not observed harmful consequences to consumers or competition. Further, as noted elsewhere in the section-by-section analysis, State laws may provide more or less specific requirements as long as those requirements are not inconsistent with part 463, under § 463.9, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency.

After carefully considering the comments, the Commission is finalizing this provision with the two minor modifications to conform with the defined terms ‘‘ ‘Covered Motor Vehicle’ or ‘Vehicle’ ’’ and ‘‘ ‘Covered Motor Vehicle Dealer’ or ‘Dealer.’ ’’ This provision prohibits dealers from making misrepresentations about paying off the financing or lease on a trade-in vehicle. Such conduct includes misrepresenting to consumers who trade in a vehicle that the dealer will pay off any outstanding balance owed on the trade-in vehicle when the consumer purchases a vehicle from the dealer. For example, when such a dealer takes a trade-in, if the dealer remits payment to the entity to whom the trade-in payment is owed, as consumers would expect, but also adds this payment to the amount the consumer owes on the vehicle the consumer is purchasing from the dealer, the consumer is the party that has ultimately paid off the trade-in amount, contrary to the impression made by the dealer. This provision also prohibits dealers that are going out of business from representing expressly or by implication that they will pay off liens if they do not, in fact, pay off the liens, or do not pay them off in a timely manner. Such misrepresentations are likely to affect a consumer’s choice to visit a particular dealership or select a particular vehicle.

(k) Whether Consumer Reviews or Ratings Are Unbiased, Independent, or Ordinary Consumer Reviews or Ratings of the Dealer or the Dealer’s Products or Services Proposed § 463.3(k) prohibited misrepresentations about whether ‘‘consumer reviews or ratings are unbiased, independent, or ordinary consumer reviews or ratings of the Dealer or its products or services.’’ Upon careful review and consideration of the comments, the Commission is finalizing paragraph (k) of § 463.3 with one technical clarification to replace ‘‘its’’ with ‘‘the Dealer’s.’’ The Rule’s requirements apply to all individuals and entities that meet the definition of ‘‘Dealer.’’ An individual commenter recommended that the Commission modify this provision to include language explicitly prohibiting dealers from creating, editorializing, modifying, or removing consumer reviews.219 Here, the Commission notes that if such acts or practices would result in reviews that are not independent or do not otherwise reflect ordinary consumer experience, they already would violate this provision. For example, if a dealer created a positive review, edited or modified negative reviews to make them sound positive, or removed negative reviews while keeping positive reviews, such practices would violate this provision.

A few individual commenters recommended that the Rule include additional provisions related to consumer reviews, including a requirement for the creation of an online database for consumer reviews and complaints about dealerships, and a requirement for dealers to post consumer reviews online and in the dealership location. The Commission notes that while some reviews are available online, additional information could assist consumers, and the Commission will consider whether such VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00033 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 284

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 220 See, e.g., Fed. Trade Comm’n, Notice of Proposed Rulemaking, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 88 FR 49364 (July 31, 2023) (to be codified at 16 CFR 465), https://www.govinfo.gov/content/pkg/FR- 2023-07-31/pdf/2023-15581.pdf; Fed. Trade Comm’n, Guides Concerning Use of Endorsements and Testimonials in Advertising, 16 CFR 255; Fed. Trade Comm’n, ‘‘FTC’s Endorsement Guides: What People are Asking,’’ https://www.ftc.gov/businessguidance/resources/ftcs-endorsement-guides-whatpeople-are-asking; Fed. Trade Comm’n, ‘‘Soliciting and Paying for Online Reviews: A Guide for Marketers,’’ https://www.ftc.gov/business-guidance/ resources/soliciting-paying-online-reviews-guidemarketers; Fed. Trade Comm’n, ‘‘Disclosures 101 for Social Media Influencers,’’ https://www.ftc.gov/ business-guidance/resources/disclosures-101social-media-influencers. 221 See Complaint ¶¶ 73–78, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16-cv-07329 (C.D. Cal. Sept. 29, 2016); see also Fed. Trade Comm’n, Notice of Proposed Rulemaking, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 88 FR 49364, 49371–75 (July 31, 2023) (to be codified at 16 CFR 465), https:// www.govinfo.gov/content/pkg/FR-2023-07-31/pdf/ 2023-15581.pdf (discussing such enforcement actions).

