Federal Register / Vol. 90, No. 29 / Thursday, February 13, 2025 / Notices 9547 

meeting may adjourn early if the 

Committee has completed its business. 

ADDRESSES: The meeting will be held at 

the Long Beach Convention Center 

located at 300 E Ocean Blvd., Long 

Beach, California. This meeting will 

follow the TPM Conference and will be 

open to the public. Members of the 

public do not need to register for the 

TPM Conference to attend the NSAC 

meeting. The meeting will also be 

streamed live on the Federal Maritime 

Commission’s YouTube channel. If 

technical issues prevent the Committee 

from streaming live, the Committee will 

post a recording of the meeting on the 

Commission’s YouTube channel 

following the meeting. 

FOR FURTHER INFORMATION CONTACT: Mr. 

Mark Braganc ̧a, Designated Federal 

Officer of the National Shipper 

Advisory Committee, phone: (202) 523- 

5725; email: mbraganca@fmc.gov. 

SUPPLEMENTARY INFORMATION: 

Background: The National Shipper 

Advisory Committee is a Federal 

advisory committee. It operates under 

the provisions of the Federal Advisory 

Committee Act, 5 U.S.C. App., and 46 

U.S.C. chapter 425. The Committee was 

established on January 1, 2021, when 

the National Defense Authorization Act 

for Fiscal Year 2021 became law. Public 

Law No. 116–283, section 8604, 134 

Stat. 3388 (2021). The Committee 

provides information, insight, and 

expertise pertaining to conditions in the 

ocean freight delivery system to the 

Federal Maritime Commission. 

Specifically, the Committee advises the 

Commission on polices relating to the 

competitiveness, reliability, integrity, 

and fairness of the international ocean 

freight delivery system. 46 U.S.C. 

45202(b). 

Meeting Agenda: The Committee will 

recognize its new members and receive 

updates from the Data/Visibilty, Fees & 

Surcharges, and Port Best Practices 

subcommittees; the Refusal to Deal 

Working Group; and the Digital 

Container Shipping Association. The 

Committee will also be provided with 

an overview of the Shipper Bill of 

Rights by the National Industrial 

Transportation League. The Committee 

will take public comment during the 

meeting. 

Public Comment: The Committee will 

take public comment during its meeting 

and is particularly interested in 

receiving feedback regarding the issues 

in your supply chain and the issues that 

you want to see the Committee and the 

Federal Maritime Commission address. 

Members of the public may also 

submit written comments to NSAC at 

any time. Comments should be 

addressed to NSAC, c/o Mark Braganc ̧a, 

Federal Maritime Commission, 800 

North Capitol St. NW, Washington, DC 

25073 or nsac@fmc.gov. 

A copy of all meeting documentation, 

including minutes, will be available at 

www.fmc.gov following the meeting. 

Dated: February 10, 2025. 

David Eng, 

Secretary. 

[FR Doc. 2025–02601 Filed 2–12–25; 8:45 am] 

BILLING CODE 6730–02–P 

FEDERAL TRADE COMMISSION 

[File No. 202 3133] 

GoDaddy Inc.; Analysis of Proposed 

Consent Order To Aid Public Comment 

AGENCY: Federal Trade Commission. 

ACTION: Proposed consent agreement; 

request for comment. 

SUMMARY: The consent agreement in this 

matter settles alleged violations of 

Federal law prohibiting unfair or 

deceptive acts or practices. The attached 

Analysis of Proposed Consent Order to 

Aid Public Comment describes both the 

allegations in the complaint and the 

terms of the consent order—embodied 

in the consent agreement—that would 

settle these allegations. 

DATES: Comments must be received on 

or before March 17, 2025. 

ADDRESSES: Interested parties may file 

comments online or on paper by 

following the instructions in the 

Request for Comment part of the 

SUPPLEMENTARY INFORMATION section 

below. Please write ‘‘GoDaddy; File No. 

202 3133’’ on your comment and file 

your comment online at https://

www.regulations.gov by following the 

instructions on the web-based form. If 

you prefer to file your comment on 

paper, please mail your comment to: 

Federal Trade Commission, Office of the 

Secretary, 600 Pennsylvania Avenue 

NW, Mail Stop H–144 (Annex H), 

Washington, DC 20580. 

