Originating Providers as Gatekeepers. The State AGs emphasize that the most effective way to stop illegal robocalls is to prevent them from entering the network in the first place. They echo the FCC’s statement from the KYC Further Notice that some originating providers “do not do enough” to vet their customers, and that this lack of diligence not only enables illegal robocalls but also hampers law enforcement’s ability to trace bad actors. 

KYC “Model Standards.” Throughout their comments, the State AGs refer to the public-facing KYC protocols for one particular company which they call “model standards,” and suggest that the FCC use them as “a reasonable starting place for this discussion.” As described in the comments, these protocols include robust customer identification measures, lists of behaviors and categories of businesses that would warrant a higher standard of KYC review, and an emphasis on approaching KYC as a continuing obligation through post-activation monitoring and audits.  

KYC Requirements Should Go Beyond the Proposed Rule. While the KYC Further Notice proposed that originating providers obtain at minimum a customer’s name, physical address, government-issued ID number, and alternate phone number, the State AGs argue this baseline is insufficient. They recommend that providers also obtain and verify information related to business formation and ownership, taxpayer identification numbers, articles of incorporation, good standing certificates, lists of DBAs and trade names, verified email domains, and the identity of business owners (including indirect owners holding a 10% or greater stake). The State AGs further suggest that providers be required to examine a customer’s business practices, consent procedures, sample call scripts, and any prior enforcement actions or provider terminations. 

Ongoing Monitoring and Re-Verification. The State AGs endorse the concept of KYC as an ongoing inquiry rather than a one-time checklist. They support required annual re-verification at minimum, with more frequent re-verification triggered by “red flags” or “changes in traffic patterns.”  

No Exemption for Smaller Providers. The KYC Further Notice asked whether enhanced requirements would unduly burden smaller providers. While acknowledging the potential burden, the State AGs say no exemption should apply, noting that illegal traffic “has often been facilitated by smaller providers,” citing multiple state enforcement actions as examples. They also suggest that any exemption for smaller providers would make them “more attractive to bad actors seeking a less rigorous entry ramp for illegal traffic.” 

High-Risk Customers and Red Flags. The State AGs support a universal baseline KYC standard applicable to all customers regardless of size or volume, with enhanced monitoring and more frequent re-verification for high-risk customers. They cite numerous red flags and high-risk indicators identified in the KYC Further Notice and industry KYC “model standards” that they say would “appear in any basic KYC screening” and would warrant heightened scrutiny, including: use of registered agents or virtual offices as physical addresses, residential addresses for corporate registration, no commercial web presence, suspicious or newly created email domains, non-registration in the state claimed, payment via cryptocurrency or other non-traceable means, vague or incomplete information, and aggressive or hostile behavior. 

Implementation, Recordkeeping, and Enforcement. The State AGs support applying enhanced KYC to both new and renewing customers. They support downstream blocking requirements—i.e., requiring downstream providers to block traffic from an originating provider found non-compliant with KYC rules—as well as the proposed per-call forfeiture structure to correlate penalties with the volume and harm of illegal calls. On recordkeeping, the AGs support the FCC’s proposal to require “originating providers to ‘retain KYC information and supporting records for the entirety of any potential statute of limitation period relating to misuse of their services to make illegal calls.’” 

MVNOs and SIM-Based Fraud. Separately, the State AGs note that the Multistate Anti-Robocall Litigation Task Force has been engaging with industry to learn more about the role of Mobile Virtual Network Operators (MVNOs) in the mobile ecosystem and “about the proliferation of SIM-based fraud” (such as bulk SIM purchases and activations). They support further FCC inquiry into KYC practices for prepaid and postpaid mobile service sold through third-party retailers. They acknowledge, though, that this is a distinct issue from the current rulemaking’s focus on business customers of originating voice providers, to be addressed at another time.

***

The State AGs’ unified comments underscore the depth of bipartisan state-level focus on rooting out illegal robocall traffic from voice service networks. Companies that originate voice traffic, as well as their customers and downstream partners, should evaluate their KYC and due diligence practices now to identify potential improvements that could ward off unwanted attention from State AGs and other regulators. We expect the KYC rulemaking, as well as the ongoing work of the Multistate Anti-Robocall Litigation Task Force, to be among the topics discussed at the Robocall Summit organized by the National Association of Attorneys General that will take place later in August. Kelley Drye will also be holding a webinar on September 23 with representatives from several State AGs’ offices to discuss robocall issues and enforcement priorities. Additional details about the webinar and a link to register will be made available here. 

In Tempest v. Safeway, the plaintiffs accuse Safeway of creating illusions about prices that induce some shoppers to make purchases they otherwise would not have. Wine again serves as a central catalyst, this time in a dispute over whether price advertisements misled consumers about the duration of discounts.

The plaintiffs allege that Safeway advertised discounted “Member Prices” for wines that were available “thru” a specified date. According to the complaint, consumers understand those dates to mean that the discounts would disappear after the specified date. The problem, plaintiffs say, is that the discounts didn’t really end in any meaningful way. Instead, Safeway allegedly renewed or replaced the promotions, allowing Rewards members to continue receiving substantially similar discounted prices month after month. 

Safeway argued that no reasonable consumer would be misled because the tags never expressly promised what would happen after the “thru” date. The court wasn’t persuaded. At the pleading stage, the court held that a reasonable consumer could plausibly interpret a sale advertised as lasting “thru” a particular date to mean that the sale would not continue beyond that date. Whether consumers were actually deceived remains a question for later stages of the case.

What makes the decision interesting is that the plaintiffs’ theory doesn’t focus primarily on the reference price itself. Many pricing cases challenge whether a higher “regular” or “compare at” price is genuine. Here, by contrast, the court focused on the allegedly temporary nature of the promotion. Put differently, the case is less about whether the discount was real and more about whether the expiration date was real.

We’re just watching the first few scenes of this play, and it’s too early to tell how it will turn out. For now, remember that plaintiffs across the country are focused on how retailers advertise discounts, and many lawsuits accuse retailers of creating an illusion that shoppers are getting a bargain. As for Gonzalo, Shakespeare’s clear-eyed counselor, remember what Antonio said in The Tempest, Act 2, Scene 1, Line 186.

A plaintiff purchased a dress from Abercrombie & Fitch’s website and paid a bundled $7 shipping and handling fee because her order did not qualify for free shipping. She argued that the retailer violated the Honest Pricing Law by not including the bundled fee in the price at the outset. Instead, the bundled fee was only displayed at checkout.

Abercrombie & Fitch argued that it didn’t violate the law because the fee was optional—consumers were presented with an option to pick up items in store without paying any fee. (Interestingly, the retailer didn’t argue that the fee fell under the law’s exception.) The District Court for the Northern District of California agreed that the fee wasn’t mandatory.

Since the statute doesn't define the term “mandatory,” the court looked to dictionary definitions and legislative history. The opinion noted that lawmakers repeatedly described the law as targeting “unavoidable” or “required” charges that consumers cannot reasonably avoid. Optional add-ons, by contrast, were not the focus of the legislation. 

The plaintiff alleged a separate “bait-and-switch” claim under California Civil Code § 1770(a)(9). That claim didn’t fare any better. Because the “bait-and-switch” argument was based on the same theory that Abercrombie & Fitch should have included the shipping charge in the advertised price, the court dismissed it as well.

