United States of America

FEDERAL TRADE COMMISSION

Washington, DC 20580

Via Federal Express

[Name]

Re: Notice of Penalty Offenses Concerning Misuse of Information Collected in 

Confidential Contexts 

Dear [Name]:

I am enclosing a copy of the Federal Trade Commission’s Notice of Penalty Offenses 

Concerning Misuse of Information Collected in Confidential Contexts. We recommend that you 

carefully review the notice and take any steps necessary to ensure that you and your company’s 

practices do not violate the law.

The notice summarizes Commission determinations in a prior litigated case that 

particular acts or practices are penalty offenses—i.e., that they are deceptive or unfair, unlawful 

under Section 5 of the Federal Trade Commission Act (“FTC Act”), and prohibited by a final 

cease and desist order. As set forth in more detail in the notice, these acts and practices include 

engaging in the following unless the individual first provides affirmative express consent: (1) 

using information collected in a context where an individual reasonably expects that such 

information will remain confidential (“Confidential Context”) for purposes not explicitly 

requested by the individual; (2) using such information to obtain a financial benefit that is 

separate from the benefit generated from providing the product or service requested by the 

individual; and (3) using such information to advertise, sell, or promote products or services. The 

notice also states that such acts or practices include making false, misleading, or deceptive 

representations concerning the use or confidentiality of such information. These uses are 

prohibited whether the information is disclosed to a third party or used internally to carry out the 

above-proscribed purposes, unless you and your company first obtain affirmative express 

consent.1 

1Privacy Online: A Report to Congress, Federal Trade Commission, at 8 (June 1998) (noting that 

choice applies to “uses [of data] beyond those necessary to complete the contemplated 

transaction” including uses that are “internal, such as placing the consumer on the collecting 

company’s mailing list in order to market additional products or promotions, or external, such as 

the transfer of information to third parties”), 

https://www.ftc.gov/sites/default/files/documents/reports/privacy-online-report-congress/priv23a.pdf. This position is consistent with In re: Beneficial Corp., in which the Commission stated 

that “the confidential relationship is breached whenever the customer’s information is used for 

the financial gain of the [business] . . . [w]hether or not [the business] brokered confidential 
[NAME] 

September 18, 2023 

Page 2 of 3

The concepts espoused in Beneficial concern the use of information collected in any 

Confidential Context, whether online or offline. In applying the determinations of Beneficial to 

today’s technologies, the Commission considers it an unfair or deceptive act or practice to use 

tracking technologies such as pixels, cookies, APIs, or SDKs to amass, analyze, infer, and 

transfer information collected in a Confidential Context for the purposes described in the prior 

paragraph without first obtaining affirmative express consent. It is also an unfair or deceptive 

practice to misrepresent or omit material facts regarding the use or confidentiality of information 

collected in a Confidential Context through tracking technologies such as pixels, cookies, or 

SDKs. The Commission’s Office of Technology has issued guidance on the risks and concerns 

associated with tracking technologies.2

In order to use information collected in a Confidential Context for purposes other than 

those explicitly requested by the individual (including to obtain a separate financial benefit or for 

advertising purposes), you and your company must obtain affirmative express consent from the 

individual. Affirmative express consent means a freely given, specific, informed, and 

unambiguous indication of an individual’s wishes via a separate agreement.3 To obtain 

affirmative consent you must provide a clear and conspicuous disclosure containing the contents 

set forth in the Commission’s final order in In re: Beneficial Corp., 86 F.T.C. 119, 179 (1975), 

and all other relevant information necessary for the provision of consent. For purposes of 

interpretation, the Commission has long stated that terms buried in privacy policies and terms of 

service are not “clear and conspicuous.”4 

information to other businesses, or simply capitalized on it themselves . . . .” In re: Beneficial 

Corp., 86 F.T.C. 119, 173 (1975), aff’d in relevant part, 542 F.2d 611 (3rd Cir. 1976).

2 Lurking Beneath the Surface: Hidden Impacts of Pixel Tracking, FTC Office of Technology 

(Mar. 16, 2023), https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/03/lurkingbeneath-surface-hidden-impacts-pixel-tracking. 

3 For further information on what constitutes affirmative express consent, please see recent 

Commission orders. See, e.g., BetterHelp, Inc., File No. 2023169 (Mar. 2, 2023) (consent order), 

https://www.ftc.gov/system/files/ftc gov/pdf/202 3169-betterhelp-consent.pdf; United States v. 

GoodRx Holdings, Inc., Case Number 4:23-cv-00460-DMR (N.D. Cal. Feb. 17, 2023) (stipulated 

order), https://www.ftc.gov/system/files/ftc_gov/pdf/goodrxfinalstipulatedorder.pdf; United 

States v. Epic Games Inc., Civil Action Number 5:22-CV-00518-BO (E.D.N.C. Feb. 7, 2023) 

(stipulated order), 

https://www.ftc.gov/system/files/ftc gov/pdf/2223087EpicGamesSettlement.pdf. Note that what 

constitutes affirmative express consent may change as technology develops, thereby requiring 

that you and your company keep informed of new requirements. Obtaining consent through an

interface that has the effect of subverting or impairing user autonomy, decision-making, or 

choice does not constitute valid consent.

4 Federal Trade Commission Staff Report: Self-Regulatory Principles for Online Behavioral 

Advertising: Tracking, Targeting, and Technology, at 40 n.70 (Feb. 2009), 

https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-staff-reportself-regulatory-principles-online-behavioral-advertising/p085400behavadreport.pdf. 
[NAME]

September 18, 2023 

Page 3 of 3 

Receipt of this notice of penalty offenses puts you and your company on notice that 

engaging in the conduct described therein could subject you and your company to civil 

penalties of up to $50,120 per violation.5

We are aware of information suggesting that you have engaged in or are engaging in 

deceptive or unfair conduct. You should take prompt action, including by reviewing all your 

practices, to ensure any deceptive or unlawful claims cease and are removed or corrected, as 

appropriate, and any other required disclosures are made. We request that you distribute copies 

of the notice and this letter to your subsidiaries. 

Copies of the case decision discussed in the notice are available on the Commission’s 

website at https://www.ftc.gov/enforcement/notices-penalty-offenses/penalty-offensesconcerning-confidential-context. 

Please note that nothing in this letter or the attached notices alters, modifies, or impacts 

your obligations, if any, under any other federal rule or statute. This letter and the notices do not 

purport to list all the deceptive or unfair practices that violate the FTC Act or all the federal 

court cases addressing when conduct is unfair or deceptive in violation of the FTC Act. 

If you have any questions about this letter or the enclosed materials, please contact 

Michael Sherling at msherling@ftc.gov or (202) 326-3286 and Manmeet Dhindsa at 

mdhindsa@ftc.gov or (202) 326-2877. 

Very truly yours,

Benjamin Wiseman

Associate Director

Division of Privacy and Identity Protection

Enclosure

5

See 15 U.S.C. § 45(m)(1)(B); 16 C.F.R. § 1.98(e).