222 See Complaint ¶¶ 73–78, Fed. Trade Comm’n v. Universal City Nissan, Inc., No. 2:16-cv-07329 (C.D. Cal. Sept. 29, 2016). 223 One commenter conducted a study of Google reviews of U.S. car dealerships from April 2008 to September 2022. The commenter found by examining a 2% sample of these reviews that consumers gave on average 4.47 stars out of 5 stars and made several other conclusions about consumer satisfaction with the auto transaction experience based on that methodology. Comment of Inst. for Regul. Analysis & Engagement, Doc. No. FTC–2022–0046–10164 at 2–5. The Commission notes that, consistent with its enforcement experience, there is no guarantee that those reviews are a genuine reflection of consumer experience. Moreover, the Commission notes that oftentimes consumers do not realize that they have been charged without their authorization. See SBP II.B. Thus, such a study that relies on Google star ratings is not conclusive of consumer experience. 224 See § 463.1 (‘‘It is an unfair or deceptive act or practice within the meaning of section 5(a)(1) of the Federal Trade Commission Act (15 U.S.C. 45(a)(1)) to violate any applicable provision of this part, directly or indirectly . . . .’’). 225 See 15 U.S.C. 45b.

226 Individual commenter, Doc. No. FTC–2022– 0046–7445 at 17.

227 The Commission discussed government impersonation scams in its Notice of Proposed Rulemaking for a Trade Regulation Rule on Impersonation of Government and Business. See 87 FR 62741 (Oct. 17, 2022). The Commission observed, inter alia, ‘‘ongoing widespread fraud measures are needed as it continues to monitor the marketplace, including after the Rule goes into effect. Several dealership associations asked what type or format of reviews or ratings would be covered by this proposed provision. As proposed, § 463.3(k) applied to all reviews or ratings, in any format or wherever displayed, that are likely to mislead consumers as to whether such reviews or ratings are unbiased, independent, or ordinary consumer reviews or ratings. Relatedly, industry and dealership associations contended that the language used in the proposed provision was vague and confusing, and requested that the Commission further define the phrase, ‘‘unbiased, independent, or ordinary consumer reviews or ratings.’’ To begin, the operative terms in this phrase are commonly used and understood and may be interpreted according to their plain meaning without further definition. Moreover, the Commission has, for decades, provided information and guidance on avoiding deception through the use of endorsements, testimonials, and online reviews.220 Enforcement actions by the Commission have documented examples of the types of misrepresentations that would be covered by this provision.221 For example, dealerships and their employees have posted positive, fivestar online reviews that falsely purport to be objective or independent.222 As these sources make clear, a person who is unbiased, independent, and an ordinary consumer would be someone who was not paid or given something of value to write a review and who has no employment or familial relationship or other unexpected material connection to the dealership.223 An industry association commenter expressed concern that this proposed provision did not appear to be limited to misrepresentations that may occur when a dealership, and not an unrelated third party, affirmatively publishes consumer reviews. To the extent an independent third party that does not have a material connection with the dealership makes any such claims, those claims would not be covered by this provision. This provision concerns situations where there is such a relationship between the third party and the dealer. For example, if a dealer were to pay a third party or consumer to post positive reviews that misrepresent their status as unbiased, independent, or ordinary consumer reviews, the dealer would be violating this provision.224 One industry association commenter contended that the Consumer Review Fairness Act 225 already prohibits the conduct covered by this provision. The Consumer Review Fairness Act makes it illegal for businesses to have form contracts that disallow or restrict consumers from posting negative reviews. Section 463.3(k) prohibits misrepresentations regarding the authenticity of consumer reviews generally. These provisions are not in conflict, and as discussed in SBP III.C.1, to the extent the provision creates any duplication, the Commission has seen no harm to consumers or competition from duplicative prohibitions of deceptive conduct.