Because the dismissal was without prejudice, giving the plaintiff an opportunity to amend, the case may not be over yet. Nevertheless, it gives an indication of how courts may differentiate fees that are mandatory from those that are optional.

In the latest episode of Privacy Perspectives, Alex Schneider is joined by Aaron Burstein and Céline Guillou to discuss the growing patchwork of state registration laws, California’s DROP deletion mechanism, and the questions businesses should be asking regarding when they are subject to data broker registration obligations. 

The conversation begins with New Jersey’s recently enacted data broker law, which moved from introduction to enactment in only two days. The law includes annual registration fees that could reach $1.5 million for some businesses, as well as a ban on the sale of sensitive data that took effect immediately. The law also bans all sales of New Jersey residents' sensitive data; this ban applies to all controllers, not just data brokers, and went into effect immediately on June 30. 

Although data broker registration is not expected to begin until spring 2027, and the law could be amended before then, companies have already begun to assess whether their activities fall within the law’s scope. 

That analysis may not be straightforward. Data broker status often depends on specific data flows rather than a company’s overall relationship with consumers. A retailer, for example, may collect information directly from its customers while also obtaining additional information from a third-party source. If the retailer later sells or licenses that enriched data, it may be engaging in activity covered by a data broker registration laws despite having a direct relationship with the consumer.

The group also discusses how these requirements may apply to advertising technology. Definitions of “sale,” “sharing,” and “direct relationship” vary across states, and regulators have not always provided clear guidance on how those terms apply to particular technologies.

California’s Delete Request and Opt-out Platform, known as DROP, adds another operational challenge. The system allows California residents to submit one deletion request that is transmitted to registered data brokers. Compliance requires businesses to identify relevant records, process requests, communicate deletions, and address data held by service providers and other recipients. Companies that do not have a detailed understanding of their data flows may find those requirements difficult to implement.

The episode also examines New Jersey’s new “data collector” category, which could require certain businesses that obtain information directly from consumers and provide it to data brokers to register with the state. This approach could bring retailers and other first-party businesses into the fold even when data brokerage is not their primary business.

The discussion concludes with practical guidance for companies assessing these laws. Businesses should review their data sources and destinations, evaluate registration requirements consistently across jurisdictions, and avoid assuming that a first-party customer relationship places every data flow outside the definition of data brokerage.

One Feed, Multiple Formats

Privacy Perspectives episodes appear on the same Ad Law Access feed hosted by Simone Roach, so if you’re already subscribed, you’ll get these automatically. If not, subscribe now on your preferred podcast platform.

We’ve got more podcast conversations and formats planned for 2026. One subscription gets you everything. Find the episode and more here.

Although several FDA-approved GLP-1 therapies are peptide-based, many popular peptides are neither FDA-approved nor included on FDA’s list of bulk drug substances that can be used in compounding (the “503A Bulks List”).  As a result, these peptides cannot be lawfully compounded under Section 503A of the Federal Food, Drug, and Cosmetic Act (FD&C Act).

Against this background, the FDA’s Pharmacy Compounding Advisory Committee (PCAC) met last week to evaluate whether seven highly sought after peptides should be recommended for inclusion on the 503A Bulks List. The uses evaluated varied significantly and include obesity, wound healing, and insomnia. The Committee recommended adding six out of seven of the peptides under review for inclusion on the 503A Bulks List, with votes as follows:

Importantly, a favorable PCAC recommendation does not immediately authorize compounding. Before any peptide is added to the 503A Bulks List, FDA must initiate a formal notice-and-comment rulemaking—a process that may take over a year to complete. And while these outcomes could significantly affect compounding pharmacies, wellness providers, manufacturers, telehealth platforms, and investors operating in the peptide space, companies who consider this development a green light to compound or market the above (and other) peptide substances face enforcement risk until FDA formally places them on the 503A Bulks list.

Further—and notwithstanding the Committee’s votes—FDA staff recommended against adding any of the peptides under review to the 503A Bulks List, repeatedly citing:

• Insufficient evidence of safety and effectiveness; 
• Insufficient or nonexistent human clinical trial data; 
• Inadequate characterization and quality information; 
• Uncertainty regarding substance identity and composition; and 
• Potential safety concerns, including immunogenicity risks.

Given that FDA staff remain skeptical of the available evidence underlying many of these peptides, and the agency is under no obligation to follow the Committee’s recommendations, it is unclear whether these substances will end up on the 503A Bulks List. For now, companies operating in the peptide space should continue to approach peptide compounding and marketing with caution, as enforcement risk persists until the evaluated substances are formally added to the 503A Bulks List. 

*Ben Winck, a Summer Associate at Kelley Drye & Warren LLP, contributed to this post.

New Jersey “Junk Fees” Enforcement Statement

New Jersey Attorney General Jennifer Davenport joined forces in June with the state’s governor in an announcement “cracking down” on junk fees. While Governor Mikie Sherrill signed an executive order for agencies to recommend junk fee legislation, AG Davenport drafted an “Enforcement Statement” and provided new educational materials on her office’s interpretation of current law. The Statement “explains how some widespread practices surrounding junk fees may violate” New Jersey’s UDAP law, the Consumer Fraud Act (CFA). The office describes “junk fees” as hidden, surprise, or excessively overpriced fees providing little to no benefit to the consumer. According to the statement, these practices harm consumers by making it difficult to compare prices and causing them to pay higher prices because businesses exclude fees from the advertised price, hide them in fine print or deceptive designs, misrepresent the nature of the fee, and charge “completely worthless” fees. The guidance does not provide additional context on how to differentiate between “worthwhile” and “worthless” fees.

The AG further cites arbitration provisions in contracts as an additional hurdle to private litigation necessitating AG involvement.  The AG explains that certain practices have already been illegal under the CFA, and the CFA is adaptable to combat new forms of fee practices, including:

• “Drip pricing” which they define as, “luring the consumer in with a low advertised price . . . and then tacking on fees later” 
• “Dark patterns” with examples including hiding pricing information in “dense fine print,” terms, pop-ups, “manipulated font sizing,” text placement, and “complex clickthroughs.” 
• Misrepresentations regarding the purpose, recipient, value, and optional nature of the fee, including a failure to disclose the existence or qualities of a fee that would be material to a purchase decision. The office highlights “focusing a buyer on a monthly payment amount without disclosing…an optional fee” if it would be material to the buyer as a potential violation of the CFA. 
• Unbundling prices where the consumer would reasonably believe the unbundled goods or services would be included or itemization is not required by law.
• Excessively high fees applying unconscionability factors under the CFA. For example, the AG says it may be unconscionable to take a significant price markup on a fee that provides little or no value to the customer.
• “Manipulated consent” such as using prechecked boxes, violating the federal E-Sign Act’s electronic consent requirements, or high-pressure sales. In this regard, the AG cited its recent Mariner Finance lawsuit as an example where company representatives allegedly quickly scrolled through contract terms on a screen in a way that made it hard for consumers to read and comprehend the terms. 

Many states likely interpret their UDAP laws in a similar manner to New Jersey even in the absence of specific guidance. 

