While this change is noteworthy, it is important for businesses to remember that Maine’s telephone solicitation statute has a number of exceptions. For example, the law – and thus this new requirement to scrub against the reassigned number database – does not apply to calls made “in response to and at the express request of the person called,” and calls “to any person with whom the telephone solicitor has an established business relationship” (based on a purchase within the preceding 18 months or consumer inquiry within the preceding 3 months). As such, businesses engaged in telemarketing that may reach consumers in Maine should examine their practices carefully to understand whether the new requirement will apply, and if so, how to implement reassigned number database verifications into their outreach flows.

If you have any questions about how this new requirement may affect your business, please reach out to Alysa Hutnik or Jenny Wainwright. For more telemarketing updates, subscribe to our blog.

Attorney General Perspective

The first panel “AI and Exploitation of Children” featured South Carolina Attorney General Alan Wilson and members of his staff, Whitney Michael, Senior Advisor, Joseph Spate, Assistant Deputy Solicitor General, and Kyle Senn, Senior Assistant Attorney General. This panel provided an excellent summary of the perspective of State AGs on combatting child exploitation and how AI can both harm and benefit society.

AG Wilson explained that social media and AI are replacing tobacco and opioids as the new bipartisan issues, with AGs, including Oregon Attorney General Ellen Rosenblum, working to keep the topics at the forefront. He explained that providing personal information over the internet is now expected and natural, and while our ability to protect ourselves has increased, so has the ability to hack. Unfortunately, predators also take advantage of the fact that children are comfortable providing information over the internet, and they use a variety of online platforms to exploit people on the Internet.

AG Wilson said it best when he compared AI to a chainsaw – a valuable tool in the hands of a lumberjack, but a deadly weapon in the hands of Jason Voorhees. He touted the joint 54 state and territory letter to Congress spearheaded in part by his office. The letter, cosponsored by Oregon, North Carolina, and Mississippi, asked Congress to help evolve the legal landscape in light of changing technology, which he described as both amazing but capable of incomprehensible feats. AGs are working together to fill in the gaps in current laws to prevent and enforce against a variety of ways AI can be used to create child sexual abuse material (CSAM). In the wake of this letter, AG Wilson explained that Congress is now setting up an ad hoc committee to study AI, and other bipartisan bills are dropping.

Industry Thoughts

We heard on other panels from industry representatives how they are working to address child exploitation. One gaming platform described a range of tools including AI moderation in combination with human moderators to help combat child exploitation. It uses automated chat filtering for personal information and machine-learning to remove inappropriate language in violation of community standards. The platform scans each image upload using AI to ensure it is appropriate and compares it to hashed National Center for Missing and Exploited Children (NCMEC) databases. The platform does not allow images of real life people and provides account monitoring by parents for users under 18. Finally, the platform reports to the FBI and NCMEC using automated tools and escalates review of “trusted flagger” reports. They use a law enforcement response tool to speed up subpoena response times.

One AI platform described its safety-first principles as it seeks to benefit humanity. Policies outline the appropriate use, and the company constantly evaluates risk from pre-training to launch to ongoing monitoring. Pre-training excludes adult content, dark web, payroll and other content from data aggregators. Post training, automated and human evaluators work to tune the AI so it behaves in accordance with policies, such as refusing to answer when appropriate to avoid providing harmful material or personal information.

Conclusion

AGs, social and online platforms, and AI programs themselves are working to combat the dark side of AI including child exploitation. However, if third-party platforms or AI companies themselves fail to implement appropriate safeguards for children, it is likely they will encounter an AG inquiry in the civil or criminal realm.

Ms. Fatale posted a video on Instagram demonstrating how the product works and used the platform’s “Paid Partnership” tool, along with “#ad” and “#sponsored,” to indicate that she was working with Fenty Skin. In a recent inquiry, NAD determined that the post did not meet the FTC’s requirement that influencers “clearly and conspicuously” disclose when they are working with a brand.

NAD explained that the FTC has cautioned companies against relying on social media platforms’ disclosure tools and has stated that those tools should be used in conjunction with other disclosures. Although the post did include “#ad” and “#sponsored,” NAD noted that the hashtags appear on the fourth line of the post’s description and that consumers wouldn’t see them unless they clicked to expand the post.

NAD recommended that Fenty Skin require Ms. Fatale to “modify the challenged post to include a clear and conspicuous material connection disclosure in the video demonstration itself.” This is consistent with guidance the FTC provided in warning letters to influencers last year in which staff suggested that the influencers superimpose a disclosure in “much larger text over the videos.”

As part of the same inquiry, NAD found that another influencer – Sarah Novio – had posted a video about the product on her Instagram and TikTok accounts. Ms. Novio wasn’t paid for the posts, but she did receive the product for free. Although she included a “gifted” disclosure on TikTok, she neglected to do so on Instagram, and when Fenty Skin re-posted the video on their account, they didn’t include any disclosure.

During the course of the inquiry, Fenty Skin advised NAD that it asked Ms. Novio to update her Instagram post to include a clear disclosure that she had received the product for free. In addition, Fenty Skin removed the post from its own Instagram page and promised NAD that it would only re-post it if and when Ms. Novio adds the disclosure.

When it comes to applying makeup, you can go for a subtle barely-there look or you can go for something more bold. We won’t judge. But when it comes to influencer disclosures, the barely-there look isn’t going to be enough. FTC and NAD want those to bold and prominent. Yes, some might call that garish and unattractive but, ironically, that will help you avoid unwanted attention.

In a statement issued last year, the Department of Justice stated that ​“existing technical standards provide helpful guidance concerning how to ensure accessibility of website features.” Among other things, DOJ pointed to the Web Content Accessibility (or ​“WCAG”) Guidelines that are incorporated into most settlements in this area. DOJ also stated that while ​“businesses must comply with the ADA’s requirements,” they ​“have flexibility in how they comply,” and can ​“choose” how to ensure accessibility. Unfortunately, DOJ did not elaborate on what that means.

This month, the DOJ announced a Rule which requires state and local governments to ensure their websites and mobile apps comply with the WCAG 2.1 AA Guidelines in two or three years, depending on the number of people in their jurisdictions. This Fact Sheet summarizes the major points. Although the Final Rule does not apply to privately or publicly-owned businesses and doesn’t shed any new light on the issues businesses face in this area, the development is worth nothing because this Rule is likely to could serve as a roadmap for the DOJ when (and if) it finally issues rules for private entities.

According to undisputed evidence in the record, some of I Dig Texas’ products had been assembled in the United States, while others had been assembled in China. Even for the products that I Dig Texas had assembled in the United States, some components – such as a nitrogen power cell – had come from other countries. If you’ve followed our coverage of Made in USA claims and the FTC’s strict standard for supporting those claims, you might think you know how this case turned out. In this instance, though, you’d probably be 110% wrong (give-or-take about 10%).