Whether reviews or ratings about a seller or the seller’s products or services are from unbiased, independent, or ordinary consumers is material to consumers’ decision-making because a consumer is more likely to interact with a particular dealership if the dealership has positive reviews or ratings from unbiased, independent, or ordinary consumers. Thus, after careful review of all the comments, the Commission is finalizing paragraph (k) of § 463.3 without substantive modification from the Commission’s original proposal. (l) Whether the Dealer or Any of the Dealer’s Personnel or Products or Services Is or Was Affiliated With, Endorsed or Approved by, or Otherwise Associated With the United States Government or Any Federal, State, or Local Government Agency, Unit, or Department, Including the United States Department of Defense or Its Military Departments Proposed § 463.3(l) prohibited misrepresentations that ‘‘the Dealer or any of its personnel or products or services is or was affiliated with, endorsed or approved by, or otherwise associated with the United States government or any Federal, State, or local government agency, unit, or department, including the United States Department of Defense or its Military Departments.’’ Upon careful review and consideration of the comments, the Commission is finalizing paragraph (l) of § 463.3 with one technical clarification to replace ‘‘its’’ with ‘‘the Dealer’s.’’ The Rule’s requirements apply to all individuals and entities that meet the definition of ‘‘Dealer.’’ One individual commenter recommended that the Commission additionally prohibit dealers from ‘‘causing any person to impersonate a police officer for any purpose.’’ 226 The commenter contended that such a prohibition would address a common yo-yo financing tactic, wherein dealers exert pressure on consumers to return vehicles by calling the consumers on the phone, falsely claiming to be police officers, and falsely representing that there is a warrant for the consumers’ arrest or that the dealer has reported the consumers’ vehicles as stolen. The Commission is likewise concerned about such conduct, and notes that it would be covered by the language in this paragraph, which applies broadly to misrepresentations of affiliation with, endorsement or approval by, or association with ‘‘any Federal, State, or local government agency, unit, or department,’’ including State or local police officials.227 By misrepresenting VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00034 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 285

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations schemes in which scammers impersonate law enforcement or government officials in attempts to extort money or steal personally identifiable information.’’ See id. at 62742 (citing announcements on March 7, 2022, and May 20, 2022, by the Federal Bureau of Investigation and the Social Security Administration’s Office of the Inspector General, in coordination with other Federal law enforcement agencies, respectively). 228 One commenter further opined that ‘‘the Department of Defense has itself dealt with this situation in the case of military lending and sales.’’ Comment of Kan. Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–4510 at 7. 229 Comment of N.C. Auto. Dealers Ass’n, Doc. No. FTC–2022–0046–11223 at 9. 230 See, e.g., Complaint ¶¶ 5–6, 9–11, 14, Traffic Jam Events, LLC, No. 9395 (F.T.C. Aug. 7, 2020) (alleging auto marketer misrepresented that it provided COVID–19 stimulus relief to consumers); Complaint ¶¶ 14–26, Fed. Trade Comm’n v. Ponte Invs., LLC, No. 1:20–cv–00177 (D.R.I. Apr. 17, 2020) (alleging misrepresentation of government affiliation by company that impersonated the U.S. Small Business Administration with business names ‘‘SBA Loan Program’’ and ‘‘SBA Loan Program.com’’ and claimed to help businesses obtain access to coronavirus relief programs administered by the agency); Complaint ¶¶ 24–36, Fed. Trade Comm’n v. DOTAuthority.com, Inc., No. 0:16–cv–62186 (S.D. Fla. Sept. 13, 2016) (alleging defendants misrepresented affiliation with U.S. Department of Transportation by claiming to be the ‘‘Compliance Unit’’ of ‘‘DOTAuthority’’ and providing a telephone number with a Washington, DC area code).

231 See, e.g., Fed. Trade Comm’n, ‘‘The Road Ahead: Selling, Financing, & Leasing Motor Vehicles,’’ Public Roundtable, Panel 1: Military Consumers and the Auto Sales and Financing Process, Remarks by Hollister K. ‘‘Holly’’ Petraeus, Dir., Off. of Servicemember Affs., CFPB, Tr. at 11 (Aug. 2, 2011), https://www.ftc.gov/system/files/ documents/public_events/52654/080211_ftc_ sess1.pdf (‘‘[S]ervicemembers don’t always realize if they buy and finance a car here in the U.S., they can’t take it out of the country unless they have a letter of permission from the lienholder to do so. And some of the lienholders won’t give that permission. . . . [W]e [heard from] a JAG in Germany saying, ‘I see a number of people who end Continued police involvement in potential vehicle repossession, such conduct would also violate paragraph (o) of § 463.3 of the Final Rule.