Massachusetts and California AG Announcements on Industry-Specific Focuses

Also in June, both the Massachusetts and California AG offices made announcements on industry-specific enforcement efforts related to fee disclosure practices. Specifically, Massachusetts Attorney General Andrea Joy Campbell advised car dealerships that state motor vehicle regulations require document preparation fees and any other necessary dealership charges to be included in the total advertised price, and explained that such disclosure may require an additional Total Price label adjacent to the US “Monroney label.” The advisory further noted a failure to comply with the specific motor vehicle regulations may also violate the more general Massachusetts Unfair and Deceptive Fees regulation, which requires generally the inclusion of all mandatory fees in advertised prices. The AG advised dealers that “it is not enough …to separately list the existence or amount of a doc fee elsewhere in an advertisement, even if it is prominently disclosed.”

Separately, California Attorney General Rob Bonta announced a cross-sectional “Affordability Response Team” within his DOJ. The team is intended to “work to investigate and go after practices that are unlawfully raising costs . . .to tackle affordability from all angles” including “corporations, landlords, scammers, or policies that are driving up prices.” He described the team as addressing a complex issue that “requires creative thinking.” The specified “focus areas” of the team (with prior enforcement efforts highlighted in each category) include:

• Grocery, Gas, and Utility Costs 
• Housing and Insurance Costs
• Healthcare Costs
• Childcare, Education, and Retirement
• “The High Cost of Enjoying Life” (described as “hiking up prices for entertainment, tech, and trips”)
• Financial Protection
• Labor and Wages 
• Scams

***

AGs continue to demonstrate interest in fee transparency by bringing enforcement and issuing statements and guidance interpreting their UDAP or fee laws and increasing resources devoted to pricing or fees. However, even without issuing specific statements, AGs may be taking actions behind the scenes that mirror these interpretations. Combined with the increase in legislative activity discussed in our last installment, we expect this area to continue to be a hot topic for enforcer attention. 

The law was scheduled to become enforceable on October 4, 2026, but that has changed. On July 14, 2026, the US District Court for the Southern District of California issued a preliminary injunction in California League of Food Producers v. Bonta, preventing California Attorney General Rob Bonta and those acting in concert with him from enforcing the law while the litigation proceeds.

The lawsuit centers on two constitutional arguments. First, the plaintiffs contend that portions of the law are so unclear that companies can’t reasonably determine what the law requires, raising concerns under the Fourteenth Amendment’s Due Process Clause. Second, they argue that the law restricts truthful commercial speech in violation of the First Amendment by limiting the ability to communicate recyclability information to consumers. The court concluded that the plaintiffs were likely to succeed on both theories, which was enough to justify preliminary relief. 

The court also found problems with the law’s restrictions on recyclability claims. While California argued that the law would reduce consumer confusion and improve recycling outcomes, the court was not persuaded that the record showed the law would materially advance those objectives. Instead, the court noted evidence suggesting that manufacturers might simply remove recyclability claims altogether to avoid enforcement risk, potentially resulting in consumers receiving less information rather than more. The court further concluded that less restrictive approaches may be available to achieve the state’s goals. 

Importantly, the decision does not strike down the law. The court found that the challenged provisions may be severable from the remainder of the statute, meaning portions of the law—particularly the “60/60” framework for collection and sorting we discussed—could survive further litigation. The case will continue, and California may seek appellate review or otherwise continue defending the law on the merits. For now, however, enforcement is on hold. 

The injunction may also have implications that extend beyond labeling compliance and into California’s broader extended producer responsibility scheme. SB 54, the Plastic Pollution Prevention and Packaging Producer Responsibility Act, leans on SB 343’s definition of “recyclable” to determine which packaging materials count as recyclable for purposes of source reduction targets, recycling rate calculations, and producer fee obligations under that program. If the litigation over SB 343 results in the recyclability criteria being narrowed, enjoined on a broader basis, or ultimately struck down as unconstitutionally vague or an impermissible restriction on speech, producers and CalRecycle may be left without a stable definition of “recyclable” to anchor SB 54 compliance. That uncertainty could complicate the development of SB 54’s implementing regulations and reporting obligations, and it would not be surprising to see CalRecycle or affected producers raise similar due process or First Amendment arguments in that context down the road.

Although companies no longer face the immediate prospect of Attorney General enforcement on October 4, 2026, it would be premature to assume that the “Truth in Recycling” law will be thrown in the trash. Instead, it’s likely that it will be recycled in another form. 

Later that month, we posted about a lawsuit against Polymarket, its CEO, and its CMO over that company’s influencer campaigns. Among other things, the complaint alleges that the influencers didn’t clearly disclose their connections to the company and that some of the experiences in their posts were fabricated. That lawsuit is still ongoing.

Last week, NAD announced that it had also launched an inquiry into Polymarket’s influencer practices in March. Because the lawsuit—which focuses on similar issues as the NAD inquiry—was filed while the inquiry was ongoing, Polymarket requested that NAD administratively close the proceeding. NAD agreed to do that.

We won’t see a decision from the NAD in this case, but the inquiry serves as a reminder that NAD is actively looking at influencer campaigns to determine, among other things, whether influencers are clearly disclosing the relationships they have to the companies they promote.  

Illinois Law on “Hidden and Misleading Fees”

In addition to newly enacted laws addressing ticket reselling practices and “buy now pay later” offers, Illinois in June passed HB 228, which will become effective in January 2027. In signing the legislation, Governor JB Pritzker praised it as “put[ting] an end to deceptive junk fees” by making “it unlawful for any business to advertise, display, or offer a price for products or services that does not include all mandatory fees or surcharges before taxes.” 

Like many other fee laws, Illinois prohibits offering a price that does not include all mandatory fees. “Mandatory fees” are defined to include fees that must be paid in order to complete the purchase when such fees are not reasonably avoidable. Illinois’ definition includes a somewhat unique wrinkle also found in Minnesota’s law that further provides that a mandatory fee is one “a person would reasonably expect to be included in the purchase of the goods or services being advertised.” As with other federal and state fee laws, the total price need not include taxes or fees imposed by the government required by law to be collected from the consumer. 

Where total cost is determined by consumer selections or preferences, or total cost is related to distance or time, disclosure is compliant if the business clearly and conspicuously discloses: (1) the factors determining the total price, (2) any mandatory fees, and (3) that total cost may vary. This could be interpreted to suggest that shipping must be included in the total price if it is not variable by distance or time, unlike most other fee disclosure laws, although it remains to be seen whether the Illinois AG will take this position. 

The law provides separate specific compliance requirements for food delivery platforms, “food or beverage service establishments,” and auctions. The law is broadly applicable to all “persons,” but has a long list of other specific carveouts primarily in already regulated industries. 

New York City Proposed Rule

New York City’s Department of Consumer and Worker Protection (DCWP) announced along with its passing of the final “Click to Cancel” Rule the initiation of a Proposed Rule addressing “junk fees.” Comments to the Rule are due on or before August 7, 2026, when DCWP will hold a public hearing on the proposal. The DCWP explains in the Proposed Rule’s Statement of Basis and Purpose that consumers are surprised by a total price higher than expected through “bait and switch” tactics, including in industries such as third-party delivery, rentals, hotels, and live event tickets. This Rule is described as “industry neutral” and builds on the existing Rule in place specifically for hotels. The DCWP points to analogous existing fee laws in CA, MA, and MN as adopting similar approaches. 

