# Business Blog Posts

- Franchise Fundamentals: Considering, calculating, and consulting Franchise Fundamentals: Considering, calculating, and consultinglfairJuly 10, 2023 | 10:49AM  Franchise Fundamentals: Considering, calculating, and consulting            By                  Lesley Fair                    You think a franchise may be for you. You can’t wait to cut that ribbon and get your business up and running. But to avoid a false start, it makes sense to spend more time in the starting block. This post – the fourth in the FTC’s Franchise Fundamentals series – covers key steps to take before you’re off to the races: 1) carefully evaluating critical documents that may (or may not) be attached to the Franchise Disclosure Document, 2) scrutinizing the financial performance representations included in the Franchise Disclosure Document; and 3) running through every detail of the deal with an experienced attorney and accountant. Evaluate the franchise documents.  The third post in the Franchise Fundamentals series covered points to consider when studying the Franchise Disclosure Document. But the FDD is just where your reading starts. As A Consumer’s Guide to Buying a Franchise explains, the FDD is just one of three critical documents you need to evaluate. The second is the Franchise Agreement itself – the binding contract between you and the franchisor, which should be attached to the FDD. The Franchise Agreement will typically restate some of the information in the FDD – your territory, franchisee payments, advertising and marketing standards, trademark use, the performance standards the franchisor will hold you to, renewal terms (including whether you may be asked to sign a new Franchise Agreement with materially different terms) or termination rights, etc. An obvious red flag would be any discrepancy between what’s in the FDD and what the Franchise Agreement says.                   Image                                          Furthermore, time may have passed between when you received the FDD and when you’re ready to sign the Franchise Agreement. Don’t approach the dotted line without asking the franchise seller if the franchisor has made any updates to the FDD or if there have been any changes to the financial performance information included in the FDD. If there have been, be sure to get copies of any updated information and study the documents carefully. Also ask the franchisor whether there are any differences between the Franchise Agreement that was attached to the FDD and the one you’re expected to sign. Confirm this yourself with a scrupulous side-by-side reading. If there are material differences between the two, the franchisor must give you more time to review those changes before you sign the agreement. The third important document to review is the franchisor’s Operating Manual. The Operating Manual includes the nuts and bolts of how you’ll need to run the franchise – including the hours and days of operation, interiors, uniforms, equipment, mandatory suppliers, and other requirements that have a profound impact on day-to-day management. The FTC Franchise Rule doesn’t require franchisors to provide their manual, but it may raise another red flag if a franchisor isn’t willing to share it. Another factor to consider is that the Franchise Agreement may give the franchisor the right to change the Operating Manual at any time. Those unilateral changes may include things like redecorating, modifications to the payment systems, or new fees and product offerings – all of which may mean big extra costs to franchisees.  Scrutinize financial performance representations.  Item 19 of the FDD addresses financial performance representations – claims the franchisor makes about sales or earnings. The Franchise Rule doesn’t require a franchisor to provide that information, but if a franchisor has made representations of that nature, they must be in Item 19. If the franchisor or any franchise seller has said things about sales or earnings in discussions with you, but those claims aren’t in the FDD, raise the red flag. Here are some other key considerations when studying financial performance representations.Potential earnings.  If a franchisor makes claims about potential income or sales, the law says it must have a “reasonable basis” to back up the statements. A hope or a hunch isn’t enough. They need solid proof. They also must tell you the source and limitations of the data they’re relying on and any important assumptions on which the claims are based. You have a legal right to written substantiation that supports their claims, so be sure to ask.Average income.  If a franchisor tell you its franchisees earn an average income of $75,000 a year, that doesn’t tell you much about how individual franchisees performed. Calculating earnings that way can allow the results from a few highly successful outlets to hide the disappointing results from other franchisesGross sales.  Providing franchisees’ gross sales also has the potential for deception because it doesn’t factor in their actual costs or profits. An outlet with high gross sales on paper might be losing money because of high overhead, rent, and other expenses.Net Profits.  Franchisors often don’t have data about franchisees’ net profits. But if you get that information, ask if it’s based on results from company-owned outlets. If they are, keep in mind that those results may differ from your own because company-owned outlets often have lower costs. Geographic Relevance.  Earnings may vary with geography. If a franchisor provides sales or income numbers, ask if that data came from franchisees in your area. In addition, consult the FDD, which should state whether there are geographic differences between the franchisees whose earnings are reported and your anticipated location.An important fact-check on any earning claims the franchisor makes to you will be your in-depth discussions with existing and former franchisees listed in the FDD – or those you identity from other sources. If their results don’t line up with what the franchisor has told you, it’s another red flag.Franchisors may ask you to sign a statement – sometimes presented as a written interview or questionnaire – that asks, among other things, whether you received any earnings or financial performance representations during the course of buying a franchise. If they gave you any information about how much your franchise may earn, report it fully. Don’t be pressured to say otherwise. If you’re encouraged not to report the earnings representations, that’s a red flag. What’s more, you may be waiving any right to contest the earnings claims you used to make your buying decision.Consult an attorney and an accountant.  