A number of dealership association commenters contended that some States address this type of deception.228 As noted in response to similar commenter contentions regarding other proposed provisions, the Commission has seen no harm to consumers or competition from duplicative misrepresentation prohibitions, and overlap between the Commission’s Rule provisions and existing law is indicative of dealers’ ability to comply with these provisions. Moreover, including such a provision in the Final Rule additionally benefits consumers who encounter such conduct, and aids law-abiding dealers that otherwise lose business to competitors that act unlawfully. Further, § 463.9 discusses part 463’s relation to State laws.

A dealership association commenter claimed that many dealerships in the commenter’s State work with military personnel to promote charitable causes, and questioned whether a banner listing a dealership at a charitable military event would be considered a misrepresentation that the dealership is ‘‘associated’’ with the military.229 Here, the Commission notes that a banner that conveys true participation in a charitable military event, and does not deceptively represent an affiliation with, endorsement or approval by, or association with the military, would not violate this provision. The Commission’s law enforcement practice provides further guidance on this point: the Commission’s many enforcement actions alleging misrepresentation of government affiliation provide examples of the types of conduct that would violate this provision.230 Representations about whether a seller or any of its personnel, products, or services is or was affiliated with, endorsed or approved by, or otherwise associated with the government are likely to affect consumers’ conduct. Consumers are more likely to visit a dealership and select a vehicle or product if they believe that a specific dealer or a dealer’s personnel, products, or services have been approved by a government entity. The Commission thus adopts paragraph (l) of § 463.3 without substantive modification from the Commission’s original proposal. (m) Whether Consumers Have Won a Prize or Sweepstakes Proposed § 463.3(m) prohibited misrepresentations about whether consumers have won a prize or sweepstakes. Upon careful review and consideration of the comments, the Commission is finalizing paragraph (m) of § 463.3 without modification from its original proposal.

Comments from dealership associations contended that some States or municipalities address this type of deception. As discussed in SBP III.C.1, the Commission has not seen harm to consumers or competition from multiple prohibitions against misrepresentations. Furthermore, any significant overlap between the Commission’s Rule provisions and existing law is indicative of dealers’ ability to comply with these provisions. Finally, § 463.9 discusses part 463’s relation to State laws. Misrepresentations about whether consumers have won a prize or sweepstakes harm consumers by inducing consumers to choose and transact with a particular dealership under false pretenses. Thus, the Commission adopts paragraph (m) of § 463.3 without modification from the Commission’s original proposal. (n) Whether, or Under What Circumstances, a Vehicle May Be Moved, Including Across State Lines or Out of the Country Proposed § 463.3(n) prohibited misrepresentations regarding whether, or under what circumstances, a vehicle may be moved, including across State lines or out of the country. Upon careful review and consideration of the comments, the Commission is finalizing paragraph (n) of § 463.3 largely as proposed, with the minor modification of capitalizing the word ‘‘State,’’ as well as the defined term ‘‘Vehicle’’ to conform with the revised definition at § 463.2(e).

The Commission received comments including from dealership associations arguing that proposed § 463.3(n) would pose issues for dealers who must comply with limitations imposed by manufacturers or distributors on the export of new motor vehicles. These commenters requested clarification about liability under this provision in the event dealers communicate any such export limitations to consumers or take other steps to prevent the export of new vehicles. Section 463.3(n), however, does not prohibit dealers from accurately and non-deceptively communicating whether, or under what circumstances, a vehicle may be moved—it instead prohibits representations that mislead consumers about this information.

Commenters including a dealership association objected to this proposed provision by asserting that a State or insurance company may prescribe, and the parties to a contract may agree upon, whether a leased or purchased vehicle may be driven to a particular area. This provision, however, does not prevent parties from discussing and agreeing to whether a vehicle may be moved. Instead, § 463.3(n) prohibits misrepresentations about whether, or under what circumstances, a vehicle may be moved, including regarding any liens or other restrictions that would prevent or hinder consumers’ ability to move the vehicle beyond certain boundaries. Furthermore, interaction with State laws is explained in the section-by-section analysis of § 463.9. Representations about whether, and under what circumstances, a consumer may move a vehicle are material as they are likely to affect a reasonable consumer’s decision to purchase a vehicle, including decisions of military consumers who may frequently need to move.231 VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00035 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 286