Proposed requirements include: 

• The total price, including all mandatory fees, must be disclosed in a clear and conspicuous manner in all offers at least as prominently as any other pricing information. 
• “Mandatory fees” is defined as fees that are not reasonably avoidable and a reasonable person would expect to be included, excluding taxes and fees imposed by the government and actual shipping charges incurred. This mirrors the definition adopted by Illinois discussed above.
• Periodic charges must include the total price for the relevant time period and the total amount of non-recurring fees (such as one-time or sign-up fees). 
• The offeror must also clearly and conspicuously disclose the nature, purpose and amount of any fees not included in the advertised total price, and the final amount of payment at least as prominent as the total price.These disclosures must occur before the consumer consents to the transaction. 
• The offeror cannot misrepresent the nature, purpose, amount or refundability of any fees or charges or the identity of the good or service where the fee is being charged in any offer or disclosure. 
• The offeror must maintain records sufficient to establish the nature, purpose, amount, and refundability aspects of the fee – and the absence of such record is a presumption that the alleged fact is true. 

Notably, the law would establish new requirements for businesses operating exclusively in New York City as New York State does not yet have a specific fee law, although the New York AG could arguably use its UDAP authority to address similar issues.

DC Housing Amendment 

DC enacted a Fair Housing Practices Amendment on July 2, with an effective date forthcoming after the legislative review period. The law amends the prior Act to require certain notifications and a dispute process for assessment and collection of unpaid amounts after vacating a property, prohibit charging a fee for services required by the implied warranty of habitability, and prohibit a separate charge for common utility charges. The common utilities provision is effective January 2027.

***

Stay tuned for part two in our fee transparency roundup, which will cover recent developments in New Jersey, Massachusetts, and California. 

Beiersdorf, makers of competing sunscreen products, didn’t think that claim smelled right. It filed a challenge before the NAD arguing that the claim required substantiation. Beiersdorf argued that there are ASTM standards for measuring smell and hedonic scales for preference that are used for claim support. Vacation countered that the claim was puffery and didn’t require substantiation.

NAD acknowledged that smell can be measured. “But the fact that a test methodology exists to measure smell does not necessarily mean that consumers would expect a claim of ‘World’s Best-Smelling Sunscreen’ to be substantiated.” Thus, the key question in the eyes of the NAD is whether consumers would expect Vacation to have substantiation based on the context of the claim.

In most contexts in which the claim appeared—such as the product labels, retail displays, and social media posts—NAD determined that consumers would not expect substantiation. “Given the inherent subjective nature of the claim and the grossly exaggerated characterization of the product’s smell, NAD found that reasonable consumers are unlikely to take the claim, when presented by itself, seriously.”

The analysis was different on Vacation’s website, though. There, the claim appeared in quotation marks directly above a star rating, a 4.8/5.0 score, and more than 13,000 reviews. That changed the context. NAD wrote that a quote that appears above ratings may suggest that the quote is taken from the reviews or is a summary of the reviews.

“By tying the claim to the reviews in this manner, consumers may take away the message that the claim is more than puffery and relies on the reviews as substantiation for a claim of preference.” NAD therefore recommended that Vacation modify the claim in this context to avoid conveying the message that the “World’s Best-Smelling Sunscreen” is substantiated by the reviews.

Many marketers will rejoice when reading about this decision. They will likely tell their in-house legal teams that the world’s best-written legal blog has a post suggesting they can say that they are the world’s best at something without having to prove it. That’s half true, but the other half is the more important part.

It’s important to remember that the difference between a claim that is puffery and one that requires substantiation can sometimes be as subtle as a hint of coconut on the breeze on a summer afternoon.

On July 14, 2026, the Seventh Circuit affirmed and held that Section 227(c)(5) does not permit plaintiffs to sue for unwanted text messages. The Seventh Circuit reasoned that text messages would not constitute ​“calls” under the ordinary meaning of the word because text messaging did not exist when the TCPA was enacted in 1991. The Seventh Circuit acknowledged that Section 227(c)(5) likely covered more than just telephone calls as they existed in 1991 but declined to express too much ​“liberality” in interpreting terms.

The Seventh Circuit also relied on the context of provisions surrounding Section 227(c)(5), noting that use of the term ​“telephone solicitations” in other parts of the statute indicated that Congress intended a different meaning for ​“calls.” The court rejected Plaintiff’s attempt to rely on the FCC’s interpretation of the statute, finding it is no longer bound by the FCC’s guidance post-McLaughlin. The Seventh Circuit also rejected Plaintiff’s policy arguments, finding that the TCPA’s remedial nature was insufficient to overcome the plain language of the statute. It also found that cases interpreting text messages under different provisions of the TCPA and case law from other circuits were similarly unpersuasive.

Accordingly, the Seventh Circuit affirmed the district court’s ruling that text messages are not ​“calls” under 47 U.S.C. § 227(c). We will continue to monitor these developments, as this issue appears ripe for the Supreme Court to review.

Seth Steidinger, et al. v. Blackstone Medical Services, No. 25-2398 (7th Cir. July 14, 2026). 

New York City

Earlier this year, we covered the New York City Department of Consumer and Worker Protection’s (“DCWP”) proposed rule governing the cancellation of automatic renewal and continuous service subscriptions. That proposal has now been finalized and will take effect on October 1, 2026.

Followers of this blog and the FTC will recognize familiar names in Mayor Mamdani’s press release on the rule, with current DCWP Commissioner and former FTC BCP Director Sam Levine and former FTC Chair Lina Khan touting the final NYC “Click to Cancel” Rule and a newly proposed “Junk Fees” Rule. Notably, NYC already proposed and finalized a rule prohibiting a “hotel junk fees” rule earlier this year that prohibits advertising a price for a hotel without clearly and conspicuously disclosing the total price of the stay, including all mandatory fees. (Stay tuned for our coverage of the newly proposed, more broadly applicable NYC fees rule announced last week.)

Here’s a summary of the NYC “Click to Cancel” Rule:

• Scope and Definitions, Disclosure, Consent, and Notice: With a few exceptions, the rule applies broadly to most businesses that offer an “automatic renewal”—a plan in which a paid subscription or purchasing agreement is automatically renewed at the end of a definite term—or a “continuous service”—a plan that continues until the consumer cancels. Before requesting consent or billing information, businesses must present all material terms, including specific disclosures related to the nature of the product, frequency of charges, and cancellation deadline, “clearly and conspicuously” and in “visual proximity” (or “temporal proximity” for voice offers) to the consent request. Reminders are required for certain longer-term subscriptions, material changes, and free trials longer than one month at specified time intervals. These provisions mirror the New York state law. 
• Cancellation Mechanism Requirements: Like the state law, businesses must provide consumers a “simple cancellation mechanism” that is “as easy to use as” and “through all mediums by which the business allows a consumer to provide affirmative consent.” The rule also prohibits imposing “unreasonable or unlawful conditions” on cancellation. In a slight variation, if consent was obtained in person, the business must additionally offer an online cancellation option, where practical (whereas the state law allows for telephone cancellation).
• Enforcement and Remedies: What gives this rule extra teeth is that it provides the City with additional remedies, so it can go on its own to pursue violations of what was essentially a state law. It provides for restitution: a business found in violation is liable for the amount charged after the consumer’s first attempt at cancellation. Civil penalties follow an escalating schedule: $525 for a first violation or default, $1,050 for a second, and $3,500 for a third and subsequent violation. These amounts can accumulate quickly for businesses with large subscriber bases, especially as a violation of this Rule could come under separate enforcement by both the City and the State.