The 10^th Circuit noted that under the Lanham Act, “a statement can be literally false only if it is unambiguous” and that “a statement without objective meaning can’t be literally false.” The court then asked itself “what does it mean to make a product in the United States or in America” and didn’t come up with a clear answer to its question. The term “make” could refer “either to the origin of the components or to the assembly of the product itself.” The challenged ads “are thus ambiguous when they say that the products are made in the United States or in America” and cannot be literally false.

How does the 10^th Circuit square its reading with the FTC’s Made in USA Rule? It doesn’t. In a short footnote, the court writes that “even if the FTC policy were otherwise instructive, it would not bind us when addressing false advertising under the Lanham Act.” The court then went on to say that given the absence of a “bright line” rule in the FTC’s policy, “it doesn’t remove the ambiguity of the phrase made in the United States or American-made.” The decision doesn’t go into more detail or discuss the FTC’s specific guidance on this issue.

If you want to know more about the FTC’s specific guidance on this issue and the consequences of ignoring that guidance, take a look at this post in which we covered a recent settlement over “Made in USA” claims that involved a $2 million penalty. The requirements in that settlement provide a good outline of what you should consider when making these types of claims. Even if you dig the 10^th Circuit’s analysis, you should know that the decision is a probably an outlier. The FTC, NAD, and other courts are likely to have a much different view of what it means for a product to be “made” somewhere.

Last year, for example, a California federal court ruled on a case in which a plaintiff claimed that the term “fruit naturals” on the front of fruit cups made by Del Monte Foods misled her into thinking that the products “contained only natural ingredients,” when that wasn’t the case. Del Monte argued that reasonable consumers wouldn’t be misled because the back of the cups clearly discloses that they include ingredients like citric acid, potassium sorbate, and sodium benzoate.

The court held that the term “fruit naturals” does not “make any affirmative promise about what proportion of the ingredients are natural” and was, therefore, ambiguous. The court found that “such ambiguity can be resolved by reference to the back label, which clearly discloses the inclusion of multiple synthetic ingredients.” Moreover, the use of “general knowledge and common sense” would lead consumers to understand that the product included some synthetic ingredients.

In contrast, consider a case that NAD initiated involving claims on the front of Quilted Northern packages advertising that the toilet paper was made “sustainably.” Because that term is ambiguous, NAD considered whether the advertiser had effectively qualified it. In that case, the advertiser included an explanation on the front of the package. NAD didn’t think that was sufficient, though, because the claim appeared at the top, the explanation appeared at the bottom, and there were a lot of other things in between. Similarly disclosures on the back of the package couldn’t cure the issue NAD found on the front.

What would the FTC think? Odds are they’d be closer to NAD’s position. We’ve already seen that in some contexts – such as the revised Endorsement Guides – the FTC has taken stricter positions on what is necessary for a disclosure to be clear and conspicuous, often insisting that it must be “unavoidable.” And when the FTC announced in 2022 that it was seeking input on ways to modernize its .com Disclosure Guidelines, the tone of the press release suggested that more stringent requirements were on the way.

What does this mean for you? It depends what side of the argument you’re on. If you’re an advertiser facing a class action lawsuit over claims on your packages, a growing number of cases suggest you should be able to rely on disclosures that appear on those packages. However, if you are looking to challenge a competitor over claims on its packages, a growing number of cases suggests that NAD may be a friendly forum for you to bring your challenge.

From kids on social media to fake reviews and junk fees, state AGs are working across state (and partisan) lines on initiatives that promise to mold the consumer protection landscape for years to come. In this post, we reflect on our conversation with Todd Leatherman, who works at the forefront of these issues as Director of the National Association of Attorneys General (NAAG) Center for Consumer Protection.

Trend 1 – Protecting America’s Online Youth

For state enforcers, children are top-of-mind, especially when it comes to social media. A coalition of 33 state AGs filed a federal lawsuit in California alleging Meta violated state consumer protection laws and the Children's Online Privacy Protection Act. The AGs claim that Meta knowingly designed and deployed addictive and harmful features on its social media platforms, intentionally addicting children and teens and misleading the public about whether its services were safe for younger children. A number of other states have filed similar lawsuits in state courts including Nevada, which also targeted TikTok and Snap. These lawsuits are ongoing and will no doubt affect how social media platforms engage younger consumers.

This year, Oregon AG and NAAG President Ellen Rosenblum chose her Presidential Initiative as: “America’s Youth: AGs Looking Out for the Next Generation.” This initiative and corresponding NAAG Presidential Summit will include programming on technology, physical health, mental and behavioral health, and financial literacy.

On the legislative front, we have seen new laws aimed at protecting young people online. Florida recently passed a law banning social media accounts for minors under 14 and requiring parental consent for 14 and 15-year-olds. Georgia may soon also require minors under 16 obtain parental consent to create an account, following similar restrictions passed in Louisiana, Texas, Arkansas (currently enjoined pending litigation), and Utah. Generals Letitia James of New York and Rob Bonta of California have also advocated for state legislation targeting the addictive features of social media. Given the aforementioned, we expect AGs to tune into emerging issues affecting children for years to come.

Trend 2 – Big Tech’s Advertising Practices

For years, big tech has been a leading issue for bipartisan cooperation among state enforcers. Last year, we saw a $700 million settlement with Google and 53 state AGs over the Google Play Store. This led to significant reforms in Google’s practices, including how consumers access apps and how payments are processed. Currently, 38 state AGs and the Department of Justice have sued Google over alleged anti-trust violations, including monopolizing the search market. The cases were consolidated with closing arguments slated to begin May 1^st.

Since our conversation with Mr. Leatherman, DOJ and 16 other state attorneys general announced a landmark lawsuit against Apple alleging that it monopolized the smartphone market. This includes allegations that Apple intentionally makes it difficult for consumers to switch cellphones and undermines innovation, among other claims.

Trend 3 – Algorithms and AI

The promise and perils of AI have drawn major focus at AG offices across the nation and at NAAG, according to Leatherman. Last year, 54 AGs sent a letter to Congressional leaders encouraging them to study how AI may lead to child sexual abuse and exploitation online. Another collation of 26 AGs submitted a comment to the FCC on the use of AI in robocalls with the FCC later voting to ban robocalls using AI-generated voices. (Revisit our post on Washington’s new AI task force here.)

Now, we’re seeing AGs particularly concerned about racial and gender bias in AI programs used in employment, housing, and financial lending and services. Enforcers are also looking into the marketing of AI, including whether companies are overpromising on what the technology can actually provide. Given how quickly AI is advancing across sectors, we expect to see more scrutiny in the months ahead. And stay tuned for additional information on AGs and AI as our team will be reporting on the NAAG and AGA Southern Region Meeting on Artificial Intelligence and Preventing Child Exploitation occurring in April.

Trend 4 – Fake Reviews

Fake reviews, including misleading influencer content, have drawn AG attention. This year, 22 AGs submitted a letter to the FTC largely supporting a new rule that would govern and ban fake reviews. That rulemaking is ongoing.

