LifeLock's Historic $100 Million Settlement, Deceptive Advertising, and the FTC

Practical Law Legal Update w-001-4301 (Approx. 6 pages)

LifeLock's Historic $100 Million Settlement, Deceptive Advertising, and the FTC

by Practical Law Commercial Transactions

The LifeLock Settlement

On December 17, 2015, the FTC announced that LifeLock agreed to pay $100 million to settle charges that the company violated a 2010 court order requiring the company to secure consumers' personal information and prohibiting it from using deceptive advertising. This is the largest monetary award the FTC has obtained in an order enforcement action.

In 2010, the FTC and 35 state attorneys general charged LifeLock with using false claims to promote its identity theft protection services. After the parties settled the claims, the US District Court for the District of Arizona issued a final order that:

Barred LifeLock and its principals from making any further deceptive claims.
Required LifeLock to take more stringent measures to safeguard the personal information it collects from customers.
Required LifeLock to pay $12 million for consumer refunds.

In July 2015, the FTC alleged LifeLock violated the 2010 order by:

Failing to establish and maintain a comprehensive information security program to protect users' sensitive personal information, including their social security, credit card, and bank account numbers.
Falsely advertising that it protected consumer sensitive data with the same high-level safeguards that financial institutions use.
Failing to meet the 2010 order's record keeping requirements.
Falsely claiming it protected consumers' identity 24/7/365 by providing alerts "as soon as" it received any indication there was a problem.

The LifeLock settlement demonstrates the importance companies should put in complying with consumer protection and advertising laws and highlights the FTC's continual monitoring of advertising practices, even after settling charges.

For more information on the LifeLock settlement, see Legal Update, LifeLock to Pay $100 million in FTC Settlement.

The FTC and Consumer Protection

The FTC is the primary federal agency charged with protecting consumers from unfair or deceptive practices under Section 5(a) of the Federal Trade Commission Act (FTC Act) (15 U.S.C. § 45). The FTC promulgates and enforces a variety of consumer protection statutes and regulations that govern specific advertising, telemarketing, financial, privacy, and data security practices.

For more information on FTC enforcement powers, see Practice Notes, Advertising: Overview: The Federal Trade Commission Act and Consumer Protection: Overview: Federal Trade Commission.

Triggers for an Investigation

While the FTC rarely discloses why it may begin investigating a company, there are several common triggers that can lead to an investigation, including:

Consumer complaints.
Recommendations from the National Advertising Division of the Council of Better Business Bureau.
News articles scrutinizing potential violations.
Petitions and requests from advocacy groups.
Requests from competitors to investigate alleged deceptive or unfair practices.
Direct observation by the FTC staff.

Companies can decrease their chances of unwanted regulatory attention by actively monitoring these sources. For more information, see Practice Note, FTC Consumer Protection Investigations and Enforcement: Triggers for an Investigation.

Initiation of an Investigation

When the FTC suspects a violation of consumer protection laws may be occurring, the agency can:

Perform initial research on its own and either:
- determine to open an investigation; or
- seek immediate relief in court (for example, by filing for a permanent injunction, temporary restraining order, asset freeze, or other equitable relief), if it believes there is an imminent threat of significant consumer injury.
Request information as part of an investigation, which normally remains confidential, and can be either:
- informal (for example, in an access letter); or
- formal (for example, in a civil investigative demand (CID) or subpoena).

For more information, see Practice Note, FTC Consumer Protection Investigations and Enforcement: Initiation of an Investigation.

Responding to Information Requests

If a company receives an information request from the FTC, it should contact the FTC to:

Negotiate:
- the scope of the request;
- timing for production of information; and
- approach for electronic discovery.
Request a meeting with the FTC to clarify confusion, answer additional questions, and advocate its position.

Companies can use the substance of their responses to explain why the marketing or advertising claims in question are substantiated or not misleading or have not otherwise violated the relevant law. Each submission should be viewed as an opportunity to tell the company's story, not just as a data dump.