FOR FURTHER INFORMATION CONTACT: 

Jarad Brown (202–326–2927) and David 

Walko (202–326–2880), Attorneys, 

Division of Privacy and Identity 

Protection, Bureau of Consumer 

Protection, Federal Trade Commission, 

400 7th St. SW, Washington, DC 20024. 

SUPPLEMENTARY INFORMATION: Pursuant 

to section 6(f) of the Federal Trade 

Commission Act, 15 U.S.C. 46(f), and 

FTC Rule § 2.34, 16 CFR 2.34, notice is 

hereby given that the above-captioned 

consent agreement containing a consent 

order to cease and desist, having been 

filed with and accepted, subject to final 

approval, by the Commission, has been 

placed on the public record for a period 

of 30 days. The following Analysis to 

Aid Public Comment describes the 

terms of the consent agreement and the 

allegations in the complaint. An 

electronic copy of the full text of the 

consent agreement package can be 

obtained at https://www.ftc.gov/newsevents/commission-actions. 

You can file a comment online or on 

paper. For the Commission to consider 

your comment, we must receive it on or 

before March 17, 2025. Write 

‘‘GoDaddy; File No. 202 3133’’ on your 

comment. Your comment—including 

your name and your State—will be 

placed on the public record of this 

proceeding, including, to the extent 

practicable, on the https://

www.regulations.gov website. 

Because of heightened security 

screening, postal mail addressed to the 

Commission will be subject to delay. We 

strongly encourage you to submit your 

comments online through the https://

www.regulations.gov website. If you 

prefer to file your comment on paper, 

write ‘‘GoDaddy; File No. 202 3133’’ on 

your comment and on the envelope, and 

send it via overnight service to: Federal 

Trade Commission, Office of the 

Secretary, 600 Pennsylvania Avenue 

NW, Mail Stop H–144 (Annex H), 

Washington, DC 20580. 

Because your comment will be placed 

on the publicly accessible website at 

https://www.regulations.gov, you are 

solely responsible for making sure your 

comment does not include any sensitive 

or confidential information. In 

particular, your comment should not 

include sensitive personal information, 

such as your or anyone else’s Social 

Security number; date of birth; driver’s 

license number or other State 

identification number, or foreign 

country equivalent; passport number; 

financial account number; or credit or 

debit card number. You are also solely 

responsible for making sure your 

comment does not include sensitive 

health information, such as medical 

records or other individually 

identifiable health information. In 

addition, your comment should not 

include any ‘‘trade secret or any 

commercial or financial information 

which . . . is privileged or 

confidential’’—as provided by section 

6(f) of the FTC Act, 15 U.S.C. 46(f), and 

FTC Rule § 4.10(a)(2), 16 CFR 

4.10(a)(2)—including competitively 

sensitive information such as costs, 

sales statistics, inventories, formulas, 

patterns, devices, manufacturing 

processes, or customer names. 

Comments containing material for 

which confidential treatment is 


ddrumheller on DSK120RN23PROD with NOTICES1
9548 Federal Register / Vol. 90, No. 29 / Thursday, February 13, 2025 / Notices 

requested must be filed in paper form, 

must be clearly labeled ‘‘Confidential,’’ 

and must comply with FTC Rule 

§ 4.9(c). In particular, the written 

request for confidential treatment that 

accompanies the comment must include 

the factual and legal basis for the 

request and must identify the specific 

portions of the comment to be withheld 

from the public record. See FTC Rule 

§ 4.9(c). Your comment will be kept 

confidential only if the General Counsel 

grants your request in accordance with 

the law and the public interest. Once 

your comment has been posted on the 

https://www.regulations.gov website—as 

legally required by FTC Rule § 4.9(b)— 

we cannot redact or remove your 

comment from that website, unless you 

submit a confidentiality request that 

meets the requirements for such 

treatment under FTC Rule § 4.9(c), and 

the General Counsel grants that request. 

Visit the FTC website at https://

www.ftc.gov to read this document and 

the news release describing the 

proposed settlement. The FTC Act and 

other laws the Commission administers 

permit the collection of public 

comments to consider and use in this 

proceeding, as appropriate. The 

Commission will consider all timely 

and responsive public comments it 

receives on or before March 17, 2025. 