States, including New York and Washington, have taken individual action against companies engaged in deceptive review practices. This includes instructing employees or associates to post positive reviews, threatening or intimidating consumers who post negative reviews, or requiring consumers to sign NDAs to receive services. Notably, states are able to enforce the Consumer Review Fairness Act, a federal law.

Trend 5 – Automatic Renewals

States continue to enforce their recently enacted automatic renewal statutes or provisions (for example, laws in California, New York, Washington D.C., and Virginia), which generally impose disclosure requirements, require that companies obtain affirmative consent from consumers, and mandate cancellation mechanisms. This includes requiring an online cancellation option when a consumer signs up for a service online. That said, states do not necessarily need a new law to target these practices as their general consumer protection laws likely apply. AGs may also enforce the federal Restore Online Shoppers' Confidence Act.

Trend 6 – Junk Fees

Companies that advertise one price and then tack on fees should beware. Enforcers are making so-called “junk” or hidden fees a priority. California has passed a new law governing fees and Massachusetts is in the process of instating new regulations governing them. Not to be outdone, the FTC has also proposed a rule on fees with a virtual hearing to take place in late April. (This aligns with the Biden administration’s whole-of-government approach to junk fees with other rulemaking and guidance out of the FCC, CFPB, HUD, and DOT).

That said, AGs take the position they do not necessarily need new legislation to target fees. Pennsylvania has led the way in asserting claims under state consumer protection laws and the Consumer Financial Protection Act against companies that impose fees. Similarly, Connecticut and the FTC have joined forces in litigation against a car dealer that allegedly deceived consumers about the nature of fees and add-ons. And Washington D.C. has warned restaurants that service charges could be unlawful if they are not disclosed before an order is placed.

Trend 7 – Privacy

States continue to pass and enact new privacy laws. Earlier this year, New Hampshire became the 15^th state to pass a comprehensive state privacy law and several other privacy bills are currently making their way through the legislative process. Many of the new laws will become effective this year through 2026, spurring enhanced AG interest in privacy matters.

In California, we saw the first investigative sweep in this arena with General Rob Bonta sending out letters to popular streaming apps and device companies alleging they failed to comply with California’s new privacy law. According to the office, the investigation will focus on opt-out requirements for business that sell or share consumer personal information.

Trend 8 – Veterans

While veterans have long been a priority for state AGs, the uptick in businesses offering to “counsel” or support veterans in applying for government benefits has sparked new AG activity in this space. Last year, a bipartisan group of 44 AGs sent a letter to Congress urging the body to pass legislation that further protects veterans in the application process and the Texas AG’s office sued a company that misled veterans about their ability to help obtain benefits and charged alleged excessive fees in the process.

Trend 9 – Health

In the health space, opioid marketing, vaping, and illegal cannabis products continue to take center stage. While the larger opioid cases have concluded, litigation is far from over. AGs have been leading the way in targeting manufacturers, distributers, and pharmacies that engaged in deceptive marketing tactics around opioids. We’ve also seen a focus on nicotine and cannabis products, particularly those that may appeal to children. A group of 33 AGs sent a letter to the FDA urging more stringent regulations on electronic nicotine delivery products, including on the marketing of e-cigarettes and the use of influencers to promote them. Connecticut and Nebraska have also cracked down on illegal marketing of cannabis products using their state consumer protection laws.

Trend 10 – Rapid Response

Many businesses fail to realize how substantial a role AGs play in emergencies and urgent consumer issues. They face public pressure to respond to events in real-time. For instance, the Taylor Swift concert ticket debacle led to more than 2,600 consumer complaints in Pennsylvania alone.

And, when it comes to a market disruption or natural disaster, some states have specific price gouging laws that provide state AGs enforcement authority. These laws vary by state and it can sometimes be difficult for companies to know when they are in place. We’ve seen a rise in AGs targeting companies following emergency situations for increasing prices on consumer staples and targeting charities that mislead consumers about donations in the time of crisis.

Kelley Drye’s state AG team will continue to monitor consumer protection trends in 2024. To view our full conversation with NAAG’s Todd Leatherman, click here. To stay up-to-date with our AdLaw Access blog, subscribe here.

The fisheries from which ConAgra purchases its fish are certified by the Marine Stewardship Council (MSC) as meeting certain sustainability standards. Plaintiffs challenged the claims, “Certified Sustainable,” “Certified Sustainably Sourced,” “We have full traceability of all our fish,” and “Good for the Environment.”

The Court first looked to the claims on the front of the package that the fish are “Certified Sustainable Seafood MSC” and “Certified Sustainably Sourced.” Plaintiffs argued that because ConAgra allegedly sourced the fish from fisheries using unsustainable and environmentally detrimental fishing practices, like the pelagic trawl, these claims are misleading. The Court said that whatever gripes the Plaintiff has with MSC’s certification standards, the fact remains that ConAgra was certified by MSC and there is nothing false about advertising it as such. Put differently, “ConAgra is not advertising that their products are sustainable, but that their products are certified as sustainable by MSC.”

The Court also considered the claim that ConAgra has full traceability of all its fish. The Court was not persuaded by the Plaintiffs’ assertion that traceability and unsustainable fishing practices are so connected such that unsustainable fishing practices would preclude ConAgra’s ability to trace the path of the pollock from the time of capture to the frozen food packaging. The Court concluded that Plaintiffs did not allege sufficient facts to suggest that ConAgra cannot identify the origin of the pollock or track the history of the sourcing process.

The Court was less persuaded about the veracity of the “Good for the Environment” claim. ConAgra defended its claim by saying the statement is aspirational, non-actionable puffery. And indeed, the Court noted that if it were the only statement on the package, a reasonable consumer may believe it to be. But, as advertisers are well-aware, “context matters.”

Because the package displays the MSC certification indicating that the fish is “Certifiably Sustainably Sourced,” a reasonable consumer reading that the product is “Good for the Environment,” can infer that the fish is sourced in a manner that is not harmful to the environment. Moreover, the claim contains no aspirational language like “promotes,” “aims,” “or supports,” so a reasonable consumer would not take the claim as a mere goal to be sustainable. The Judge said that “because the question of whether a fish is sourced in a manner that benefits, or at least does not harm, the environment can be evaluated and measured,” and because the complaint alleged that the products are not in fact sustainable, the claim would be allowed to proceed.

ESG challenges are coming from all angles and consumer plaintiffs are eager to dispel inaccuracies about sustainable practices, even those that rely on technical fishing practices occurring outside of the U.S.. Marketers should carefully craft ESG claims to ensure they are not overstating the benefits. And, when reputable third party certifications may be available, marketers should take advantage of them as they help provide credibility and validation, which ultimately may insulate some of the more technical green claims from legal scrutiny.