Prospective franchisees may have a legal background or financial experience, but regardless, all prospective franchisees should consult an attorney and an accountant before deciding to buy a franchise. Think of it this way: A lot of surgeons need to have their appendix removed, but they don’t perform the operation on themselves. Hire an experienced attorney to review the Franchise Disclosure Document, the Operating Manual, and the Franchise Agreement with you. Discuss with your attorney if there are provisions in the Franchise Agreement you’d like to change. If the franchisor isn’t willing to negotiate, it could be a bad omen for the future. Also consider consulting an accountant to review the franchisor’s financials and any financial performance representations. While you’re looking at the balance sheet line by line, your accountant may be able to discern things between the lines – where the “good stuff” often hides in financial documents. Even the most sophisticated titan of industry wouldn’t make a major financial commitment without talking it over with independent experts. Paying an attorney and an accountant up front could save you thousands (and a thousand headaches) in the future.Next in Franchise Fundamentals: What to do if you spot questionable practices related to the sale of a franchise. And check out the entire series:#1:  Debunking five myths about buying a franchise#2:  Researching franchise opportunities#3:  Taking a deep dive into the Franchise Disclosure Document#4:  Considering, calculating, and consulting#5:  Reducing the risks – and reporting if things go awry 
- $575 million Equifax settlement illustrates security basics for your business $575 million Equifax settlement illustrates security basics for your businesslfairJuly 22, 2019 | 6:48AM  $575 million Equifax settlement illustrates security basics for your business            By                  Lesley Fair                    Patch your software. Segment your network. Monitor for intruders. According to tech experts, those are security basics for businesses of any size. But when you’re industry giant Equifax – a company in possession of staggering amounts of highly confidential information about more than 200 million Americans – it’s almost unthinkable not to implement those fundamental protections. An FTC, CFPB, and State AG settlement of at least $575 million illustrates the injury to consumers when companies ignore reasonably foreseeable (and preventable) threats to sensitive data. Read on for security tips for your business and what consumers can do to get compensation for their losses and sign up for free credit monitoring.The Equifax data breach has been in the headlines, but what happened behind the scenes? According to the complaint, in March 2017, US-CERT – Homeland Security’s cyber experts – alerted Equifax and other companies about a critical security vulnerability in open-source software used to build Java web applications. The alert warned anyone using a vulnerable version of the software to update it immediately to a free patched version. It didn’t take long before the press reported that hackers had already started to exploit the vulnerability.Equifax’s security team got the US-CERT alert on March 9, 2017, and sent it to more than 400 employees with instructions that the staffers responsible for the affected software should patch it within 48 hours, as required by the company’s Patch Management Policy. Within a week, Equifax performed a scan intended to search for vulnerable forms of the software remaining on its network. But the scan Equifax conducted wasn’t up to the task, which ultimately proved devastating to consumers. According to the complaint, the company used an improperly configured automatic scanner that failed to detect that the vulnerable software was alive and well on a part of the company’s Automated Consumer Interview System (ACIS). The lawsuit alleges that Equifax didn’t detect the “open sesame” vulnerability in its system for months.How sensitive was the data stored on the ACIS portal? If it’s been a while since you’ve made that hands-on-face shriek from “Home Alone,” now may be the time because it was the portal where Equifax collected information about consumer disputes, including documentation uploaded by consumers. In addition, Equifax used that platform for consumer credit freezes, fraud alerts, and even requests for a free annual credit report. Thus, millions of consumers interacted with the ACIS portal every year. The complaint outlines the specifics, but suffice it to say that for infocrooks looking for Social Security numbers, dates of birth, credit card numbers, expiration dates, and the like, the data on ACIS was Grade A primo stuff.Compounding the injury to consumers was the fact that ACIS was originally built in the 1980s and even in-house Equifax documents referred to it as “archaic” and “antiquated technology.” What’s more, the complaint alleges that when Equifax sent that email to more than 400 of its employees warning them about the need for the patch, the company didn’t alert the staff member responsible for the part of ACIS with the vulnerability.Equifax failed to discover the unpatched vulnerability for more than four months. In late July 2017, the company’s security team spotted suspicious traffic on the ACIS portal. They blocked it, but identified additional questionable traffic the next day. That’s when Equifax took the platform offline and hired a forensic consultant who determined that hackers had already exploited the vulnerability. But it gets worse. The consultant figured out that once inside the ACIS system, attackers were able to gain access to other parts of the network and rummage through dozens of unrelated databases also containing highly confidential information. In addition, they accessed a storage space connected to the ACIS databases that included administrative credentials stored in plain text, which they used to grab even more sensitive data. According to Equifax’s forensic analysis, attackers were able to steal (among other things) approximately 147 million names and dates of birth, 145 million Social Security numbers, and 209,000 credit and debit card numbers and expiration dates.The complaint alleges that a number of Equifax’s actions – and failures to act – led to violations of the FTC Act and the Gramm-Leach-Bliley Safeguards Rule, which requires financial institutions to implement and maintain a comprehensive information security program. For example:Equifax didn’t check to make sure employees followed through on the patching process;Equifax failed to detect that a patch was needed because the company used an automated scan that wasn’t properly configured to check all the places that could be using the vulnerable software;Equifax failed to segment its network to limit how much sensitive data an attacker could steal;Equifax stored admin credentials and passwords in unprotected plain-text files;Equifax failed to update security certificates that had expired 10 months earlier; andEquifax didn’t detect intrusions on “legacy” systems like ACIS.The complaint cites those as factors that contributed to a breach of consumers’ personal information of massive proportions.The settlement requires Equifax to pay at least $300 million to a fund that will provide affected consumers with credit monitoring services, compensate people who bought credit or identity monitoring services from Equifax, and reimburse consumers for out-of-pocket expenses incurred as a result of the 2017 data breach. Equifax will add up to $125 million more to the fund if the initial payment isn’t enough to compensate consumers for their losses. Equifax also will pay $175 million to 48 states, the District of Columbia and Puerto Rico, and a $100 million civil penalty to the CFPB.  (The FTC doesn’t have legal authority to get civil penalties in a case like this.)Financial remedies are only part of the settlement. Under the order, Equifax must implement a comprehensive information security program requiring – among other things – that:Equifax must conduct annual assessments of internal and external security risks, implement safeguards to address them, and test the effectiveness of those safeguards;Equifax must assure that service providers with access to personal information stored by Equifax also implement appropriate security programs; andEquifax must get annual certifications from Equifax’s Board of Directors saying, in effect, “Yes, I attest that the company is complying with the order’s requirement of an appropriate information security program.”The Equifax settlement is a study in how basic security missteps can have staggering consequences. Here are some tips other companies can take from the case – and we didn’t have to look far for advice. The quotes are all from the FTC’s brochure, Start with Security.“Update and patch third-party software.” Companies should treat a security warning from US-CERT with the utmost seriousness. Equifax’s 48-hour Patch Management Policy may have looked good on paper, but paper can’t patch a critical software vulnerability. Of course, you should tell your IT team to implement appropriate patches and fixes. But you also need a belt-and-suspenders system to make sure your company follows through effectively.“Ensure proper configuration.” There’s nothing inherently wrong with using an automated vulnerability scan, but if it’s not set up to know where to look, it’s just another collection of zeros and ones. The complaint alleges that Equifax compounded the problem by not maintaining an accurate inventory of what systems ran what software – a fundamental practice that would have made it easier to find the vulnerability in the ACIS platform. “Monitor activity on your network.” Who’s coming in and what’s going out? That’s what an effective intrusion detection tool asks when it senses unauthorized activity. An effective system of intrusion detection could have helped Equifax detect the vulnerability sooner, thereby reducing the number of affected consumers. “Segment your network.” The idea behind ships’ watertight compartments is that even if one portion of the structure sustains damage, the entire vessel won’t go under. Segmenting your network – storing sensitive data in separate secure places on your system – can have a similar mitigating effect. Even if an attacker sneaks into one part of your system, an appropriately segmented network can help prevent a data oops from turning into a full-fledged OMG.The FTC has more security advice for businesses. Are you a consumer affected by the Equifax breach? Visit ftc.gov/equifax (also available in Spanish) for information about how to apply for compensation.  
- FTC says what was “invisible” about Invisible Mask was proof for its anti-virus claims FTC says what was “invisible” about Invisible Mask was proof for its anti-virus claimslfairOctober 23, 2023 | 11:58PM  FTC says what was “invisible” about Invisible Mask was proof for its anti-virus claims            By                  Lesley Fair                    According to a proposed settlement and a complaint filed by the FTC, two corporations, their President, and their CEO pitched a product called 1Virus Buster Invisible Mask, claiming that wearing the badge-like gizmo around the neck would create a three-foot barrier against 99.99% of viruses and bacteria, including COVID-19. But from the FTC’s perspective, the only thing invisible about Invisible Mask was scientific evidence supporting its claims.The substantiation may not have been visible, but the defendants’ promises to consumers were definitely up front and out there. According to one of the defendants’ websites:The 1 Invisible Mask offers three feet of protection from airborne viruses including Covid 19. This added protection is needed when masks are removed in order to eat, drink and speak filling that void. The quantum science behind the technology allows for this protective barrier to shield against pathogens and viruses – including COVID 19 – for up to 30 days.How could a badge worn around the neck protect consumers from COVID? The defendants explained it this way:The light-weight pouch containing the invisible barrier sits lower than one’s face and clips onto the clothing or worn loosely around the neck similar to an ID badge. In this way, the area surrounding the head and face receives the benefit of this invisible, protective formula. A patent pending technology called Isil-Chlor ensures the science by backing up the positive, proven results of this one-of-a-kind virus killer as reliable, safe, harmless, and easy as 1-2-3 to use.                  Image                                          According to the complaint, the defendants further claimed to have scientific supported in the form of in vitro lab tests that supposedly evaluated the efficacy of the product against Staphylococcus aureus and a case study of 598 volunteers that purportedly measured the product’s “ability to kill viruses and bacteria and results on symptoms of allergies.” They also include on their websites a “Certificate of Registration” featuring the FDA’s logo.That’s what the defendants said about their “quantum science,” but from the FTC’s perspective, their advertising claims reflected a quantum leap of logic unsupported by appropriate proof – or any approval from the FDA. What about that FDA “Certificate of Registration”? According to the complaint, “Defendants' certificate is fake. The FDA does not issue certificates of registration to manufacturers of medical devices.”This isn’t the first time the defendants has heard from the FTC about their representations. An earlier FTC warning letter advised them, “[A]ny coronavirus-related prevention or treatment claims regarding such products are not supported by competent and reliable scientific evidence. You must immediately cease making all such claims.”Three defendants – Gary Kong, K W Technology Inc. and K W Technology NV Inc. – have entered into a proposed settlement, which prohibits misrepresentations about the health, safety, or efficacy of any product; bans bogus claims of government approval or clearance; and imposes a $150,000 financial remedy. Litigation continues against defendant Timothy Wetzel.Read the FTC’s Health Products Compliance Guide for more about substantiating health claims.  