For information on the Commission’s 

privacy policy, including routine uses 

permitted by the Privacy Act, see 

https://www.ftc.gov/site-information/ 

privacy-policy. 

Analysis of Proposed Consent Order To 

Aid Public Comment 

The Federal Trade Commission 

(‘‘Commission’’) has accepted, subject to 

final approval, an agreement containing 

a consent order from GoDaddy Inc. and 

GoDaddy.com, LLC (‘‘Respondents’’). 

The proposed consent order (‘‘Proposed 

Order’’) has been placed on the public 

record for 30 days for receipt of public 

comments from interested persons. 

Comments received during this period 

will become part of the public record. 

After 30 days, the Commission will 

again review the agreement, along with 

the comments received, and will decide 

whether it should make final the 

Proposed Order or withdraw from the 

agreement and take appropriate action. 

Respondent GoDaddy Inc. is a 

Delaware corporation with its 

headquarters in Arizona. Respondent 

GoDaddy.com, LLC is a Delaware 

limited liability company with its 

headquarters in Arizona and is a wholly 

owned subsidiary of GoDaddy Inc. 

Respondents provide website hosting 

services to individuals and businesses 

of all sizes, including small businesses. 

Since at least 2015, the Commission 

alleges, Respondents have marketed 

their services as a secure choice for 

customers to host their websites, touting 

their commitment to data security. 

Respondents have also stated that they 

comply with the Privacy Shield 

Framework principles, which include a 

promise to take reasonable and 

appropriate measures to protect the 

security of personal information. As 

alleged in the complaint, in fact, 

Respondents’ data security practices 

were not reasonable for their size and 

complexity. GoDaddy did not have 

reasonable visibility into vulnerabilities 

and threats affecting its hosting services. 

Since 2018, GoDaddy has failed to 

implement standard security tools and 

practices to protect its hosting services 

and to monitor them for security threats. 

In particular, GoDaddy allegedly failed 

to: (a) inventory and manage assets; (b) 

manage software updates; (c) assess 

risks to its website hosting services; (d) 

use multi-factor authentication; (e) log 

security-related events; (f) monitor for 

security threats, including by failing to 

use software that could actively detect 

threats from its many logs, and failing 

to use file integrity monitoring; (g) 

segment its network; and (h) secure 

connections to services that provide 

access to consumer data. In light of 

these failures, the Commission 

challenged GoDaddy’s representations 

about security and adhering to the 

Privacy Shield Framework principles as 

false or misleading. As a result of 

Respondents’ data security failures, as 

alleged in the complaint, they 

experienced several incidents of 

unauthorized access to their hosting 

service between 2019 and December 

2022, in which threat actors repeatedly 

gained access to customers’ websites 

and data, causing harm to Respondents’ 

customers and putting them and visitors 

to the customers’ websites at risk of 

further harm. 

The Commission’s proposed threecount complaint alleges that 

Respondents engaged in unfair and 

deceptive practices in violation of 

Section 5(a) of the FTC Act by (1) 

unfairly failing to employ reasonable 

and appropriate data security measures, 

(2) deceptively representing that they 

used reasonable and appropriate data 

security measures, and (3) deceptively 

representing that they adhere to the EU– 

U.S. and/or Swiss-U.S. Privacy Shield 

Principles. With respect to the first 

count, the proposed complaint alleges 

that Respondents failed to employ 

reasonable and appropriate measures to 

protect their hosting environment from 

unauthorized access. Respondents’ 

failure to employ such reasonable and 

appropriate measures has caused or is 

likely to cause substantial injury to 

consumers in the form of several data 

breaches between 2019 and 2022, theft 

of Respondents’ customers’ confidential 

information stored in Respondents’ 

hosting services, and alteration of 

Respondents’ customers’ websites. 

These injuries are not outweighed by 

countervailing benefits to consumers or 

competition and are not reasonably 

avoidable by consumers themselves. 

Summary of Proposed Order With 

Respondents 

The Proposed Order contains 

injunctive relief designed to prevent 

Respondents from engaging in the same 

or similar acts or practices in the future. 