Cooperation and Role of State AGs

Director Chopra began by complimenting the State AGs for their important consumer protection work, including by ringing the alarm bells on the foreclosure crisis. While he discussed the roles of states throughout his remarks, he emphasized that states and the CFPB need to work together. He reminded the AGs that early on, the CFPB published a procedural rule clarifying that State AGs can bring suit under the CFPB’s organic statute including a whole host of consumer credit and data laws, which several states have utilized. Director Chopra said the CFPB is looking for ways to collaborate with more states, noting they have been able to collect billions in penalties that can be used for consumer redress even in unrelated cases to make victims whole. Director Chopra asked that consumers send complaints to both State AG offices and the CFPB, because their consumer complaint system immediately routes complaints to the financial company at issue to get a response and resolution without staff intervention. The CFPB also is able to use data visualization tools to provide states with information about hot issues in different regions. The CFPB has used complaint data in collaboration with states to work on medical debt and other collection cases. Director Chopra said the CFPB is always looking upstream to identify warning signs to avoid future crises like the one caused by subprime mortgages.

Consumer Data and Security

Director Chopra explained that President Biden’s executive order on protecting sensitive personal data highlights a broad bipartisan interest in stopping the bulk transfer of consumer data. He explained that State AGs can work alongside the CFPB to enforce the Fair Credit Reporting Act, not only against the big three reporting companies, but also against data brokers. He noted the CFPB will propose additional rules to require data brokers to adhere to accuracy standards and otherwise protect consumer data. Director Chopra described categories of data and lists that brokers can purchase about vulnerable consumers, and his concern that there be a way for these people to be able to participate in the digital world without sacrificing privacy and security. He pointed to state laws requiring additional privacy and security such as Washington’s recent My Health My Data Act, and said he supported the fight against preemption of state privacy laws.

Big Tech and AI

Director Chopra reminded the audience of big tech’s efforts to become payment processors, providing them consumer transaction data. He noted these payment methods were used as a vector for imposter fraud, specifically citing the DOJ and states’ March lawsuit against Apple. Director Chopra explained the CFPB has recruited additional technologists with knowledge of user interfaces and design, and the agency has hosted enforcer roundtables with states to discuss issues with AI and technology, including how to draft CIDs.

On AI, Director Chopra said the CFPB is looking at marketing and advertising for discriminatory or manipulative AI. They are also reviewing how loans are being written, because if AI cannot explain why it denied credit to a person, it is a violation of federal law that requires explanation for denial. Director Chopra also said chat bots are another form of AI used by banks for customer service. He alluded that it could be considered deceptive to use human names and “…” thinking signals to simulate human activity. Director Chopra said he wants to see institutions affirmatively describe these chat bots as robots and ensure the bots do not provide inaccurate information or a poor customer service experience.

Bank Relationships

Director Chopra said the CFPB’s work has shifted some from mortgage lending issues with banks into non-banks. He said they have also heard from the AG community that national chartered banks have not cooperated on investigations, claiming preemption. Director Chopra said when that happens, the CFPB will work with the states to obtain the information themselves. His expectation is that banks work with the states to ensure consumers are protected.

Junk Fees

As a former businessperson himself, Director Chopra said pricing consultants he encountered in the past left a big impression on him. He noted that industries such as air travel, event ticketing, and banking have made it difficult to compare pricing resulting in reduced competition. He described certain bank fees such as a paper statement fee (when nothing is printed and no paper is sent) as “fake fees,” and harkened back to past CFPB actions against banks reordering payments to trigger multiple overdraft fees. Director Chopra also said that some credit card issuers created a business model based on rooting for people to be late, causing late fees. The CFPB has proposed rules to close what he described as a loophole in the credit industry, stating people understand they will have to pay interest but do not understand the other layers of fees they may not be able to control. Director Chopra also pointed to potential concerns with credit card reward “bait and switch” offers as a core truth in advertising concept. Though the CFPB is using rulemaking and enforcement actions to combat junk fees, Director Chopra also gave credit to the business community for taking initiative to become more upfront and transparent.

Stay tuned as our team will be hearing more from the State AG community on AI and other tech topics in less than two weeks at the NAAG and AGA’s Southern Regional Meeting/Artificial Intelligence and Preventing Child Exploitation Seminar.

Naked & Thriving, a family-owned skincare business, also runs The Bare Beauty Babes blog. One post on that blog started, much like this one does, with the question of whether hyaluronic acid can fight signs of aging. Unlike this post, though, that one included an answer to the question. In that post, a dermatologist claimed that she had “tested hundreds of hyaluronic acid serums” and found “5 that actually work.” A Naked & Thriving product came in first.

NAD wrote that endorsements from experts “must be supported by an actual exercise of the expertise that the expert is represented as possessing” in evaluating features which are relevant to an ordinary consumer’s use of a product. NAD requested information about the dermatologist’s expertise and the methodology she used to evaluate the “hundreds” of serums. Apparently, the advertiser didn’t provide it because NAD noted that there was “no evidence in the record” on either point.

The same claims that appeared on the blog also appeared in social media posts which were labelled as “sponsored.” Echoing concerns similar to ones FTC staff expressed in warning letters last year, NAD noted that a “sponsored” disclosure “might be insufficient if the viewer does not know who is the sponsor of the post. That is particularly true where, as here, a health professional is posting and endorsing a product.” The posts should have been more clear that Naked & Thriving was the sponsor.

On a related note, at the start of NAD’s inquiry, the bottom of each page of The Bare Beauty Babes blog included a disclosure in “very small print” stating: “The content on this site is sponsored and The Bare Beauty Babes may earn a portion of sales from products that are purchased through our site as part of our Affiliate Partnerships.” During the course of the inquiry, Naked & Thriving added a more prominent disclosure to the top of each page stating that it owned the blog. It also stopped recommending products.

If you asked us about how to fight signs of aging, we might give you some tips, but we’d probably direct you to consult a reputable health care professional. If you asked a reputable health care professional how to advertise an expert endorsement, they’d probably just direct you to consult us. In that case, we’d be happy to talk to you at length. For now, though, we’ll highlight two lessons you should take away from this decision.

• First, this decision demonstrates why it’s important to document the expertise your experts have and the methodology behind their recommendations. Simply saying that an expert is a doctor, for example, may not be enough.

• Second, this is the latest in growing line of cases in which NAD, FTC, and even competitors are challenging how endorsers (or influencers) disclose that they are working with the companies whose products they promote. Take a look at how your disclosure practices match up with these recent cases.

Keep visiting our blog for the latest in advertising and privacy tips (with occasional beauty tips thrown in for free).