- FTC takes action against stalking apps FTC takes action against stalking appslfairOctober 22, 2019 | 9:10AM  FTC takes action against stalking apps            By                  Lesley Fair                    You know that eerie feeling that someone is following your every move? If someone secretly installed a “stalking app” or “stalkerware” sold by Retina-X Studios, LLC, onto your mobile device, that strange sensation could be way more than a feeling. A complaint against the developer and marketer alleges violations of the FTC Act and the Children’s Online Privacy Protection Act Rule.Florida-based Retina-X and James N. Jones, Jr., marketed three apps as ways to monitor children or employees. MobileSpy captured and logged GPS location, text messages, photos, call history, browser history, etc. People who bought the premium version also could view the unsuspecting user’s screen in real time. PhoneSheriff monitored much of the same data, plus email history and screenshots of activity using Snapchat. As part of the iOS registration process for TeenShield, Retina-X collected the dates of birth of users being monitored–roughly a third of whom were under 13. Once installed, TeenShield captured GPS location, text messages, call history, browser history, email, and the like.To install the products, the buyer needed physical access to the device and often had to jailbreak or root it. In other words, they had to bypass restrictions built into the operating system on the device. Once the software was in place, buyers could remotely monitor the user’s activities from an online dashboard. By default, an icon appeared on the device. However, Retina-X instructed the person who installed the software on how to hide it and have the app run surreptitiously without the user’s knowledge. Although Retina-X claimed in its privacy policies that the products were designed to be used only to monitor a parent’s underage child or employee, the company didn’t take any steps to ensure that was how their apps were used. What’s more, why would parents or employers jailbreak or root phones to install Retina-X software when other monitoring apps on the market didn’t require jailbreaking or rooting?The complaint alleges several forms of consumer injury. One particular concern is that stalkers – for example, perpetrators of domestic violence – could use the apps to keep tabs on their victims’ location and online activity, information they could use to inflict emotional or even physical harm. Stalkers also could also use software like this to commandeer victims’ financial accounts. At the very least, people who installed Retina-X’s apps on the devices of unsuspecting users likely voided their devices’ warranties and exposed the users to increased security risks common when a device has been jailbroken.Furthermore, the FTC alleges Retina-X failed to take basic steps to protect the sensitive data its apps collected, especially information collected from children being monitored. For example, the company didn’t have written security standards in place and didn’t conduct security testing for known vulnerabilities. In addition, while touting its products’ ability to monitor others, the complaint alleges that Retina-X didn’t take appropriate steps to monitor its own service provider – the company that developed Retina-X’s apps, managed its servers, handled its payment processing, and provided marketing and customer support services.The privacy policies for MobileSpy, PhoneSheriff, and TeenShield included the same soothing language: “It is company policy that our customer databases remain confidential and private. . . . Your private information is safe with us.” But no one told that to the hacker who in 2017 found unencrypted credentials for the company’s cloud storage account in the TeenShield Android Package Kit. Once logged in, the hacker found the username and password for Retina-X’s server. That was the “Open Sesame!” the hacker needed to access sensitive data collected through PhoneSheriff and TeenShield and then erase it entirely. Retina-X didn’t learn about the hack until two months later when a journalist contacted the company after having received evidence from the hacker.Fast forward a year and a hacker again found the credentials for the company’s cloud storage account, this time in the PhoneSheriff Android Package Kit. The credentials were–to use the company’s terminology – “obfuscated,” but the hacker was still able to decrypt them. This time the hacker erased all photos in the cloud storage account.The complaint includes one count of unfair acts or practices and three counts of deception. In addition, the FTC alleges Retina-X knowingly collected personal information from children under the age of 13 through the TeenShield product, but failed to honor the COPPA Rule’s requirement to maintain reasonable procedures to protect the confidentiality, security, and integrity of that data.To settle the case, Retina-X and James N. Johns, Jr., have agreed to delete the data they collected and not sell any product that requires jailbreaking or rooting. In addition, in the future, they’ll have to get statements from buyers that they’ll use the app only to monitor their child or an employee, or an adult who has consented in writing. They also must include an icon with the name of the app that can only be removed by parents who have installed it on their kids’ phones. In keeping with other recent data security settlements, they must get third-party assessments of their information security program every two years.Once the proposed settlement appears in the Federal Register, the FTC will accept public comments for 30 days. In the meantime, here are tips other companies can take from the case.Exercise heightened caution if you sell monitoring products. Take reasonable steps to ensure your product is used only for lawful purposes. For example, you can’t require the circumvention of built-in operating system or device security protections and then claim ignorance about how your product is used.If you collect it, protect it. Collecting any form of sensitive data carries with it the obligation to protect it when it’s in your possession. If it’s information covered by COPPA, Section 312.8 of the Rule puts special data protections in place.Take steps to avoid a third-degree burn. When working with third-party service providers, spell out your data security expectations in your contracts and build in monitoring mechanisms to make sure they’re following through. When COPPA-covered information is involved, Section 312.8 of the COPPA Rule underscores that requirement: “[T]ake reasonable steps to release children’s personal information only to service providers and third parties who are capable of maintaining the confidentiality, security and integrity of such information, and who provide assurances that they will maintain the information in such a manner.” 
- Voice cloning: Where WOW meets OMG Voice cloning: Where WOW meets OMGlfairJanuary 16, 2020 | 1:39PM  Voice cloning: Where WOW meets OMG            By                  Lesley Fair                    Have you had this experience? You hear about a remarkable innovation, but before you can finish the phrase “That’s amaz . . . .” you’ve already jumped ahead to the questions and concerns it raises. That’s how many people are responding to voice cloning – emerging technologies that let users make near-perfect reproductions of a person’s voice. It’s also the subject of You Don’t Say: An FTC Workshop on Voice Cloning Technologies, scheduled for January 28, 2020. You’ll want to check out the just-announced agenda.Think of the benefits of voice cloning for people who have lost the ability to speak. But now consider the danger if scammers exploit the technologies by using recognizable voices to perpetrate family emergency scams (“I’m in the hospital, Grandpa, and need money ASAP”), business imposter cons (“Wire a payment to our vendor immediately”), or other forms of fraud.You Don’t Say will convene at 12:30 PM ET with remarks from FTC Commissioner Chopra. Next on the agenda: a presentation by Dr. Patrick Traynor, the John and Mary Lou Dasburg Preeminence Chair in Engineering at the University of Florida, on the state of voice cloning technologies.The first panel – which will feature a demonstration of voice cloning – will focus on Good and Bad Use Cases. On the second panel, academics and others will discuss the Ethics of Voice Cloning. The third panel will explore Authentication, Detection and Mitigation. Lois Greisman, Associate Director of the FTC’s Division of Marketing Practices, will present closing remarks at 4:45.You Don’t Say is free and open to the public. Planning to attend in person? The event will convene at 12:30 PM ET on Tuesday, January 28th, at the FTC’s Constitution Center conference facility, located at 400 7th Street, S.W., in Washington, DC. Or you can watch the live webcast from a link we’ll post minutes before the start time. We’ll also live tweet from @FTC using the hashtag #voicecloningFTC.  