Louisiana

Louisiana passed its own “Click to Cancel Act,” which will take effect on January 1, 2027. As with other automatic renewal laws, the Act requires clear and conspicuous disclosure of terms in visual proximity to the request for acceptance of the offer before the purchasing agreement is fulfilled . Affirmative consent is required “to an agreement that clearly and conspicuously displays the automatic renewal terms.” The law requires an acknowledgment containing the terms. A notice of material changes is required, as is a renewal notice for annual or longer contracts or any trial period conversion, at least three days prior to the renewal/conversion.

Here are some other notable provisions:

• The Act prohibits businesses from presenting consumers with information that contradicts or undermines the ability to provide express affirmative acceptance to the automatic renewal offer. 
• The Act requires businesses to maintain “reasonable business records” demonstrating that a consumer provided consent for at least one year from the formation of the contract.
• Despite being called “Click to Cancel,” the Act does not specifically require online cancellation. It permits “a cost-effective, timely, and easy-to-use mechanism” for cancellation that is not “unreasonably burdensome or designed to deter cancellation.” The mechanism can include online, email, phone, “or another commonly used communication method.”
• The Act broadly exempts any businesses with less than 50 employees or annual gross revenue of less than $5 million (though other provisions in the statute conflict on this point).

Violations will be subject to penalty of up to $500 per violation. However, prior to initiating any enforcement action, the Louisiana Attorney General must provide a  business written notice of the alleged violation. If a business cures the violation within 30 days and provides written confirmation of that cure, the AG may not impose a penalty for that violation.

Getting Ready for Compliance

With October 1, 2026 approaching, businesses with subscribers or recurring-charge customers in New York City should assess their practices in light of the new rule. Prior to the new year, companies doing business in Louisiana should also update their renewal notice regimes and business record practices. Both new enforcement mechanisms share a lot in common with the growing patchwork of state laws, but there are various nuances within that patchwork that businesses need to pay attention to. We expect to see a lot of continued enforcement on automatic renewal issues at the federal, state, and now, local levels.

• Marketing misled consumers that the app had safety and security similar to banks, when the app did not have consistent fraud detection practices.
• Ads misrepresented FDIC insurance coverage of balances. 
• The app did not provide inbound phone support, despite being aware that this “created opportunities for fraud” through fake phone numbers. 
• A promotion encouraging users to post their username publicly generated account takeover fraud. 
• Responses to fraud were inadequate and inconsistent with the statements made on the website regarding support and protections. 
• Despite promises of quick cash access, frequent account freezes with limited customer support left consumers without the means to pay for necessities.

This is not the first time states have alleged that payment transfer services violated UDAP laws through their marketing of safety or security, or permitting fraud on the platform. For example, last year AG James sued the parent company of Zelle on a similar theory, and Texas previously settled with PayPal regarding the Venmo app’s practices.   

The Agreed Final Judgment requires Block to:

• Comply with the federal EFTA Regulation E, including by conducting investigations of notices of error and providing any provisional credits required by the regulation, without requiring the customer to take certain additional steps such as filing a police report. 
• Create a governance process for compliance including a committee reporting to the board.
• Prohibit misrepresentations regarding customer service, fraud protections, and banking (including where applicable making specific disclosures that the app is not a bank). 
• Provide education to consumers about common fraud on the platform, and create procedures designed to reduce fraud.
• Implement procedures to respond to account takeovers and establish procedures pertaining to account suspensions and deactivations.
• Appropriately staff customer service to resolve customer complaints, including live 24-hour support with “human” support available during specified hours. 
• Comply with the CFPB’s prior 2025 settlement pertaining to Block’s conduct in providing customer redress, and make a $45 million payment to the states.  

Key takeaways for all companies: 

• Make sure your customer support practices and staffing aligns with marketing promises.
• If you become aware of customer complaints regarding an issue, don’t ignore them. This could become a basis for a “failure to disclose” allegation for a known issue. 
• Don’t assume that once a federal enforcement agency acts, state AGs will back down. They may take the action into account but continue with their own independent authority and avenues for relief. 
• This settlement serves as another example that despite political differences, states are still working together on key consumer protection initiatives.

Mammoth compared the price of a Harry’s Original 8-count refill ($17) and a Harry’s Plus 8-count refill ($25) to a Gillette Fusion5 ProGlide 8-count refill ($39). Mammoth told consumers that Gillette was “straight up taking advantage of you” for “a couple pieces of metal and some plastic” and urged them to “stop getting ripped off by your razor company.”

Gillette took issue with the prices Mammoth quoted, noting that consumers could receive a one-time discount from Gillette other retailers. NAD noted that “price comparisons should reflect prices that are charged on a regular basis and for a reasonably substantial period of time.” Isolated sales prices shouldn’t be used. Accordingly, NAD found that Mammoth’s numbers were appropriate.

Gillette also objected to the suggestion that it was taking advantage of customers and ripping them off. Although NAD has often taken a strong position on disparaging claims, here NAD noted that “disparagement alone does not warrant discontinuance of a claim that is not false or misleading.” Although the language in the ads was “somewhat hyperbolic,” NAD didn’t seem to be too bothered by it. 

This decision provides helpful guidance to advertisers looking to make price comparisons. It’s important to ensure you focus on the regular prices at which products—both yours and your competitor’s—are sold for a reasonably substantial period of time. And while aggressive language can draw scrutiny, truthful claims supported by fair comparisons won’t automatically be shut down just because they’re sharp.

From Kitchen Tables to Market Structures: Examining the fundamental economics behind rising costs for families and the American dream

This panel, moderated by Rebecca Borné, Assistant Attorney General, Connecticut Attorney General’s Office was intended as a backdrop for understanding the economics of rising costs. It included an industry representative and an academic participant to discuss prices. The industry representative, general counsel for a large beef processor, explained beef pricing trends and the economic factors driving them. Ryan Nunn, Director of Research at the Budget Lab at Yale University, described short-run and long-run drivers of pricing. In the short run, he noted prices have increased from: 

• Higher energy prices due to the Iran conflict
• Higher energy costs due to AI investment (but unclear)
• Tariffs
• Financing costs from higher interest rates

In the long run, prices increased from: 

• Higher housing costs from land use restrictions and stagnant housing construction
• Higher consumer borrowing costs from rising federal debt
• Insufficiently competitive product and labor markets, and asymmetric information

Looking back further, Nunn pointed to a series of economic shocks responsible for inflation, including supply chain disruptions from Covid and the Russian invasion of Ukraine. 