The bill, as written, has no shortage of broad and undefined terms. To determine whether advertising directed at children is false or misleading, the bill, among other changes, amends New York’s general false advertising statute, New York General Business Law § 350 (“NY GBL § 350”), to require courts to consider the following factors:

• Whether the advertising “targets a consumer who is reasonably unable to protect their interests because of their age, physical infirmity, ignorance, illiteracy, inability to understand the language of an agreement, or similar factor.” Here, “‘consumer’ is defined as a person who is targeted by an advertisement, or those acting on such a person’s behalf.”
• Whether the advertising constitutes “an unfair act, practice or conduct.”
• “An act, practice, or conduct” is considered “unfair” to a consumer where it: “(a) causes or is likely to cause substantial injury to such consumer; (b) cannot be reasonably avoided by such consumer; and (c) is not outweighed by countervailing benefits to such consumer or to competition.”
• Courts must give special consideration to advertisements “concerning a food or food product” directed at children. In determining “whether any advertising concerning a food or food product is false or misleading,” courts must also consider factors including—but not limited to—the following: “(a) subject matter; (b) visual content; (c) use of animated characters or child-oriented activities and incentives; (d) music or other audio content; (e) age of models; (f) presence of child celebrities or celebrities who appeal to children; (g) language; (h) competent and reliable empirical evidence regarding audience composition and evidence regarding the intended audience; (i) physical location of advertisement, including, but not limited to, proximity to schools or other institutions frequented by children; (j) medium by which the advertisement is communicated, including, but not limited to, social media; or (k) other similar factors.”

The bill fails to define several key terms, including “unhealthy foods,” and “ignorance,” to name just a few. Further, the bill directs that courts consider not only whether advertising is directed to children, but also whether advertisements target persons unable to protect their interests due to “illiteracy” or “ignorance.” The bill would also provide a private right of action for consumers “targeted by an advertisement, or those acting on such a person's behalf.”

Although subject to constitutional challenges similar to those filed relative to NY’s soon-to-be-effective dietary supplement age restrictions, if passed, this amended version of NY GBL §350 would further open the litigation floodgates against food and beverage companies. Impacted stakeholders should consider advocacy strategies individually or via trade associations to ensure that their viewpoints are considered at the legislative level.

In December 2022, NAD recommended (among other things) that Smile Prep ​“avoid conveying the message that Smile Prep does not give preferential treatment” to its affiliate partners and that it ​“clearly and conspicuously disclose that Smile Prep’s rankings, reviews, and product information of the clear aligners of its affiliate partners are advertising.” Smile Prep appealed the decision, an NARB panel affirmed the decision in March 2023, and the panel opened a compliance inquiry later that year.

Smile Prep made a number of changes to its site in an attempt to comply with the NAD and NARB decisions. For example, with respect to the issues we’re focusing on in this post, Smile Prep included a box at the top of each clear aligner review page on the website that begins with the words ​“Advertising Disclosure” in bold and then explains that: ​“When you buy products and services through our links, we may earn commissions.”

NARB determined that the ​“disclosure is neither clear nor conspicuous.” Among other things, NARB was concerned that ​“by having the disclosure appear on each page of the website, Smile Prep has obscured the fact that the disclosure is meant to apply to references to affiliate partners and their products.” Moreover, it worried that consumers may not understand the disclosure to communicate that the rankings, reviews, and other information about Smile Prep’s affiliate partners are ​“advertising.”

Smile Prep advised NARB that it believed that it was already in compliance with the NAD and NARB decisions and with applicable law, and that it was not willing to make further changes. It further stated that, ​“in the event of a referral, it looked forward to working with the FTC to craft a meaningful and fair approach to the regulation of all affiliate review sites.” Most companies wouldn’t look forward to that, especially after the FTC’s recent update to the Endorsement Guides.

This month, the FTC released a letter in which it noted that “after FTC staff explained the reason for NARB’s referral and its potential consequences, the company agreed to re-engage with NARB and NAD.” The company subsequently took additional steps to comply with the original decisions, including by adding a prominent disclosure explaining that it has an economic motivation for its recommendations. NARB subsequently closed the inquiry.

This case demonstrates that how companies disclose incentivized reviews (including through affiliate review sites) continues to be a hot topic for regulators, NAD, and even competitors. The updated Endorsement Guides include more granular requirements on what it means for a disclosure to be ​“clear and conspicuous” and companies will be evaluated against those requirements. The case also demonstrates the potential consequences of ignoring an NAD or NARB decision.

The 19-member task force would consist of technology industry representatives, a civil liberties organization representative, subject matter experts, and other stakeholders. Indicative of the importance to AGs of protecting children, one of those members must represent a statewide teachers association. The taskforce would also include a representative of a statewide retail association and of an independent business association. The task force would meet at least twice a year to review policies, identify emergent risks, and provide recommendations to the legislature related to AI technology. The bill provides that the AG’s office administer the task force, whose duties would also include:

• Examining the development and use of generative AI by both private and public sector entities;

• Making recommendations to the legislature regarding standards for the use and regulation of generative AI systems to protect the safety, privacy, and civil and intellectual property rights of the state’s citizens.

While businesses should keep an eye on AI developments in Washington state as the AG is generally on the forefront of many consumer matters, the reporting by the taskforce won’t be seen for quite some time if the bill passes; an interim report is due December 1, 2025 and a final report is due June 1, 2027.

AGs remain incredibly focused on AI and are continually looking for opportunities to develop policy and enforcement initiatives around this powerful technology. AG Ferguson’s emphasis on AI through an inclusive task force is not a novel initiative, as states such as Alabama, Massachusetts, New Jersey and Wisconsin have already launched similar task forces:

• Massachusetts’s task force was established on February 14 to study AI and generative AI technology and its impact on the state, private businesses, higher education institutions, and constituents. The aim of Massachusetts’s new task force is to provide recommendations for how the state can best support its businesses in leading sectors around AI adoption. In addition, the task force will provide recommendations focused on startups’ ability to scale and succeed in Massachusetts. The task force will present its final recommendations to the governor later this year.

• Alabama’s task force launched on February 8 and will recommend policies for the responsible and effective use of generative AI in state executive-branch agencies. A report on the task force’s findings on current generative AI use in executive branch agencies and their recommendations for responsibly deploying such technology is due to the governor by November 30, 2024.

• New Jersey’s task force launched on October 10, 2023 and is focused on studying emerging AI technologies. New Jersey’s task force is also responsible for analyzing AI’s potential impacts on society as well as preparing recommendations to identify government actions encouraging the ethical use of AI technologies. The task force’s findings and recommendations will be presented to the governor no later than 12 months from the effective date of the order.

• Wisconsin’s task force launched on August 23, 2023 to study the effects of AI on Wisconsin’s workforce. The task force is responsible for gathering and analyzing information to produce an advisory action plan for the governor, such as recommending policy directions and investments related to workforce development and educational systems to capitalize on the AI transformation. The goal is to have an action plan for the governor’s consideration in early 2025.

There will likely be more states developing task forces and legislation in the coming years, as states continue to balance AI’s utility with its risk. And don’t forget; state consumer protection laws are broad and already apply to AI.

Sephora sells a line of ​“clean” products under its ​“Clean At Sephora” line. The company explains that those products are “formulated without phthalates, formaldehyde or formaldehyde releasers, oxybenzone and octinoxate, and more.” In some places, the company also links to a more detailed list of ingredients that are not included in the products.