- COPPA Guidance for Ed Tech Companies and Schools during the Coronavirus COPPA Guidance for Ed Tech Companies and Schools during the Coronavirus lschifferleApril 9, 2020 | 8:18AM  COPPA Guidance for Ed Tech Companies and Schools during the Coronavirus             By                  Lisa Weintraub Schifferle                    “Social distancing,” “shelter-in-place,” “virtual happy hour”— these are some of the new expressions on everyone’s lips the past few weeks. For many, add “remote learning” to the list. Because of school closures, millions of students are now using online, education technology (or “ed tech”) services to engage in remote learning from home. And while this fills a vital need, it’s important to keep in mind that many of these ed tech services collect and use student’s personal information. So, it’s a good time to remind ed tech providers and schools about the continued need to protect student’s privacy and safeguard their personal data. To help, here are some FAQs.What is the Children’s Online Privacy Protection Act (COPPA)? Importantly, COPPA does not impose obligations on schools. Instead, COPPA spells out what operators of commercial websites and online services, including some ed tech services, must do to protect children’s privacy and safety online. For example, if your company is covered by COPPA, you need to have certain information in your privacy policy and get parental consent before collecting some types of information from kids under 13. In addition, companies covered by COPPA must also maintain reasonable data security practices to, for example, protect hackers from accessing student accounts. Does COPPA apply to ed tech services used for remote learning? At the outset, we want to stress that COPPA is not a barrier to schools providing robust remote learning opportunities through ed tech services. COPPA generally requires companies that collect personal information online from children under age 13 to provide notice of their data collection and use practices and obtain verifiable parental consent. In the educational context, however, schools can consent on behalf of parents to the collection of student personal information — but only if such information is used for a school-authorized educational purpose and for no other commercial purpose. This is true whether the learning takes place in the classroom or at home at the direction of the school. How can ed tech services get consent from a school? For the ed tech service to get consent from the school instead of from the parent, the service must provide the school the necessary COPPA-required notice of its data collection and use practices. Want to know what the notice should look like? Read Section C of the FTC’s COPPA FAQs. As a best practice, ed tech services should make the COPPA notice available to parents, and, where feasible, let parents review the personal information collected. In addition, ed tech services should use plain language that students, parents, and educators can easily understand.  What if the ed tech services are for students over the age of 13? Even for students who are 13 or older and not covered by COPPA, ed tech services should not use less care or engage in different practices simply because a student is engaged in remote learning rather than using the ed tech service in the classroom. Are there other laws that ed tech vendors should be aware of? In addition to COPPA, ed tech services should review the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA) — laws administered by the U.S. Department of Education’s Student Privacy Policy Office (SPPO) — as well as any of the state laws that protect the privacy of K-12 students. Also, check out the U.S. Department of Education’s new information on FERPA and Virtual Learning. SPPO’s website includes best practices and potential terms of service that may be helpful to include in an agreement between schools and ed tech vendors. And, of course, Section 5 of the FTC Act prohibits all companies from engaging in unfair or deceptive practices.Is there any advice for schools that are using ed tech services? Keep in mind that, because COPPA applies only to operators of commercial websites and services, it generally does not impose obligations directly on schools. Nevertheless, as schools and school districts move to remote learning, they should consult with their attorneys and information security specialists to review the privacy and security policies of the ed tech services they use. Schools or school districts should decide whether a particular site’s or service’s privacy and information practices are appropriate, rather than delegating that decision to the teacher. Also, the school or school district should give parents a notice of the websites and online services whose collection they have consented to on behalf of the parent. In deciding which online technologies to use with students, a school should be careful to understand how an operator will collect, use, and disclose personal information from its students. Among the questions that a school should ask potential operators are:What types of personal information will you collect from students?How do you use this personal information?Do you use or share the information for commercial purposes not related to the provision of the online services requested by the school? For instance, do you use students’ personal information in connection with generating targeted advertising, or building user profiles for commercial purposes not related to the provision of the online service? If so, the school cannot consent on behalf of the parent. Do you let the school review and have deleted the personal information collected from their students? If not, the school cannot consent on behalf of the parent. What measures do you take to protect the security, confidentiality, and integrity of the personal information that you collect?What are your data retention and deletion policies for children’s personal information?For more guidance on schools and COPPA, read Section M of the FTC’s COPPA FAQs. Where can I learn more? For more specific information on how COPPA works and who is covered, read COPPA FAQs and Children’s Online Privacy Protection Rule: A Six Step Compliance Plan for your Business.
