“Trust but verify” is an old Russian proverb that former president Ronald Reagan used in arms negotiations with his Soviet counterpart Mikhail Gorbachev. Earlier this week, the FTC alleged TRUSTe, an entity that offers certified privacy seals for companies to display on their websites, had failed to verify that companies had the right to display the TRUSTe seal.
In Count I of its complaint, the FTC alleged that although TRUSTe stated on its own website that websites certified by TRUSTe must undergo annual recertification to verify ongoing compliance with TRUSTe’s requirements. TRUSTe did not conduct recertification for more than 1,000 websites between 2006 and 2013. This meant that those websites represented to customers that they were TRUSTe certified with best privacy practices, when in fact they had not undergone recertification and could have slacked in their privacy policies. The FTC alleged that TRUSTe’s conduct constituted a deceptive act or practice.
Count II of the complaint dealt with TRUSTe’s representation that it is a non-profit organization, which, according to the Commission, although true when TRUSTe was formed in 1997, was not true beginning in 2008, when it became a for-profit company. Importantly, TRUSTe provided its certified sites with language to use in their privacy policies that stated that TRUSTe was an independent, non-profit organization. Despite the change in its status, TRUSTe continued to recertify sites as compliant that continued to describe TRUSTe as a non-profit in their privacy policies. The FTC challenged this as providing the “means and instrumentalities” to its clients to deceive consumers.
Traditionally, the FTC used means and instrumentalities in situations where a manufacturer provides a retailer or marketer with a false advertisement that the retailer or marketer then disseminates. The FTC has been increasingly aggressive in using means and instrumentalities to skirt a hole in its jurisdiction – it lacks aiding and abetting authority. Indeed, Commissioner Ohlhausen dissented from the means and instrumentalities count finding it an “aiding and abetting” claim falsely advertised as a means and instrumentalities claim and noting that the FTC lacked aiding and abetting authority.
The proposed settlement in the case prohibits a broad range of misrepresentations about TRUSTe’s certification (and recertification) practices, corporate status, and independence. The order also imposes $200,000 in disgorgement and additional reporting requirements regarding TRUSTe’s COPPA safe harbor, which the FTC approved in 2001.
Interestingly, the Commission obtained redress through an administrative order, not a court order, which it usually (but not always) uses when obtaining disgorgement.
The settlement signals to other companies that if they wish to provide certifications, they had better ensure that they are following through and enforcing their requirements. The FTC has previously gone after companies who used phony “green” seals and “Made in USA” seals, and FTC scrutiny on seals and certifications is likely to continue.