As we posted last year, a consumer filed a purported class action against Sephora, alleging that although Sephora advertise the products as being “clean,” they “contain ingredients inconsistent with how consumers understand” that word. The complaint provides a list allegedly synthetic and potentially harmful ingredients that are included in the products.

At the time, we noted that this case is a litmus test for the ​“reasonable consumer” standard. Given that Sephora clearly disclosed what it meant by “clean,” it wouldn’t be reasonable for consumers to assume that it means anything else. Luckily, the court gave reasonable consumers some credit and determined that they wouldn’t be misled by Sephora’s explanations.

The complaint left the court “guessing as to how a reasonable consumer could mistake” the company’s claims and “believe that the cosmetics contain no synthetic or harmful ingredients whatsoever.” Sephora explained that products were formulated without specific ingredients. The court noted that “nowhere on the label or in the marketing materials plaintiff cites does defendant make any claim that the products are free of all synthetic or harmful ingredients.”

From a false advertising perspective, it doesn’t matter that the plaintiff provided “a laundry list of synthetic ingredients found in ‘Clean at Sephora’ cosmetics that she claims have been known to cause irritation or other human harm.” To determine whether or not Sephora’s claims are false, it’s necessary only to consider whether the products included any of the ingredients that Sephora claimed the products did not contain. Because that wasn’t the case, the court dismissed the false advertising claim.

This analysis is similar to the one we discussed in last week’s NAD case, though NAD added the additional caveat that the list of excluded products should “reflect the ingredients banned that are typically used in cosmetics products.” As the law in this area evolves, these two decisions should help to provide a helpful framework for companies that make “clean” claims.

The framework may also be helpful for companies that make other claims using broad terms – such as “sustainable” – that don’t have established definitions. Advertisers should provide a clear and reasonable explanation of what they mean by those terms. Challengers may disagree with the definitions, but advertisers may argue that reasonable consumers won’t be misled as long as the advertisers meet the definitions.

What’s the issue?

Although it exempts protein powders, protein drinks and other protein foods unless they contain ingredients promoted for weight loss or muscle building specifically, the language is otherwise very broad, making compliance a challenge. Here are just some of the friction points:

• Age-Gating, Including At Delivery: Retailers must verify the age of individuals purchasing covered products. Valid verification documents include an individuals’ driver’s license, state ID or passport. For sales that are delivered, retailers are tasked with implementing age verification processes at the point of delivery. Most common carriers have processes to age-gate at age 21; however, age-gating at 18 is not broadly offered or will cost extra. Neither the law nor guidance offer direction for sales completed via direct selling companies or through delivery services such as Doordash or similar.
• “Covered Products” Effectively Includes Every Possible Means of Labeling, Categorizing, or Promoting the Products – Including Those Outside the Manufacturer’s Control: The law explicitly states that covered products containing certain ingredients, such as steroids, green tea extract, garcinia cambogia, or creatine, cannot be sold to minors. Moreover, products whose labeling includes statements or imagery that imply health benefits related to weight loss or muscle enhancements are also subject to this new law - targeting not just ingredients, but how products are presented to consumers. As such, even if the manufacturer does not include an express weight loss claim on the label, if a retail platform categorizes it under “weight loss” on its website, this could cause the product to be covered.
• Enforcement and Penalties: The law allows the New York Attorney General to bring an action to stop a violation and impose civil penalties of up to $500 per violation. While the law does not expressly provide for a private right of action, impacted stakeholders should anticipate that interested parties may conduct “secret shopping” campaigns and provide any relevant findings to the AG’s office.

Legal Challenges

In December 2023, the Natural Products Association filed suit seeking to stop implementation of the law on constitutional grounds. More recently, another dietary supplement trade association, the Council for Responsible Nutrition (CRN),also filed suit. Highlights of CRN’s complaint include the following:

• Constitutional Challenge: CRN contends that the law infringes on constitutional principles by imposing restrictions that infringe on lawful commercial speech. CRN claims that the law unduly restricts lawful commercial speech by targeting “all representations concerning covered products, regardless of their accuracy.”

• Lack of Scientific Basis: The complaint challenges the legislative intent behind the law which aims to prevent eating disorders among minors. CRN argues that while it is a “noble and worthwhile goal,” there is “absolutely no evidence” demonstrating a causal link between covered products and eating disorders, citing the state’s lack of substantiation for its claims. For example, CRN cites studies that support the safety of prebiotic fiber supplements (which would be subject to the law) for combating childhood obesity.
• Economic and Practical Burdens: CRN further argues that the law’s overly broad definitions and the lack of specificity could post significant economic challenges for the industry. CRN notes that “[w]ithout any guidance from the State, but substantial financial penalties for violations, the act compels retailers and marketers to err on the side of restricting sales of products with lawful claims.”

Looking forward:

While New York leads the charge as the first state to enact this type of legislation, there are indicators that other states may be considering similar paths. At present, California, Massachusetts, New Jersey and Rhode Island all have bills pending at various stages. These bills all have varying and inconsistent language, which could further increase the complexities of selling these products nationwide.

On Friday, FTC staff put another stake in the ground when it sent a letter to the Direct Selling Association (“DSA”), doubling down on its reframing of the longstanding Koscot test for determining whether a business is an illegal pyramid scheme – a reframing that Judge Barbara Lynn soundly rejected in the Neora matter, as we previously discussed here. Also on Friday, the FTC sent a separate letter to the Direct Selling Self-Regulatory Council (“DSSRC”), taking issue with the independent body’s issued guidance on income disclosure statements.

We discuss these two letters in more detail below, but note the following key takeaways:

• Advisory opinions and letters such as the ones discussed below reflect the views of the current staff and are not official Commission positions. The Commission is not bound by these opinions, and future staff may rescind or modify them at any time (as illustrated below by staff’s disavowal of its 2004 Advisory Opinion, upon which many in the direct selling industry have relied over the years).
• Regardless of Commission staff’s opinions, Section 5 and associated case law ultimately control. Commission staff undoubtedly intends to raise the bar for compliance while attempting to improve its litigation position in future matters (and possibly avoiding a repeat of the Neora loss), but courts must ultimately look to the law and relevant precedent in determining whether a practice is unfair or deceptive under the FTC Act.

Repudiation of “Primary Source” Test

In 2004, when DSA sought guidance regarding FTC staff’s analysis of a pyramid scheme, staff clarified in a letter that “[t]he critical question for the FTC is whether the revenues that primarily support the commissions paid to all participants are generated from purchases of goods and services that are not simply incidental to the purchase of the right to participate in a money-making venture.” In other words, if compensation was “primarily” based on recruitment rather than product sales, the operation would be considered a pyramid scheme. This Advisory Opinion is well-known within the direct selling industry and has been cited in multiple complaints and decisions over the last 20 years, including in the recent Neora decision.