- Root, root root for the regions Root, root root for the regionslfairSeptember 24, 2018 | 2:03PM  Root, root root for the regions            By                  Andrew Smith, Director, FTC Bureau of Consumer Protection                    This year eight major league baseball teams are celebrating milestone anniversaries – and so are the FTC’s regional offices. In 1918, the Commission opened the first three of its regional offices. Today, eight regional offices continue to knock it out the park on behalf of America’s consumers. So it’s only fitting that on this momentous day we acknowledge the regional offices’ century of pennant-winning performances.According to the Commission’s 1918 Annual Report, “In order to expedite the greatly increased work of the Commission . . . small branch offices were established in New York, Chicago, and San Francisco.” Over time, the FTC has added other locations for a current total of eight offices in seven regions. Regional staff work with the Bureau of Consumer Protection and the Bureau of Competition on investigations and litigation. But they are in a unique position to host roundtables and workshops in their communities; to coordinate with local, state, and cross-border law enforcers; and to build partnerships with consumer groups and small business organizations within their region. According to the scouting report, there isn’t a pitch they can’t hit.Here’s a brief look at each region’s box score with a focus on just a few of their many MVP contributions to the FTC’s consumer protection mission.East Central Region. In 1918, the Cleveland Indians finished just out of pennant contention, but the FTC’s Cleveland-based office works hard to bring home the W for consumers and small businesses. For example, ECR has brought a number of cases over the past two decades to protect small businesses in their area and around the country, including cramming, business directory, and unordered merchandise scams. Recently, ECR played a central role in Operation Main Street, the FTC’s recent initiative against scammers targeting small businesses.Midwest Region. Chicago fans may be divided in their loyalty to the Cubs and the White Sox, but consumers who lost money to scammers who used the services of a major money transfer company are united in their appreciation for the FTC-DOJ settlement that returned $586 million back to them. And just recently, MWR hosted the Commission’s workshop on cryptocurrency scams and took a lead role in Operation Tech Trap, a coordinated state, federal, and international effort to shut down tech support fraudsters.Northeast Region. Given New York’s connection to names like Huggins, Houk, Stengel, Berra, and Torre, it’s no wonder the FTC’s Northeast Region has particular expertise in coaching. But in NER’s case, it’s about companies that make deceptive “coaching” and money-making representations. The New York-based office also has been one of the FTC’s power hitters in addressing misleading practices in the affiliate marketing industry. And from their Big Apple location, NER has been a leader in educating consumers, particularly older Americans and small businesses.Northwest Region. Like their hometown Seattle Mariners, the FTC’s Northwest Region has a proven record of navigating the complexities on the field of play. NWR coordinated Operation Donate with Honor, a nationwide crackdown on fraudulent charities alleged to have conned consumers by falsely promising their contributions will help veterans and servicemembers. In addition, our team in Seattle regularly coordinates with Canadian counterparts to combat cross-border fraud. And they’ve been ahead of the curve on tech issues, bringing one of the FTC’s first internet cases in the 90s and more recently, an early online influencer action.Southeast Region. The Atlanta Braves boast a national fan base – and due to their expertise in fighting fraud, the FTC’s Southeast Region can be proud of its coast-to-coast impact, too. For example, SER has been at the forefront in stopping fraudulent practices in the travel industry. Operation Trip Trap and the Last Resort timeshare sweep are just two examples. SER staff is also a leader in the community, hosting Scam Jam events with the BBB and reaching out to consumer groups and small business organizations in their region.Southwest Region. Texas can be proud of the 2017 World Champion Astros just as we’re proud of the accomplishments of the FTC’s Dallas-based Southwest Region. One recent example: the staff’s expertise in handling pyramid and chain referral cases, including a recent settlement with a company that targeted college students and other young people with practices the FTC says created a pyramid scheme. Like another famous Texan, SWR staff is regularly “on the road again,” speaking with consumer and business groups throughout their region at libraries, town halls, fairs, and conferences.Western Region (Los Angeles). It’s only fitting that the Los Angeles office of the FTC’s Western Region has a lot of experience with “dodgers” – companies charged with making dodgy claims. For example, WR-LA staff brought the FTC’s first Do Not Call case. WR-LA’s locale has given the staff particular experience in coordinating consumer education events at local military installations, including a Military Common Ground conference. In addition, WR-LA won $100 million in loan forgiveness and refunds back for students in an action challenging deceptive claims by a post-secondary school.Western Region (San Francisco). The FTC’s San Francisco office of the Western Region lives up to the name “Giants.” In the 80s, they brought one of the first Section 13(b) actions establishing the Commission’s ability to get injunctive and monetary relief in federal district court. More recently, they spearheaded a precedent-setting case addressing the scope of the FTC Act’s common carrier exemption. Given their Silicon Valley-centric location, WR-SF has played a key role in business outreach and education for the tech community.Box scores in 1918 included names like Babe Ruth, Walter Johnson, and Ty Cobb. On the occasion of their 100th anniversary, we’re just as proud of the accomplishments of the All-Stars in the FTC’s regions. 