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations up having to do what you would call ‘‘voluntary repossession’’ on their car because they bought this car, they’re excited about it, and . . . the person who made them the loan didn’t say ‘‘Oh, by the way, if you go overseas, we’re not gonna let you take it with you.’’’ And . . . sometimes, they’ll find that their warranty is no good overseas, either.’’). 232 Comment of 18 State Att’ys Gen., Doc. No. FTC–2022–0046–8062 at 13. 233 See, e.g., Complaint ¶¶ 10–21, CFPB v. USASF Servicing, LLC, No. 1:23-cv-03433–VCM (N.D. Ga. Aug. 2, 2023); Consumer Fin. Prot. Bureau, ‘‘Supervisory Highlights: Issue 28, Fall 2022’’ 6–7 (Nov. 2022), https://files.consumerfinance.gov/f/ documents/cfpb_supervisory-highlights_issue-28_ 2022-11.pdf (finding that, in certain instances, auto servicers engaged in unfair acts or practices by activating vehicle disabling devices in consumers’ vehicles when consumers were not past due on payment, contrary to relevant contracts and disclosures, including by causing the devices to sound late payment warning beeps and by preventing consumers from starting their vehicles). 234 See 15 U.S.C. 45; see also, e.g., Int’l Harvester Co., 104 F.T.C. 949, 1064–67 (1984) (finding that manufacturer’s failure to adequately disclose that its tractors had a serious safety hazard constituted unfair conduct, where the hazard caused serious injury to a small number of consumers, consumers could not have reasonably avoided the harm because the respondent did not adequately disclose the serious risk, and the cost of the respondent disclosing the risk was very small in relation to the substantial injury).

235 See 50 U.S.C. 3952(a). 236 NPRM at 42022.

Based on a review of the comments and for the reasons previously discussed, the Commission is finalizing paragraph (n) of § 463.3 largely as proposed, with the minor modification of capitalizing ‘‘State’’ and the defined term ‘‘Vehicle.’’ (o) Whether, or Under What Circumstances, a Vehicle May Be Repossessed Proposed § 463.3(o) prohibited misrepresentations regarding whether, or under what circumstances, a vehicle may be repossessed. After careful review and consideration of the comments, the Commission is finalizing paragraph (o) of § 463.3 with the minor modification of capitalizing the defined term ‘‘Vehicle’’ to conform with the revised definition at § 463.2(e). A number of commenters, including consumer advocacy organizations and a group of State attorneys general, expressed concern about electronic disablement of vehicles, including through the use of starter interrupt devices, which are sometimes utilized for vehicle repossession. Many of these commenters expressed concern about the potential for harm to consumers if such devices are activated without regard to the location or operational state of the vehicle, and recommended that the Commission restrict their use. Alternatively, one such commenter recommended that the Commission add a provision to part 463 that would require dealers to disclose any such technology, obtain the consumer’s express, informed consent to its use, and limit its use to one time, not to exceed 30 days, once a consumer is in default. Finally, the comment from a group of State attorneys general recommended that the Commission require additional disclosures any time a starter interrupt device is installed, provide advance notice to consumers prior to activating such devices, and enable consumers to restart their vehicles in emergency or unsafe situations.232 The Commission recognizes the potential for abuse with regard to vehicle disablement technology.233 It is already illegal under section 5 of the FTC Act to engage in deception, including regarding vehicle disablement technology, and to unfairly cause substantial injury to consumers, such as by disabling a vehicle while it is being operated on the highway.234 This provision will further provide protection for consumers from unfair or deceptive conduct surrounding the repossession of vehicles. Moving forward, the Commission will continue to monitor the motor vehicle marketplace for developments in this area to determine whether additional restrictions are warranted. A number of dealership association commenters contended that this provision would inhibit dealers from making representations about their lawful rights to repossess vehicles, positing that, upon making any such representations, this provision might require dealers to carry out repossessions without exception or risk violating this provision. This provision, however, does not prevent dealers from providing accurate information to consumers about when a vehicle can, or will, be repossessed. Even where dealers have a lawful right to repossess a vehicle, current law, as well as this provision, prohibit dealers from misrepresenting whether or when they may take such action. Current law, including at the Federal level, imposes some such restrictions in this regard: for example, the Servicemembers Civil Relief Act prohibits repossession of vehicles during a servicemember’s period of military service without a court order, as long as the servicemember either placed a deposit for the vehicle or made at least one installment payment on the contract before entering military service.235 This provision prevents dealers from representing that they may repossess military consumers’ vehicles under such circumstances. However, dealers may still accurately and non-deceptively inform a consumer about the circumstances under which a vehicle can be repossessed or when the dealer may take action. In providing consumers with such information, however, dealers must refrain from representing, including by implication, that repossession is likely when in truth it is not.