Provision I prohibits Respondents from 

misrepresenting, expressly or by 

implication: (1) the extent to which they 

protect the security, confidentiality, 

integrity, or availability of their hosting 

services; (2) the extent to which they 

use reasonable or appropriate measures 

to protect certain hosting services from 

unauthorized access; (3) the extent to 

which they utilize any security 

technology or technique, including 

monitoring, to protect certain hosting 

services; (4) the extent to which they 

protect the security, confidentiality, 

integrity, or availability of consumers’ 

personal information; and (5) the extent 

to which Respondents are a member of, 

adhere to, comply with, are certified by, 

are endorsed by, or otherwise 

participate in any privacy or security 

program sponsored by a government or 

any self-regulatory or standard-setting 

organization, including the E.U.-U.S. 

Privacy Shield Framework and the 

Swiss-U.S. Privacy Shield Framework. 

Provision II requires that Respondents 

establish, implement, and document a 

comprehensive information security 

program. The program must include 

specific security measures tailored to 

Respondents’ previous data security 

shortcomings alleged in the complaint. 

Provisions III–VI require that 

Respondents obtain initial and biennial 

information security assessments by an 

independent, third-party professional 

for 20 years (Provision III), cooperate 

with the independent assessor 

(Provision IV), provide the Commission 

with annual certifications of compliance 

with the Order from a senior executive 

officer from each Respondent (Provision 

V), and submit reports to the 

Commission if they suffer additional 

data incidents (Provision VI). 

Provisions VII–X are reporting and 

compliance provisions, which include 

recordkeeping requirements and 

provisions requiring Respondents to 


ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 90, No. 29 / Thursday, February 13, 2025 / Notices 9549 

1See infra note 5. 

2Based on the time necessary for similar activity 

in the federal government (including at the FTC), 

staff estimates that such contracting and 

administration will require approximately 4 fulltime equivalent employees (FTE) for the web 

Continued 

provide information or documents 

necessary for the Commission to 

monitor compliance. Provision XI states 

that the Proposed Order will remain in 

effect for 20 years, with certain 

exceptions. 

The purpose of this analysis is to 

facilitate public comment on the 

Proposed Order, and it is not intended 

to constitute an official interpretation of 

the complaint or Proposed Order, or to 

modify the Proposed Order’s terms in 

any way. 

By direction of the Commission. 

April J. Tabor, 

Secretary. 

[FR Doc. 2025–02575 Filed 2–12–25; 8:45 am] 

BILLING CODE 6750–01–P 

FEDERAL TRADE COMMISSION 

Agency Information Collection 

Activities; Proposed Collection; 

Comment Request; Extension 

AGENCY: Federal Trade Commission. 

ACTION: Notice. 

SUMMARY: The information collection 

requirements described below will be 

submitted to the Office of Management 

and Budget (OMB) for review, as 

required by the Paperwork Reduction 

Act (PRA). The FTC seeks public 

comments on the agency’s shared 

enforcement with the Consumer 

Financial Protection Bureau (CFPB) of 

the information collection requirements 

in CFPB’s rule on Duties of Consumer 

Reporting Agencies Regarding 

Disclosures to Consumers (Rule). That 

clearance expires on April 30, 2025. 

DATES: Comments must be filed by April 

14, 2025. 

ADDRESSES: Interested parties may file a 

comment online or on paper, by 

following the instructions in the 

Request for Comment part of the 

SUPPLEMENTARY INFORMATION section 

below. Write ‘‘Regulation V, subpart N; 

PRA Comment, P085405,’’ on your 

comment, and file your comment online 

at https://www.regulations.gov by 

following the instructions on the webbased form. If you prefer to file your 

comment on paper, mail your comment 

to the following address: Federal Trade 

Commission, Office of the Secretary, 

600 Pennsylvania Avenue NW, Suite 

CC–5610 (Annex J), Washington, DC 

20580. 

FOR FURTHER INFORMATION CONTACT: 

Ryan Mehm, Attorney, Bureau of 

Consumer Protection, (202) 326–2918, 

rmehm@ftc.gov, Federal Trade 

Commission, 600 Pennsylvania Avenue 

NW, Washington, DC 20580. 

SUPPLEMENTARY INFORMATION: 

Title: Regulation V, Subpart N (12 

CFR 1022.130–1022.138). 