- 20 more warning letters tell companies to cut out unproven COVID-19 claims 20 more warning letters tell companies to cut out unproven COVID-19 claimslfairAugust 14, 2020 | 11:41AM  20 more warning letters tell companies to cut out unproven COVID-19 claims            By                  Lesley Fair                    Coronavirus claims for zappers, virus-busting cards, sage, oregano, and bay leaves are among the representations called into question in the latest round of warning letters sent by FTC staff. With the total closing in on 300, the letters make it clear that companies need to clean up their claims about preventing or curing COVID-19. Here are the products and promises that have raised the most recent concerns.The1VirusBuster.  Citing statistics on the proliferation of coronavirus, the company promoted The 1 Virus Buster Cards as “safe, simple, and effective. All you need to do is hang it on your neck or attach it to your collar, close to your mouth and nose. If used correctly, it kills 99.99% of most harmful bacteria and viruses, which live in the air you breathe, within a three-foot radius.”Active Lifestyle Clinic.  In marketing materials titled “Learn about our COVID-19 protocol,” the Phoenix clinic promoted ozone therapy as an “effective, safe, and affordable way to treat virus and infection . . . .”Dave Asprey.  In a letter sent in care of Seattle-based Bulletproof 360, Inc., FTC staff cited blog posts, including one about “how to hack coronavirus.” The website touted a variety of products, including andrographis, sage, oregano, bay leaves, and a formulation called Bulletproof.Back 2 Health Family Wellness Center.  A video on the New Jersey office’s YouTube channel claimed to show consumers “how to improve your immune system to fight any virus including the corona virus or Covid 19.” On a webpage with the heading “Corona Virus Covid-19 and Chiropractic,” the company touted “regular chiropractic adjustments” as a way “you may lessen the severity or duration if you do happen to get sick.”Bottom Line Inc.  In promoting products it sells, the Connecticut company stated, “[A]ccording to the NIH, there is significant data showing that melatonin limits virus-related diseases and would also likely be beneficial in COVID-19 patients.” In addition, the company claimed that astragalus, quercetin, elderberry, and zinc “help prevent the virus from entering your cells by blocking the receptors where it tries to dig in.”Breiner Whole-Body Health.  After referring to “the new coronavirus spreading worldwide,” a video on the Connecticut company’s website claimed, “We have several IV drips that can . . . help prophylactically as well as IVs that can be used if you have a current infection.” On a Facebook post, the company said that for consumers who take intravenous Vitamin C, “the viruses themselves will just . . . get overwhelmed and die.”CoviDoctors.  The Lubbock-based business advertised on its website “Get the same herbal formulas used in Chinese hospitals for treatment and prevention of Covid-19.” The company also promoted three products it claimed were based on “research from China on advanced formulas for prevention of coronavirus infection.”Fortifeye Vitamins.  On its website, the Florida business warned consumers that “this cytokine storm when you have this virus attacks your lungs, your heart, your brain . . . you could die.” The company promoted a variety of products as “natural approaches to help fight against this viral invasion,” including its Fortifeye Super Immune Wellness bundle, described as “the big daddy, the king daddy.”Gesundheit Nutrition Center.  In describing “things you can do to protect yourself from becoming infected by this CoronaVirus or any other virus for that matter,” the Montana company recommended products it sells, including “Oil of Oregano, Olive Leave Extract, Elderberry, Sovereign Silver, Garlic, Astragalus, and Cat’s Claw.”Hackbart Chiropractic.  On a webpage with the heading “Improved Immunity During Covid-19,” the Nebraska clinic stated, “There are many things you can do but what is the single most effective option? Get Adjusted!” It continued, “Develop a good offense through chiropractic so you can have the upper hand over COVID-19.”Hyde Park Holistic Center.  A webpage for the Georgia clinic included the heading “Possible Natural Solution” to coronavirus and recommended four products available from its online store: AdvaClear, which contains EGCG; Sinuplex, which contains quercetin; Zinc AG; and Ultra Potent [Vitamin] C.Dr. Rozita Moshtagh.  In a warning letter sent to Dr. Moshtagh at San Diego’s Naturopathic Medicine Clinic, FTC staff cited claims on her website – for example, “We offer Anti COVID-19/Anti Coronavirus Natural Antivirals and IV Therapy” and “Schedule Your High Dose IV Vitamin C. KEEP Covid-19 AWAY.”Natural Health Center of Clifton.  In a Facebook post titled “Coronavirus: How to Protect Yourself,” the New Jersey center promoted its “CoronaVirus Protocol” as “specifically designed to BOOST your immune system and ward off viruses.” It also recommended chiropractic adjustment as a way to “Boost Your Immune System & Protect Yourself Against The CoronaVirus.”NaturalHealthSupply.com.  The Maine company promoted its Zapper and Food Zappicator as devices that could prevent or treat coronavirus by using certain frequencies to kill viruses.NSideOut Health.  Using hashtags #coronakiller, #coronacure, or #covidcure on Instagram posts, the Atlanta company promoted its elderberry syrup, elderberry elixir, elderberry seamoss gel, and black seed oil as “ideal for everyday use but especially during this pandemic . . . .”Provita Health Store.  On its webpage, the company described the health risks posed by COVID-19 and recommended the VariZapper, a device “to remove viruses.” Using the hashtag #coronavirus, the product was promoted on Instagram as a “#frequencygenerator device that removes #pathogens from the body.”Silver Cancer Institute & Center for Chronic Disease.  In promoting ozone therapy as part of its “Emergency protocol for CORONA VIRUS,” the Arizona company cited “new peer reviewed literature” and recommended “oxidative therapy with intravenous ozone,” which “quite effectively killed [the] virus.”UWell Life, Inc.  On its website, the California company claimed consumers could “Prevent Corona Virus with Primocyn.”Whole Word Botanicals.  In marketing materials titled “4 Things You Can Do at Home to Ease Coronavirus and Pneumonia Symptoms,” the New York company recommended camu camu, cat’s claw, and desmodium. The website also featured a testimonial claiming that two healthcare workers who had contracted COVID-19 had taken the products and “Three days later their fevers were gone and their oxygen levels were almost back to normal!”Xlear.  In a YouTube video titled “There is a Simpler, Cheaper Way to Deal with COVID-19,” the Utah company claimed that “a Utah State University study found that a nasal spray like Xlear reduced the COVID-19 virus to ‘an undetectable amount’ in 15 minutes.”Like the hundreds of warning letters FTC staff has already sent, the latest letters get down to brass tacks:It is unlawful under the FTC Act . . . to advertise that a product or service can prevent, treat, or cure human disease unless you possess competent and reliable scientific evidence, including, when appropriate, well-controlled human clinical studies, substantiating that the claims are true at the time they are made. For COVID-19, no such study is currently known to exist for the product identified above. Thus, any coronavirus-related prevention claims regarding such products are not supported by competent and reliable scientific evidence. You must immediately cease making all such claims.The FTC has already filed suit against a company that received a warning letter and failed to make material changes to its COVID-19 claims. Looking for more compliance resources? Visit the FTC’s Business Guidance During Coronavirus portal.  