After considering the comments, the Commission is finalizing paragraph (o) of § 463.3 largely as proposed, with the minor modification of capitalizing the defined term ‘‘Vehicle.’’ This provision prohibits dealers from making misrepresentations regarding material information about repossession of a vehicle. Information about whether, or under what circumstances, a vehicle may be repossessed is likely to affect consumers’ conduct, including by impacting military consumers’ conduct regarding which payments to prioritize while serving our country. (p) Any of the Required Disclosures Identified in This Part Proposed § 463.3(p) prohibited misrepresentations of any of the required disclosures identified in this part. As the Commission noted in its NPRM, this was including but not limited to representations that limit or contradict the required disclosures.236 Upon careful review and consideration of the comments, the Commission is finalizing paragraph (p) of § 463.3 as proposed.

The Commission received a dealership association comment that contended generally that the proposed prohibited misrepresentations in this provision were already addressed in State statutes and regulations, and asserted that such State measures should suffice given that, according to the commenter, State regulators are more readily available to the public. As discussed in SBP III.C.1, the Commission has seen no harm to consumers or competition from duplicative prohibitions of deceptive conduct, and commenters did not cite State laws that permit misrepresentations or otherwise present a possible conflict with the Rule. Moreover, the Final Rule provides additional remedies that will benefit consumers who encounter conduct that is already illegal under State or Federal law, including by adding a mechanism for the Commission to redress consumers injured by a dealer’s violation of the rule, and will assist lawabiding dealers that presently lose business to competitors that act unlawfully. Furthermore, State laws VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00036 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

Page 287

Federal Register / Vol. 89, No. 3 / Thursday, January 4, 2024 / Rules and Regulations 237 See 15 U.S.C. 57a(a)(1)(B) (the Commission ‘‘may include requirements prescribed for the purpose of preventing’’ such unfair or deceptive acts or practices).

238 15 U.S.C. 45.

239 Comment of Or. Consumer Just., Doc. No. FTC–2022–0046–8492 at 4; cf. Individual commenter, Doc. No. FTC–2022–0046–0144 (recommending the disclosed offering price separately list MSRP, markup, all fees, and add-on costs); Comment of Legal Aid Just. Ctr., Doc. No. FTC–2022–0046–7833 at 2 (‘‘[D]ealers should be required to verbally disclose and explain in a language the customer understands the material terms of the contact [sic] (including APR, total number of monthly payments required, etc.) before customers sign[] the contract and receive the customers’ consent that they understand these terms. After this verbal disclosure, a consent form should be required. This form should be provided in the language preferred by the customer, and should ensure that the customer was provided with accurate and agreed-upon terms prior to signing.’’); Individual commenter, Doc. No. FTC–2022–0046– 1641 (‘‘Mortgage lenders are required to give a borrower a disclosure document prior to closing to show all costs and expenses; car dealers should have to do the same thing.’’). 240 In addition to the disclosures noted, a few commenters requested additional provisions to address concerns regarding transparency in pricing, Continued may provide more or less specific requirements, as long as those requirements are not inconsistent with part 463, and in the event of an inconsistency, the Rule only affects such State law to the extent of the inconsistency. Accordingly, the Commission adopts this provision without modification from its original proposal.