For more information, see Practice Notes, FTC Enforcement of Advertising Claims: Responding to a Civil Investigative Demand, and FTC Consumer Protection Investigations and Enforcement: Responding to Information Requests.

Escalation of FTC Investigation

The FTC processes potential violations by escalating the claims through the agency. A target company has the opportunity to advocate for its position by requesting a meeting with FTC representatives, including:

FTC staff. The FTC staff generally has discretion to review the information collected during an investigation and conduct meetings with the target company. At the conclusion of its investigation, the staff recommends to the Bureau of Consumer Protection (Bureau) to either:
- close the investigation without further action; or
- pursue a formal enforcement action, in which case it usually sends the target company a written notification, a proposed settlement agreement called a consent order, and a draft complaint the FTC can use if it decides to file the complaint in court.
Director of the Bureau of Consumer Protection. If the Bureau decides to pursue a formal enforcement action the target company can request a meeting with Bureau staff, including the director of the Bureau, to try to persuade them that the investigation should be closed. The director has considerable discretion on how to proceed on each matter, so an effective presentation can slow the momentum as the Bureau deliberates or sends the matter back to the staff for further investigation or settlement discussions. If the Bureau agrees with the FTC staff's complaint recommendation, the proposed complaint and settlement terms (consent orders) are next forwarded to the FTC commissioners.
The FTC commissioners. A majority of the FTC commissioners must vote in favor of issuing a complaint against the company. Before the vote, the company can request a meeting with each commissioner to explain why a complaint should not be issued or why it cannot agree to the current proposed consent order. After deliberation, the commissioners can either:
- instruct the Bureau to close the case;
- send the file back to the Bureau and FTC staff for settlement negotiations with the target company; or
- vote to file a complaint and initiate litigation.

For more information on how the FTC handles potential consumer protection violations, see Practice Note, FTC Consumer Protection Investigations and Enforcement: Escalation within the FTC.

Settling with the FTC

If the FTC believes that an investigation has uncovered illegal acts or practices, it usually attempts to settle with the target company by entering into a consent order before resorting to litigation. Once the FTC has drawn preliminary conclusions of wrongdoing, the parties can reach a settlement at any point, even after a complaint recommendation has been forwarded to the Bureau of Consumer Protection, the FTC commissioners, or the US Department of Justice (DOJ).

FTC consent orders typically require injunctive relief to immediately stop the acts or practices at issue. Many agreements also include:

Fencing in provisions that are broader in scope than the conduct that is declared unlawful, to prevent future unlawful conduct.
Restitution or other financial relief for consumers.
Civil penalties, where applicable, for alleged violation of a rule or a previous administrative order.

Consent orders can vary in term. Administrative settlements generally have a 20 year term. For more information on settling with the FTC, see Practice Notes, FTC Enforcement of Advertising Claims: Settlement, and FTC Consumer Protection Investigations and Enforcement: Settling by Consent Order.

FTC Initiated Administrative Actions and Federal Court Proceedings

If settlement discussions crumble and the FTC decides to pursue the case, the next step is litigation. The FTC has the choice of bringing an administrative action or an action in federal court.

Administrative Action

FTC administrative proceedings function like expedited court proceedings in which FTC staff attorneys prosecute as complaint counsel. After an evidentiary hearing, an administrative law judge (ALJ) evaluates whether the company has committed the alleged acts. The FTC's Rules of Practice govern its adjudicative proceedings (16 C.F.R. §§ 3.1-3.83).

Federal Lawsuits

To initiate a federal lawsuit, the FTC sends a recommendation to the DOJ. DOJ attorneys then consult with FTC attorneys before deciding whether to file a claim. During that time, the target company often has an opportunity to present its case to the DOJ attorneys. If the DOJ files a complaint, the litigation often takes much longer than an administrative action (in the absence of an expedited process like a motion for a temporary restraining order).

For more information on FTC initiated proceedings, see Practice Note, FTC Consumer Protection Investigations and Enforcement: Litigation.

LifeLock's Historic $100 Million Settlement, Deceptive Advertising, and the FTC | Practical Law