- Setting the debt parking brake Setting the debt parking brakelfairNovember 30, 2020 | 12:14PM  Setting the debt parking brake            By                  Lesley Fair                    What are the biggest risks of parking? A dinged door? A bruised bumper? For consumers victimized by the pernicious practice of debt parking, the impact on their financial health can be devastating. And if you’re a debt collector who engages in debt parking, an FTC settlement with Midwest Recovery Systems suggests you could face law enforcement action for violations of the FTC Act, the Fair Debt Collection Practices Act, and the Fair Credit Reporting Act.Just what is debt parking? It’s the practice of placing purported debts on consumers’ credit reports without first attempting to communicate with the consumer about the debt. Some call it “passive debt collection,” but there’s nothing passive about the injury it can inflict. Consumers often don’t learn about it until a mortgage company, prospective employer, or other decision maker pulls their credit report and spots what appears to be an unpaid debt. With a house, car, or job in the balance, many people feel pressured to pay up – even though they may not actually owe the money.That’s the tactic the FTC says Missouri-based Midwest Recovery Systems and owners Brandon M. Tumber, Kenny W. Conway, and Joseph H. Smith engaged in. According to the lawsuit, since at least 2015, the defendants have reported to credit reporting agencies more than $98 million in bogus or highly questionable debts for payday loans, debts subject to unresolved fraud claims, debts in bankruptcy, debts in the process of being rebilled to consumers’ medical insurance, and even debts people had already paid.The FTC alleges the defendants continued to collect those debts even in the face of billowing red flags about their validity. In fact, when consumers were able to dispute the purported debts, the defendants have regularly concluded that between 80% and 97% of them were either inaccurate or invalid. That’s not surprising, given that many of those debts originated from certain payday lenders and others whom the FTC has sued for their own illegal practices.Here’s an example cited in the complaint of how the defendants used debt parking to help line their pockets with millions in gross revenue. When applying for a mortgage, a consumer was told that an outstanding medical debt of $1,500 had lowered his credit score, which threatened to put the kibosh on buying a house. He contacted the hospital where he supposedly owed the debt, only to be told that he owed just an $80 co-pay. In spite of that, the FTC says the defendants refused to remove the debt and threatened the consumer with a lawsuit if he didn’t pony up. His complaint was one of thousands that Midwest Recovery received.For people who work in the collections field, the pleading in this case merit a careful read. In addition to alleging the defendants made false or unsubstantiated representations in violation of the FTC Act and the Fair Debt Collection Practices Act, the complaint expressly challenges their debt parking tactics as an unfair practice under the FDCPA. The FTC says they also violated the FDCPA by failing to provide validation notices – one of the protections in the statute designed to ensure consumers have the information they need to dispute an invalid debt. Three other counts charge the defendants with violating the Fair Credit Reporting Act by furnishing information to credit reporting agencies they knew or had reasonable cause to believe was inaccurate, by failing to conduct reasonable investigations of disputes, and by failing to report the results of those investigations to consumers.The settlement suggests some takeaway tips for others in the collections ecosystem.Consumers’ credit reports are a NO PARKING zone. This is the first FTC case to address debt parking – and thus the first to challenge the practice as unfair under the FDCPA – but the message couldn’t be clearer. Debt collectors that park fake or questionable debts can expect law enforcement scrutiny. What’s more, this kind of parking can result in remedies that extend far beyond a ticket or a boot. In addition to a financial judgment and tough injunctive provisions, the settlement requires the company to turn over all its remaining assets and one defendant to sell his stake in another debt collection company and surrender the proceeds.Watch for the symptoms of questionable medical debt. The Midwest Recovery settlement is among the first FTC matters to address medical debt. Over 43 million consumers have outstanding medical debts on their credit reports, and medical debt accounts for more than half of the debts reported by third-party collection companies. But medical billing is a frequent source of confusion and uncertainty for consumers, given the complex and often opaque system of insurance coverage and cost sharing. Now more than ever, accuracy issues are a particular concern.Exercise caution at the intersection of debt collection and credit reports. Reporting debts first and asking questions later – or not at all – can land collectors in a steaming alphabet soup of FDCPA and FCRA violations. Prudent members of the industry scrutinize questionable categories of debt and debts to questionable creditors. They also contact consumers and listen to what they have to say before furnishing information to credit reporting agencies.  
- $50 million in refund checks for University of Phoenix students $50 million in refund checks for University of Phoenix studentschundyczMarch 24, 2021 | 11:01AM  $50 million in refund checks for University of Phoenix students            By                  Lesley Fair                    “The check’s in the mail.” You’ve heard it before, but this time it’s true if you are one of the 147,000 University of Phoenix students who will be receiving payments totaling more than $50 million as a result of the FTC’s law enforcement action against the online school. In a 2019 lawsuit, the FTC alleged the University of Phoenix lured consumers in with ads that falsely touted – among other things – job opportunities for its students with national employers like AT&T, Yahoo!, Microsoft, Twitter, and the American Red Cross. To settle the case, the defendants agreed to pay $50 million in direct payments for some students and an additional $141 million in canceled balances that eligible students owed directly to the school. (Other debts – for example, federal and private student loans or military benefits – aren’t affected by the settlement.)Who is getting the 146,804 checks and 677 PayPal payments the FTC is sending out? The money is going to students who:first enrolled in a masters, bachelors, or associates degree program between October 15, 2012, and December 31, 2016;paid more than $5,000 with cash, grants, federal and private student loans, or military benefits; didn’t get debt cancellation as part of this settlement; anddidn’t opt out of the University of Phoenix providing the student’s contact information to the FTC. People who receive checks should deposit or cash them within 90 days. By the way, the FTC never requires people to pay money or provide account information to get a refund or to cash a refund check. People who get a refund via PayPal will have 30 days to accept the payment. (This FAQ has more information about the PayPal payment process.) If you have questions about debt canceled by the school, email the University of Phoenix at UOPXFinance@phoenix.edu or call 1-800-333-5305. For questions about refunds, call the FTC’s refund administrator, Rust Consulting, at 1-877-310-0487.Even if you weren’t a University of Phoenix student, someone in your company may have been. Share this information with them to make sure they don’t miss their check in the mail.