In last week’s letter to DSA, Division of Marketing Practices Associate Director Lois Greisman restated a position expressed during the Neora trial and at recent industry events that the “primary source” test for differentiating a legitimate business from an illegal pyramid scheme does not exist, and that industry has misinterpreted the 2004 Staff Advisory Opinion. The letter cites language in certain decisions such as Koscot, Noland, and Vemma to suggest that the dispositive inquiry for a pyramid analysis is whether a compensation plan incentivizes recruiting and/or relies on recruiting to unlock significant rewards – a position the agency advanced (and lost) in the Neora case.

While acknowledging that many FTC complaints and court decisions use the “primarily” or “primary source” language, the staff letter discounted that language as related to “litigation decisions” and/or “not key holdings in the decisions” and stated that the 2004 letter is no longer valid and therefore rescinded.

The disavowal of the 2004 Advisory Opinion demonstrates a shift in staff’s thinking on pyramid scheme standards, but – importantly – does not change applicable law. The FTC’s position did not hold in Neora, and future litigation will determine whether other courts accept the FTC’s reframing.

DSSRC IDS Guidance

The DSSRC, a national advertising self-regulatory program administered by BBB National Programs, is tasked with monitoring and addressing earnings and product claims made by the direct selling industry, and issuing guidance on lawful advertising and marketing practices. For example, DSSRC’s “Guidance on Earnings Claims for the Direct Selling Industry,” which was first issued in July 2020 and subsequently revised in 2022, lays out guiding principles for making truthful and non-misleading claims, including that companies refrain from making lavish lifestyle claims and focus on the overall “net impression” communicated by any product or earnings claims.

In fall 2023, DSSRC issued a new document, “Guidance on Income Disclosure Statements for the Direct Selling Industry,” to provide guiding principles to help direct selling companies develop income disclosure statements, which are commonly used in the industry to provide prospective participants with earnings and other key information that consumers may wish to consider.

In last week’s letter to DSSRC, FTC staff raised several concerns with this new IDS Guidance. For example, Ms. Greisman took issue with the Guidance’s discussion of business costs, arguing that all costs – mandatory and optional – must be tracked and accounted for when determining whether earnings claims have a “reasonable basis.” But this position does not account for the manner in which direct selling companies allow sellers to determine how to build their businesses and which costs to incur. DSSRC’s Guidance takes the balanced approach that companies should disclose mandatory costs, but that non-incidental expenses should be evaluated on a case-by-case basis, thus acknowledging that different sellers may engage in a variety of different marketing techniques.

FTC staff also argued that even supplemental income claims may be misleading if most people are not making any money net of expenses. But this position ignores the low entry costs associated with a direct sales opportunity, and does not acknowledge that industry calculations of expected earnings, whether measured as averages or medians, do not account for the significant variability in the amount of time and effort invested in building sales businesses.

The letter also takes the position that any representations regarding substantial earnings must be qualified “at a minimum [by] a clear, prominent, and unavoidable presentation of the typical participant’s revenue minus expenses—all of which must be substantiated.” But FTC staff provides no support or precedent for why an appropriately qualified earnings claims could not be made based on gross earnings where the claim makes that fact clear and reiterates that expenses vary by seller.

***

With these two letters, FTC staff has unmistakably turned up the heat on the direct selling industry and reiterated that it will not cede ground based on its loss in the Neora trial. Yet the agency can’t make law by proclamation – that will be for a judge or jury to decide.

Wonderbelly engaged a number of influencers to promote its Wonderbelly Antacids on social media. The challenger argued that many of these influencers failed to properly disclose their material connection to Wonderbelly and that even when the influencers did make the necessary disclosures, they were buried among other hashtags or “below the fold” such that consumers would have to click a link to see them.

In response, Wonderbelly agreed to revise its influencer agreements to comply with the FTC’s Endorsement Guides. More specifically, the company will require influencers to include hashtags such as #ad or #WonderbellyPartner at the beginning of each post. The company also promised to require its influencers to verbally disclose their connection to Wonderbelly in video posts. NAD was happy with these changes.

The challenger complained about a post by Demi Moore promoting Wonderbelly which she stated was “not an ad” and failed to disclose that she is an investor in the company. Wonderbelly responded that Ms. Moore almost always discloses that she is an investor in her posts, and that it had advised her to ensure she does that in every post going forward. NAD was happy with that, too, although it cautioned that Ms. Moore should not claim that a post is “not an ad.”

The challenger also complained that when Wonderbelly reposted influencer posts, the original disclosures weren’t carried over to the repost. Wonderbelly argued that the reposts did not require a disclosure, but NAD disagreed. In fact, in the revised Endorsement Guides, the FTC has stated that when reposting material from a paid influencer, an advertiser must clearly and conspicuously disclose its relationship to the influencer in the repost.

There’s nothing surprising in this decision, but it’s worth noting that the challenge was brought by a competitor, rather than having been initiated by the FTC. Companies that take shortcuts hoping that they will stay under the FTC’s radar should remember that competitors have their own radars. And companies that find their competitors aren’t complying with the law should remember that NAD provides a forum to address that.

Amyris made the following claim: “Our 100% sugarcane derived squalane is ethically and sustainably sourced.” To support the claim, the company relied on a certification from Bonscuro, a leading global sustainability platform that sets standards for sugarcane. The certification is based on an assessment of each step in the sugarcane’s chain of custody in the production process. Based on that certification, NAD determined that the claim was substantiated.

Next, NAD examined the support for the advertiser’s claim that “all of our ingredients are also ethically and sustainably sourced.” To support this claim, Amyris relied on its Supplier Code of Conduct which requires all of its suppliers to assure that, among other things, they engage in ethical practices (including labor practices) and that they source their ingredients in a way that minimizes deleterious impacts to the environment.

NAD noted that it has previously found that supplier codes of conduct can support aspirational claims related to sustainability efforts. For example, in this case, the advertiser referred to its Supplier Code of Conduct as evidence that reducing its carbon emissions is a focus of its sustainability efforts and that those efforts are growing and evolving, an aspirational claim. NAD thought the evidence was enough to support the advertiser’s claims.

In this case, though, NAD questioned whether the Supplier Code of Conduct could support “a broad, unqualified claim that all of the ingredients in the product are ethically and sustainably sourced.” It determined that while the Code might demonstrate a “commitment to ensuring that ingredients are ethically and sustainably sourced, it does not, standing alone, demonstrate that all ingredients are, in fact, ethically and sustainable sourced.” Therefore, NAD recommended that the company either stop or modify the claim “to better fit the evidence in the record.”

This case suggests that certifications from reputable organizations that engage in thorough assessments can be helpful in substantiating sustainability claims. Although supplier codes of conduct can also be helpful to substantiating certain sustainability claims, those claims will need to be worded carefully to avoid conveying a broader claim than the advertiser can reasonably support.