The Commission hereby determines it is an unfair or deceptive act in violation of the FTC Act for any dealer to make any misrepresentations, expressly or by implication, regarding material information about the subjects set forth in the paragraphs of § 463.3. Such misrepresentations are likely to cause consumers to waste significant time or money beyond what dealers led them to believe would be necessary to purchase or lease a vehicle. Thus, these misrepresentations are material and are likely to cause substantial injury to consumers. This injury is not reasonably avoidable by consumers themselves because information about the truth or falsity of the dealer’s misrepresentations is within the control of the dealer, and there are no countervailing benefits to consumers or to competition from the illegal practice of making misrepresentations. Further, these provisions also serve to help prevent dealers from failing to make disclosures required by § 463.4, and from charging for add-ons that provide no benefit and from failing to obtain express, informed consent for charges, as required by § 463.5, including by prohibiting misrepresentations regarding costs and terms.237 To reflect this, and without changing any substantive requirements for covered entities, the Commission is adding the following sentence to the end of § 463.3, at newly designated paragraph (q): ‘‘The requirements in this section also are prescribed for the purpose of preventing the unfair or deceptive acts or practices defined in this part, including those in §§ 463.4 and 463.5.’’ Thus, this Rule requires dealers to refrain from making material misrepresentations about the topics enumerated in § 463.3. The prohibitions contained in § 463.3 help protect consumers from deceptive representations and promote the ability of honest dealers to compete on honest terms.

D. § 463.4: Disclosure Requirements 1. Overview The proposed rule included five disclosure requirements for motor vehicle dealers regarding certain pricing and financing information (in proposed § 463.4(a) through (e)). These provisions proposed to require dealers to disclose a vehicle’s offering price; an add-on list with each optional add-on for which the dealer charges consumers and the price of each such add-on; that such add-ons are not required and that the consumer can purchase or lease a vehicle without the add-ons; and information about a vehicle’s total of payments when making certain representations about monthly payments.

In its NPRM, the Commission specifically requested comments regarding key aspects of the proposed disclosures. In response, various stakeholder groups and individuals provided comments regarding the proposed provisions. In this section, the Commission discusses the comments, responses to the comments, and any changes made to this section based on the comments.

The Commission received many comments in favor of its proposal, including from consumer groups, financial services groups, dealerships and dealership employees, individual consumers, and others. These comments supported the proposed disclosures as addressing bad actors and unlawful practices in the automotive marketplace while promoting transparency, reducing consumer confusion, and refraining from inhibiting consumer choice or materially increasing the time or paperwork required.

A number of such comments, however, urged the Commission to adopt additional disclosures, both in the areas covered by its proposal and elsewhere. Regarding disclosures covered in the proposal, for example, commenters suggested more detailed requirements, including regarding specific disclosure language and specific placement of disclosures. The Commission agrees with commenters that key information affecting pricing, add-ons, and costs must be disclosed clearly and conspicuously to consumers in order to address consumer deception and unauthorized charges during the motor vehicle buying and leasing process. To provide flexibility for dealers and room for disclosures to be made in a manner that is clear and conspicuous to consumers in particular circumstances, however, the Commission declines to include additional prescriptive language about the form of such disclosures. Further, the Commission emphasizes that, in accordance with the provision being finalized at § 463.3(p), any material misrepresentations regarding the disclosures in the Final Rule violate section 5 of the FTC Act 238 and part 463.

The additional disclosures recommended by commenters included, inter alia: a disclosure regarding the installation and use of any electronic disabling devices; a disclosure explaining the fees certain lenders may charge to accept a consumer’s loan application; a disclosure of the invoice price, or the price a dealer paid the manufacturer for the vehicle; a disclosure of any potential value gap between a vehicle’s price and its appraised value; a disclosure, prior to purchase negotiations, of any potential financing limitations imposed by the dealer; a disclosure of credit characteristics relied upon by the dealer and certain terms; a disclosure that, as with a mortgage loan settlement statement, itemizes all the elements of the sale for car purchases; 239 and disclosure signage in dealership showrooms or on sales desks explaining that add-ons are not required. As for disclosures in additional areas, the Commission recognizes that vehicle purchase and lease transactions are lengthy and document-heavy, and while consumers may benefit from additional information, each additional disclosure requirement could increase the cost to comply with part 463 and would risk crowding out the information in the Commission’s proposed disclosures. Accordingly, the Commission has determined not to expand § 463.4 of this Final Rule to include additional disclosures.240 The Commission will VerDate Sep<11>2014 17:45 Jan 03, 2024 Jkt 262001 PO 00000 Frm 00037 Fmt 4701 Sfmt 4700 E:\FR\FM\04JAR2.SGM 04JAR2 khammond on DSKJM1Z7X2PROD with RULES2

The rest of the text is omitted here to keep this page loading quickly; the full document is in the PDF.