Market Consolidation and America’s Pocketbook: Housing, Eggs, Broadcast Media & More

Nicole Demers, Deputy Attorney General, Connecticut Attorney General Office kicked off the panel which also included Elizabeth Odette, Assistant Attorney General, Minnesota Attorney General (and Antitrust Task Force Chair) and Christopher Teters, Assistant Attorney General, Kansas Attorney General’s Office, with a representative from the American Economic Liberties Project (AELP). 

Demers stated that when markets consolidate, consumers feel the effects including in the areas of housing, groceries, healthcare, and media. AELP posited that concentration is caused by labor exploitation and other “economic termites” such as company uniform rental markets, where bloating causes higher prices. Odette said state AGs are in a unique position to hear from consumers, and state resources have increased in several states including through the creation of additional positions, increased fines, merger notification laws, and laws keeping antitrust actions from being pulled into MDLs. Teters explained the multistate approach is especially important for states like Kansas, as it allows them to put time and effort into big cases and “help swing way above their weight class” to impact consumers. 

The panelists discussed several types of consolidation, including in the areas of housing, groceries, and media. Centralized pricing software or algorithmic pricing may exacerbate the issue of housing prices. Panelists admitted that in some cases conduct that looks illegal may not be. Teters pointed to how difficult it is to investigate and convince judges or juries of illegal conduct. He also noted how general issues with drought or the economy, and a state of crisis, breeds opportunity for anticompetitive conduct and obfuscates potential issues. AELP’s panelist claimed that in agriculture, there is a problem with the floor prices going up even after a crisis, such as with eggs, beef, Pepsi, payment companies, and fertilizer. Odette mentioned recent enforcement in Agristats, John Deere, and pesticide loyalty programs and said states are looking at a Restaurant Depot merger. Demers asked how consolidation impacts media, not just with prices and labor but also with the marketplace of ideas and information. Odette said local journalists used to report on local businesses, and consolidation could lead to a decrease in quality of news. AELP said consolidation including Google Adtech and other media companies is eroding the ability to know what is going on in society, and thinks AGs should not overlook vertical integration. He said you can point at anything and find an issue. 

Current Consumer Trends in Data-Driven Pricing

Utah Attorney General Derek Brown moderated this panel, the next in a series of similar recent panels, joined by panelists from Instacart, the National Grocers Association, and Stevie DeGroff, First Assistant Attorney General at the Colorado Attorney General’s office. 

Defining Pricing Terms

AG Brown commented that the pricing landscape shifts every couple of weeks. He understood the use of dynamic pricing, such as price changes due to war, as with individualized pricing for auto insurance. But other instances of individual pricing sparked questions. DeGroff defined the terms surveillance, personalized, dynamic, and algorithmic pricing. The term “loyalty programs” has come up with regulations many states are considering, but is not easily defined. Colorado dealt with defining bona fide loyalty programs with its existing privacy law and related regulations, summarized as a program established for genuine purchase to provide defined benefit to a consumer voluntarily participating. DeGroff said when thinking of the contours of surveillance pricing, it is important to consider whether the consumer is getting a benefit versus harm. 

Potential Pricing Harms

DeGroff outlined two main buckets of harms:

1. Data Abuse. DeGroff explained abuse could be tied to surveillance pricing because businesses collect so much data to personalize. She said an increasing amount of data is being collected seemingly unrelated to the goods and services – for example, categorizing consumers by intellectual ability, or collecting biometric data. Concerns originating with targeted advertising are now playing out with surveillance pricing where secondary uses are not disclosed to consumers. Further, data becomes the target of breaches. This all causes a lack of trust from consumers. 
2. Pricing Risks. DeGroff described headlines about airlines using search history to set a higher price, using customer desperation, or personal data including sensitive or demographic data, to set a higher price. Businesses could also target discounts, with some getting more than others. Who gets the discount and why?

Enforcement Tools

AG Brown summed it up as pricing is not just what the market will bear, but what will the consumer bear. While surveillance pricing is “creepy”, he acknowledged there are some misconceptions and discussed those with the industry participants. For example, when data is being individualized, in practice panelists said it is being used to help consumers find what they want or help target coupons or promotions that benefit both consumers and small businesses. 

AG Brown asked how to provide disclosure and transparency without suppressing innovation. DeGroff said Colorado’s bill took this question into consideration, and she expects the vetoed bill to reemerge next year. She also pointed out current laws that can address pricing issues, such as consumer privacy laws addressing deleting data, opting out of the sale of data, and opt out of targeted advertising. States can also use unfairness – for example, if there is a fake discount or the discount is not equally applied. If using demographic data, businesses could run afoul of antidiscrimination laws. Finally, states also have laws addressing that the price on the shelf has to be the price at checkout. 

Disclosures and Innovation

DeGroff said it is useful to think of a ground truth for consumers, and what harm to prevent. More sensitive data could lead to more harms, and appropriate controls could be used for data. Should controls be for setting a higher price? Selectively giving discounts? Or set depending on the industry? Where might consumers have more expectation of fairness and ensuring no opportunity for misuse? AG Brown agreed that with discount programs there should be protections, but cautioned on “squishing” innovation including potentially coupons. DeGroff agreed but said a wholesale carve-out for loyalty programs could be harmful with potential misuse. 

AG Brown asked about disclosures like the New York law requirement. He questioned whether awareness is good enough – knowing someone is watching and collecting. Panelists responded that it is difficult to have meaningful disclosure, including issues with disclosure fatigue and potential for over disclosure to create antitrust concerns. DeGroff agreed antitrust is a great tool for the price setting world, but price tags are in the stores due to a moral imperative to charge customers the same price and treating customers fairly. 

DeGroff proposed rather than meaningful disclosure, control of data such as deletion rights might be more meaningful. Further, the role of data brokers may be different than if a brand or business a customer expects is getting data. She mentioned California’s upcoming data broker law that requires deletion of that data. She also suggested opting out of secondary use of data would be helpful. Finally, a true price, the same as what everyone is seeing, to start at the same place can mitigate potential harms.  She does not want customers to be siloed when it comes to pricing. 

Conclusion

Expect state AGs to continue to debate: 

• The right balance between free markets and consumer protection.
• The interplay between disclosure, innovation, consumer protection, and antitrust. 
• The appropriateness of tools such as antitrust laws, UDAP, privacy, and others to address alleged harms versus more specific regulation. 

The fact patterns in these letters are similar to ones we’ve seen before. The companies made various types of “Made in USA” claims—including claims in hashtags, like #madeinUSA—but the letters state that FTC staff has reviewed information which suggests the companies may be importing the products, in whole or significant part.

The letters go on to state that unless companies can adequately substantiate that “all or virtually all” of a product was made in the USA, their claims may violate the law and result in an enforcement action in which the FTC seeks redress for injured consumers and/or the imposition of civil penalties of up to $53,088 per violation.

Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, promised to “hold accountable any company that undermines Americans’ trust with misleading or outright false U.S. origin claims.” If you haven’t evaluated whether you can substantiate your “Made in the USA” claims recently, now may be a good time to do that.

Maine’s Consumer Protection Landscape

Unlike the forty-three states that elect their AG by popular vote, the Maine Attorney General is selected by its legislature every two years. The Consumer Protection Division in the AG’s Office operates under the Unfair Trade Practices Act (UTPA), which is modeled after the Federal Trade Commission (FTC) Act. Maine courts are guided by FTC and federal court interpretations of the FTC Act. 