NAD notes that context in which “clean” claims are made dictates their meaning and, therefore, that advertisers should explain exactly what they mean. In a nod to challenges outside of the self-regulatory context, NAD warns that “this is especially important in light of numerous class action lawsuits filed against beauty companies for touting their ‘clean’ products” which contain ingredients that some may not consider clean. (Click here for an example of one of those suits.)

In this case, Amyris Clean Beauty qualified its “clean ingredients and clean formulas” claim by adding the following explanation in the same sentence: “we ban over 2,000 ingredients that are known to be toxic to you and the environment.” In response to NAD’s inquiry, Amyris pointed to lists of substances that various regulatory bodies, countries, and trade associations have deemed to be toxic to human health or the environment and explained that the company doesn’t use those substances in its products.

Based on NAD’s decision, it seems like defining what “clean” means by clearly explaining what ingredients aren’t included in a product may be a good strategy. However, that’s only part of the strategy. Leaning on the FTC’s Green Guides, NAD notes that “a truthful claim that a product, package, or service is free of, or does not contain or use, a substance may nevertheless be deceptive if the substance has not been associated with the product category.”

In this case, NAD found that it wasn’t clear whether the over 2,000 ingredients Amyris doesn’t use are typically associated with cosmetics. Thus, NAD recommended that the company modify the claim “to reflect the ingredients banned that are typically used in cosmetics products.” Presumably, that means that Amyris can continue to make the “clean ingredients and clean formulas” as long as it updates the disclosure, as recommended.

This may be a good model for companies who are faced with NAD challenges, but we’ll have to wait and see whether plaintiffs’ attorneys and courts will feel the same way. In the meantime, tomorrow we’ll look at lessons that this decision may hold for sustainability claims.

In terms of what is visible, regulators expect companies to make detailed, specific disclosures and obtain opt-in consent for most health data collection, use, and sharing. Getting these disclosures and consents right, however, requires a lot of preparatory work, starting with identifying health data that a company controls.

A few steps can be helpful in managing this uncertainty. First, adopting a framework to classify health data will lead to greater consistency and efficiency in this cornerstone compliance activity. Second, taking a clear-eyed view of the difficulty of obtaining a consent will help set realistic business expectations for the use of health data in this challenging regulatory environment. Third, documenting a health data privacy program will help to maintain the program over time and demonstrate compliance to regulators and commercial partners.

Framework for Data Classification: Is It Health Data?

For many companies, determining whether they process health data, and which elements of their data inventories constitute health data, is a daunting task. The exercise can involve reviewing thousands of variables, segments, or personal data elements.

At present, there is little regulatory guidance and no common taxonomy of health data definitions, making it difficult to benchmark. In addition, health data definitions vary across state and federal regulators, and adopting a national approach based on the broadest definition might be infeasible from a business perspective.

A few strategies can help manage the uncertainty:

• Work from explainable factors. Using factors that capture the overlap among different health data definition will be helpful in establishing consistent classifications and educating business stakeholders about when they’re encountering health data. Factors that are based on the current range of health data definitions include:
  • Does the data reveal a specific health condition?
  • Does the data reveal a past or present health condition?
  • Does the data relate to a specific consumer?
  • Does the data relate to a sensitive health matter?
  • What kinds of harm (if any) could use or disclosure of the data reasonably cause to an individual.
  • Particularly important for Washington and Nevada: Does the data relate to a consumer’s past, present, or future health status?

• Think holistically about classification. Classifying health data in a vacuum can lead to trouble. Regulatory definitions are broad, and it may be insufficient to analyze a data element on its own. Rather, it may be necessary to consider the purpose of using or disclosing a specific data element bears on whether it is health data. It’s also possible that a data element is “health data” when under the control of one entity but not another. Understanding the business processes, contractual commitments, data sources, and other factors surrounding potential health data is therefore critical. In many cases, there won’t be a clear answer to whether a data element is health data. Being able to identify what’s clearly in, and out, of this category allows businesses to devote more time to genuinely debatable cases.

• Think about scalability and sustainability. A one-time classification effort, even if it encompasses thousands of variables, might be feasible for many companies. Maintaining these classifications over time is another story. For companies with relatively static data inventories, maintenance over time is likely less challenging. When inventories change quickly, however, a case-by-case review of data elements might be impractical. Consider setting a cadence for review and how one might designate privacy champions within the business to apply the framework on an ongoing basis, in coordination with legal support.

There’s Consent, and Then There’s MHMD Consent

While the FTC and states with comprehensive privacy laws are moving toward requiring opt-in consent for most health data processing, MHMD creates particularly stringent consent requirements. The difference between MHMD and other health data regulations lies not in the action required for consent – it must be voluntary and unambiguous – but in the narrow scope of consent that is permissible and the details that must be disclosed to make the consent informed. (Although other regulators have not been as explicitly restrictive, there is a clear trend in this direction, as we discussed in our recent posts on the FCC’s one-to-one consent order.)

Specifically, a business must disclose the following to obtain consent to collect or share consumer health data:

1. The categories of consumer health data collected or shared;
2. The purpose of the collection, including the specific ways in which it will be used;
3. The categories of entities with whom the consumer health data is shared; and
4. How the consumer can withdraw consent from future collection or sharing of consumer health data.

Meeting these standards might be infeasible for many businesses, particularly those that do not have direct relationships with consumers.

MHMD’s requirements to sell consumer health data are even more stringent. The law requires a valid authorization, which must include the name and contact information of the purchaser, be signed by the consumer, and expire within one year of signatures, among other requirements. Obtaining an authorization outside of limited circumstances is unlikely to be practical for most companies.

The main alternative to consent or authorization is to restrict collection of health data under MHMD to what fits under the necessity exception. Washington has not provided further guidance on the scope of this exception, but we expect regulators to interpret this exception narrowly.

Documentation is Key

We get it: companies are reluctant to create discoverable documents that might be used to prove that they misinterpreted health data regulations. The alternative, however, is far worse and could be used to support the argument that a company systemically failed to govern health data in a reasonable fashion. It can also lead to inconsistent practices within a company and time-consuming back-and-forth between business and legal teams.

Key documents include health data definitions, consent requirements, partner diligence processes, data subject request procedures, and model contract terms. Many of the consumer health data practices that should be documented are likely extensions of current privacy programs and processes, such as data protection assessments.

Of course, some discussions warrant protection under attorney-client privilege. Maintaining clear lines between discussions that provide legal advice and operational guidance to business teams will help draw defensible lines around privilege.

* * *

The acceleration in health data privacy regulation is adding to demands to privacy teams that are already stretched thin. Confronting the breadth of “health data” definitions and the impact of these regulations on business operations in the absence of regulatory guidance is especially challenging. For better or worse, the boundaries of health data privacy regulations will be clarified through enforcement and MHMD’s private right of action. In the meantime, understanding these laws’ core purposes and keeping a close watch on statements from regulators will be helpful starting points to setting compliance priorities.