OMB Control Number: 3084–0128. 

Type of Review: Extension of a 

currently approved collection. 

Abstract: The FTC shares enforcement 

authority with the CFPB for subpart N 

of Regulation V. Subpart N requires 

nationwide consumer reporting agencies 

and nationwide consumer specialty 

reporting agencies to provide to 

consumers, upon request, one free file 

disclosure within any 12-month period. 

Generally, it requires the nationwide 

consumer reporting agencies, as defined 

in section 603(p) of the Fair Credit 

Reporting Act (FCRA), 15 U.S.C. 

1681a(p), to create and operate a 

centralized source that provides 

consumers with the ability to request 

their free annual file disclosures from 

each of the nationwide consumer 

reporting agencies through a centralized 

internet website, toll-free telephone 

number, and postal address. Subpart N 

also requires the nationwide consumer 

reporting agencies to establish a 

standardized form for internet and mail 

requests for annual file disclosures and 

provides a model standardized form that 

may be used to comply with that 

requirement. It additionally requires 

nationwide specialty consumer 

reporting agencies, as defined in section 

603(w) of the FCRA, 15 U.S.C. 1681a(w), 

to establish a streamlined process for 

consumers to request annual file 

disclosures. This streamlined process 

must include a toll-free telephone 

number for consumers to make such 

requests. 

As required by section 3506(c)(2)(A) 

of the PRA, 44 U.S.C. 3506(c)(2)(A), the 

FTC is providing this opportunity for 

public comment before requesting that 

OMB extend the existing clearance for 

the information collection requirements 

contained in the Rule. 

Burden Statement 

Because the FTC shares enforcement 

authority with the CFPB for subpart N, 

the two agencies split between them the 

related estimate of PRA burden for firms 

under their co-enforcement jurisdiction. 

Estimated PRA burden, excluding the 

halving (to be shown at the conclusion 

of this analysis), are as follows: 

A. Requests per Year From Consumers 

for Free Annual File Disclosures 

When the FTC last sought clearance 

renewal for the Rule, we estimated 34 

million requests per year as a 

representative average to calculate PRA 

burden, and noted that the Commission 

was seeking more recent estimates of the 

number of requests consumers are 

making for free credit reports. Since that 

time, the Consumer Data Industry 

Association (‘‘CDIA’’) estimated that in 

2023 and 2024, the nationwide 

consumer reporting agencies provided 

on average approximately 17 million 

free annual file disclosures through the 

centralized internet website required to 

be established by the FACT Act and 

subpart N. Based on its knowledge of 

the industry, FTC staff projected that 

during this same time period of 2023 

and 2024 the consumer reporting 

agencies provided no more than 2 

million free annual file disclosures 

through the centralized toll-free 

telephone number and postal address 

required to be established by the FACT 

Act and subpart N. We expect that the 

number of requests for free annual 

credit reports will rise over the next 

three years because of increases in the 

population and consumer awareness 

that they are entitled to a free annual 

report. As a proxy, we are now 

estimating 21 million requests per year 

as a representative average year to 

estimate PRA burden for purposes of the 

instant analysis. 

The Commission seeks recent data on 

how these requests are being received— 

by internet, phone, or by mail. 

B. Annual File Disclosures Provided 

Through the Internet 

Both nationwide and nationwide 

specialty consumer reporting agencies 

will likely handle the overwhelming 

majority of consumer requests through 

internet websites. The annual file 

disclosure requests processed through 

the internet will impose a de minimis 

hourly burden in personnel costs per 

request on the nationwide and 

nationwide specialty consumer 

reporting agencies, except for those 

requests that are redirected to the mail 

process.1 However, consumer reporting 

agencies periodically will be required to 

adjust the internet capacity needed to 

handle the changing request volume. 

Consumer reporting agencies likely will 

make such adjustments by negotiating 

or renegotiating outsourcing service 

contracts annually or as conditions 

change. Trained personnel will need to 

spend time negotiating and 

renegotiating such contracts. 

Commission staff estimates that 

negotiating such contracts will require a 

cumulative total of 8,320 hours and 

$678,080 in labor costs.2 Such activity 


ddrumheller on DSK120RN23PROD with NOTICES1