Consumer complaints are a central driver of enforcement. The office receives regular reports on complaint trends, and scam activity consistently ranks among the top concerns, along with home improvement disputes. Maine pairs enforcement with a consumer mediation program, where staff and volunteer mediators help resolve disputes between consumers and businesses. 

From an enforcement standpoint, the UTPA provides pre-suit investigative authority, including through civil investigative demands, which are considered confidential. The law requires the office to provide 10 days’ notice before filing suit. The state is not subject to statutes of limitations under the common-law nullum tempus doctrine. The office prioritizes injunctive relief to stop harmful conduct, while also seeking restitution, disgorgement, and civil penalties of up to $10,000 per intentional violation. The office also participates in multistate investigations, allowing it to leverage resources, draw on expertise from AG offices in other states, and address conduct that extends beyond Maine’s borders.

Recent legislative developments related to consumer protection emphasize a focus on emerging risks, including:

• A cryptocurrency kiosk law imposing licensing, disclosure, and liability requirements to combat fraud
• New protections allowing financial institutions, under certain circumstances, to delay suspicious transactions involving older or vulnerable adults
• An opt-in privacy law for internet service providers, even in the absence of a broader, comprehensive privacy law

Ballot Power: Citizen Initiatives and Regulatory Change

Maine’s Constitution allows citizens to initiate legislation directly, making ballot initiatives a significant force in consumer protection law. After filing an initiative with the Secretary of State, proponents have 18 months to gather signatures equal to 10% of the last gubernatorial vote, or roughly 68,000 signatures currently.

Once qualified, the legislature may pass the proposal, reject it and send it to voters, or offer a competing measure. Even after passage, initiatives often require legislative refinement and may prompt litigation, underscoring the challenge of transposing complex policy into a yes-or-no ballot question.

Recent years have seen increased use of this process across issues from economic regulation to social policy, demonstrating its growing role in Maine’s regulatory environment.

For example, Maine’s automotive right-to-repair law, approved by voters in 2023 with overwhelming support, illustrates both the power and complexity of citizen initiatives. The law seeks to ensure that vehicle owners and independent repair shops have access to electronic vehicle data, including wireless telematics through either an interoperable platform or app.

Private Equity and Consumer Protection

Like other states, Maine is focusing on the intersection of private equity and consumer protection, where profit-driven investment strategies may be viewed as conflicting with consumer interests such as affordability, access, and quality.

Two areas have drawn particular attention for Maine:

• Healthcare transactions: Maine recently enacted a law requiring 180 days’ advance notice and regulatory review when private equity or similar entities seek to acquire or control healthcare providers. This indicates a broader concern about maintaining access to services in a state where hospitals are predominantly nonprofit. 
• Mobile home parks: Private equity acquisitions have prompted legislative responses, including:
  • Mobile home owners or their association have a first option to purchase the mobile home community in the event the owner sells the property  
  • Notice and mediation requirements for rent increases
  • Transfer fees on the purchase of a community by certain large purchasers, to fund programs supporting resident ownership

These measures demonstrate an effort to balance investment activity with consumer protection, particularly in markets affecting at-risk populations.

***

Maine’s consumer protection regime is unique in that it is not only shaped by the attorney general’s office and market forces, but also directly by voters. For businesses, this means staying attuned not only to enforcement trends but also to legislative developments driven by forces outside the traditional policymaking process. 

Summer Associate Bariela Capollari contributed to this post.

Sessions included The Deadly Deception of Counterfeit Drugs; Building Public-Private Partnerships to Protect Public Health and Safety; Mental Health Matters: Equipping Leaders to Make a Difference; Addressing the Rise of Illicit Substances and Related Criminal Markets; The Evolving Debate Over Prediction Platforms; Navigating a New Era in College Sports; and Financial Fraud in Focus.

We elaborate on some key sessions from the meeting below. 

Opening Remarks: AGA Chair AG Raúl Torrez

New Mexico Attorney General Raúl Torrez set the tone for the conference with a call for bipartisan collaboration and good faith debate. AG Torrez emphasized that regardless of party or state size, AGs are in the “get stuff done business,” and that collaborative policy statements and court actions are intended to shape national policy. He framed AGs as public servants who can model constructive governance for other institutions and urged continued coordination on issues ranging from algorithmic pricing to children’s online safety. AG Torrez was then joined by Jim Steyer, CEO of Common Sense Media, to discuss this year’s Chair’s Initiative on Protecting Children from Online Exploitation and Human Trafficking.

A New Pricing Playbook: Driving Innovation, Balancing Transparency, and Serving Consumers

Connecticut AG William Tong moderated a panel on modern pricing, featuring multiple industry representatives and the National Retail Federation (NRF).

AG Tong framed the issue from the consumer perspective: consumers expect a clearly stated price, no hidden fees, and the ability to comparison shop. According to AG Tong, the challenge arises as pricing increasingly involves algorithms, machine learning, and consumer behavioral data. Overall, AG Tong focused on:

• Putting customers on notice through disclosures, even if imperfect;
• Ensuring data-driven pricing actually advantages consumers; and
• Ensuring data does not distort supply and demand and that prices are not increased based on a consumers’ ability to pay or necessity.

Key points from the discussion included:

• A company representative noted that they are tracking 75 pricing-related bills; most have not advanced, but Connecticut passed a law and New York has a bill awaiting the governor’s signature. The representative emphasized that “algorithm” can mean a basic formula—like a chocolate chip cookie recipe—and that surveillance pricing raising concerns about race or health data is a fundamentally different question.

• NRF pushed back on the “surveillance pricing” framing as a “bogeyman,” stating there is no evidence its members are fluctuating prices real time in stores because doing so would erode customer trust. NRF noted Connecticut’s law takes a more balanced approach: disclosure is required only if a price is increased based on individual data, not decreased.

• NRF cautioned that mandatory disclosure of all pricing inputs could create a “black box” that confuses consumers and be collusive. An industry representative similarly warned that requiring companies to divulge how every price is derived could facilitate collusion and disadvantage smaller companies. AG Tong pushed back: “Who better to bear the risk—the retailer or the consumer?”

• Affordability, loss leaders, loyalty programs, and discounts were discussed as areas where data legitimately advantages consumers, and where overbroad regulation could chill competitive behavior.

For more information on pricing legislation, including surveillance pricing, see our webinars on the topics here and blog posts here.

The GC & The AG: Building Relationships Before the Crisis

Arkansas AG Tim Griffin moderated a conversation with general counsel from a grocery store chain and ride share app. The overall message was businesses that build relationships with AG offices before there is a problem are the ones that navigate enforcement most successfully.

Key points from the panel included: 

• The grocery store representative noted that AG offices are increasingly active on M&A, organized retail crime, surveillance pricing, and grocery affordability—and that companies must understand these priorities and engage early. They explained that their company proactively educated AG offices on grocery pricing economics (roughly 2% margins).

• The ride share company representative emphasized shared interests with AGs—clear rules, safe communities, information sharing—and highlighted partnerships on human trafficking (drivers recognizing signs), and relationship building through staff-level continuity.

• AG Griffin noted that “99% of engagement should be relationship building.” According to him, if you call a GC only when there’s a problem, you’ve already lost.

• Practical advice included that companies should engage at staff level (because staff outlast elected AGs), and finding organic partnership opportunities (ORC, human trafficking, drug takeback, gift card fraud, food pricing).

Data Privacy Enforcement: The Patchwork Is Real (But Not What You Think)

Moderated by Sharon Merriweather of the Maryland AG’s Office, this panel featured Delaware’s John Eakins and Andrew Kingman from Mariner Strategies and was one of the most substantive sessions of the conference for companies navigating state privacy compliance.

The panelists first overviewed the state of play for data privacy in the states, including that: 

• Vermont just signed the 23rd state comprehensive data privacy law. Twenty state laws are currently effective. Core definitions, consumer rights (access, delete, correct, opt out of sale/targeted advertising), sensitive data consent requirements, and the controller/processor framework are largely consistent—about 85% the same across the state laws.

• No state has a private right of action. AGs are the primary enforcers. Cure periods have expired. Bipartisan coalitions are actively enforcing.

• Delaware’s just-passed amendments (awaiting governor’s signature) include: explicit treatment of inferences as sensitive data even after collection, location data tied to sensitive locations (like abortion clinics) treated as sensitive, contracting and due diligence requirements for third-party disclosures, and a new impact assessment requirement for automated decision-making with discriminatory impacts.

The panelists then discussed enforcement trends and practical signals from the panel, including:

• States have moved beyond reviewing privacy notices to examining actual data use and senior leadership involvement. Mr. Eakins said, “We ask for board minutes. Make sure your bosses know—when the states are looking, they want to know what management is doing.”

• Multistate coordination is accelerating. A consortium of state privacy regulators plus the California Privacy Protection Agency (CPPA) has an MOU enabling information sharing. Delaware’s calendar is “80–90% multistate meetings.”

• States report 99% cooperation from investigation targets. Companies with mature programs—those that can quickly explain what data they collect, how they use it, and who makes decisions—fare significantly better.

• Expect settlements in both data security and privacy practices—under state privacy laws and UDAP statutes (including in states without comprehensive privacy laws).

• Kingman emphasized that businesses want consistency and clarity, value consumer trust, and appreciate AG guidance on unique state standards.

***

In all, the 2026 AGA Annual Meeting reinforced several themes that companies should keep in mind going forward: 

1. Multistate coordination is the norm, not the exception, and AGs are working together on privacy, pricing, AI, child safety, and financial fraud.

2. Companies that engage proactively—before enforcement—are the ones that navigate issues most successfully.

3. AI is simultaneously an enforcement target and an enforcement tool. AGs are using AI internally and regulating it externally.

4. Privacy enforcement is accelerating and board-level engagement with data practices is no longer optional according to state AGs.

5. The pricing debate is moving from theory to law. Companies using algorithmic pricing need a defensible story.

We will continue to monitor developments from the AGA and state AG enforcement trends. 

Narrow Duty with Broad Consequences

The Amazon settlement relates to Section 609(e) of the FCRA, 15 U.S.C. § 1681g(e), which requires a business that has potentially transacted with someone who fraudulently used a consumer’s identity to provide the identity-theft victim with the application and business transaction records of the fraudulent transaction. The statute permits a business to require proof of identity and proof of the identity-theft claim, and it allows a business to refuse the request only in narrowly defined circumstances.

According to the complaint, Amazon routinely declined to furnish identity-theft records, citing “security” or “privacy” grounds that the statute does not recognize as valid bases for refusal. The complaint alleges that consumers were forced to navigate a “Kafkaesque” loop to obtain records they were entitled to under Section 609(e): in some instances, customer service agents allegedly would not release records about a fraudulent account unless the victim could first name the identity thief—information available only in the very records being withheld. One victim reportedly guessed more than 30 names before giving up. The FTC also alleged that Amazon refused records to authorized law enforcement absent a subpoena and missed the FCRA’s 30-day deadline in numerous instances.

Compliance Lessons

What makes this settlement instructive is that Amazon’s alleged day-to-day practices, which included identity-verification scripts, escalation protocols, and well-intentioned “fraud prevention” efforts, did not meet the letter of the FCRA. Even after the FTC identified the issue to Amazon’s counsel in 2023, the FTC contends that the company did not implement a required written policy until 2025, after learning it was under investigation.

The parties’ resolution underscores the stakes. Amazon agreed to a $2.25 million civil penalty, detailed injunctive relief, multi-year website-notice requirements, affirmative outreach to “Eligible Identity Theft Victims,” and a decade of compliance reporting and recordkeeping. The order sunsets in 10 years.

Sophisticated Guidance Matters

The Amazon settlement illustrates that even well-intentioned compliance efforts can falter when they fail to account for the FCRA’s highly specific requirements. The statute imposes precise obligations, measured in days, triggered by specific requests, and subject to carefully delineated exceptions. These obligations intersect with other regulatory regimes, such as the Gramm-Leach-Bliley Act and state law.

Businesses that touch consumer data, payments, fraud response, or identity verification need experienced counsel who understand both the letter of the FCRA and how the Commission develops and resolves these cases.

Here’s an overview of some of the key allegations in the complaint:

• Undisclosed Paid Endorsements: The defendants paid influencers to post about the Polymarket platform without disclosing their material connection to the company. For example, the CMO reportedly used a personal PayPal account to send at least $350,000 to influencers between January 2025 and February 2026. The defendants also allegedly wrote posts for some influencers and sometimes asked them to promote specific bets.
• Fake Betting Videos on Simulated Platforms: The defendants paid influencers to produce videos showing themselves placing fake bets on a simulated version of the Polymarket platform. The videos created the impression that it was easy to make money on the platform. The defendants exerted substantial control over the videos, providing guidance on format and content, reviewing finished videos, and sometimes requiring reshoots. In some cases, the defendants reportedly prohibited influencers from disclosing they were being paid.
• “Clipping” Scheme to Make Ads Go Viral: The defendants employed a “clipping” scheme to make their influencer advertising go viral. For example, the defendants recruited individuals to create short clips from influencer content and disseminate them on social media using fake accounts, paying clippers $1 per 1,000 views. The defendants instructed clippers to make content “feel natural and native to the platform,” explicitly directing them: “Do NOT make the videos feel like ads or promotions.”
• Targeting College Students: The defendants aggressively targeted college-aged consumers through on-campus marketing. They collaborated with an agency to find college students who were paid $500–$2,000 per campaign to promote Polymarket to their peers. The defendants offered to pay fraternities directly for signing up users at $15 per user, offered $150 payments for access to chapter meetings to present about the platform, and provided branded merchandise and party sponsorships. 

NACA alleges that Polymarket’s conduct violates Washington, DC’s Consumer Protection Procedures Act. Among other things, it asks the court to award equitable relief, including equitable restitution, disgorgement of profits, and a permanent injunction against the defendants’ use of the practices described in the complaint. 

We only have one side of the story and it’s too early to tell how this case will turn out, but this case—like the lawsuit against Gymshark that we posted about earlier this month—demonstrates the importance of ensuring that influencer campaigns comply with the FTC’s Endorsement Guides. The FTC may have temporarily stepped away from the table, but plaintiffs’ lawyers and consumer groups are doubling down.