Skip to content

Menu

LexBlog, Inc. logo
NetworkSub-MenuBrowse by SubjectBrowse by PublisherJoin the NetworkGet StartedSubscribeSupportContact
Search
Close

Check Out Before Checkout: The FTC’s Settlement with Doxo and Payment Flow Risk

By Roma Patel on August 20, 2026
Email this postTweet this postLike this postShare this post on LinkedIn

On August 17, 2026, the Federal Trade Commission (FTC) announced a $2.1 million settlement with online bill-payment company Doxo over allegations that the company, and its two co-founders, deceived consumers through search ads, fees, and subscription practices. The case shows that consumer protection risk can begin at the first click, especially when ads or landing pages make a third-party service look like an official payment channel.

The FTC alleged that Doxo used search ads and other advertising to make consumers believe they were paying utilities, car loans, and other bills through their billers’ official channels. The FTC also alleged that Doxo landing pages often displayed biller names and sometimes logos, even though Doxo had no relationship with the many companies it claimed were in its payment network.

The proposed settlement order starts with the core problem: Doxo allegedly made its payment pages look more official than they were. The order prohibits Doxo from suggesting that a customer paying through a Doxo-controlled site is paying the biller directly or using a service authorized by the biller. It also restricts Doxo from using biller website addresses, names, and logos in search ads, URLs, webpages, and other payment-related advertising in ways that falsely imply sponsorship or approval.

That focus reflects a broader point about consumer perception. A disclaimer may not cure an overall impression created by the rest of the page. If a landing page uses a biller’s name in the headline, places a familiar logo near the payment button, or shows a display URL that looks official, consumers may reasonably think they are dealing with the biller itself. The FTC’s position is that companies need to evaluate the full context, not isolate each word or design choice.

The order also addresses how Doxo presented fees. The FTC alleged that Doxo charged “delivery fees” without clear disclosure and did not adequately explain that those fees were waived only for certain payment methods. Under the order, Doxo cannot misrepresent what consumers will pay, why a fee applies, its total cost, or important limits and conditions. Essentially, fees that matter to the purchase decision need to appear before the consumer enters payment information or commits to the transaction.

The subscription allegations also raise a related issue: consent. The FTC alleged that Doxo enrolled consumers in a recurring subscription program without clearly disclosing the subscription price. Recurring subscriptions often involve a “negative option” feature, where the consumer’s silence or failure to cancel is treated as acceptance. For those features, the order requires Doxo to disclose the key terms before collecting billing information, obtain express informed consent before charging consumers, and provide cancellation methods that are easy to find and use.

The settlement is a reminder that compliance review should follow the customer’s experience from the first search result through cancellation. The question is not only whether each disclosure is technically present, but what the overall flow communicates. If a payment page uses another company’s name, offers a fee waiver, or includes a recurring charge, those terms should be clear before the customer pays. Companies should also be able to show that customers affirmatively agreed to the terms and can cancel without unnecessary steps or confusion. Overall, the checkout flow should make the relationship, cost, and commitment clear before the consumer clicks to pay.

Photo of Roma Patel Roma Patel

Roma Patel focuses her practice on a broad range of data privacy and cybersecurity matters. She handles comprehensive responses to cybersecurity incidents, including business email compromises, network intrusions, inadvertent disclosures and ransomware attacks. In response to privacy and cybersecurity incidents, Roma guides clients…

Roma Patel focuses her practice on a broad range of data privacy and cybersecurity matters. She handles comprehensive responses to cybersecurity incidents, including business email compromises, network intrusions, inadvertent disclosures and ransomware attacks. In response to privacy and cybersecurity incidents, Roma guides clients through initial response, forensic investigation, and regulatory obligations in a manner that balances legal risks and business or organizational needs. Read her full rc.com bio here.

Read more about Roma PatelEmail
Show more Show less
  • Posted in:
    Administrative and Regulatory, Business and Commercial
  • Blog:
    Data Privacy + Cybersecurity Insider
  • Organization:
    Robinson & Cole LLP
  • Article: View Original Source

Call us at 1-800-913-0988 or email sales@lexblog.com.

Facebook LinkedIn Twitter RSS
The Library at LexBlog
  • About LexBlog
  • The Field We Built
  • Library at LexBlog
  • Our Beliefs
  • Our Team
  • Contact LexBlog
  • Disclaimer
  • Editorial Policy
  • Terms of Service
  • Get Started
  • Publishing Solutions
  • Compass
  • Submit a Request
  • Support Center
  • System Status
Copyright © 2026, LexBlog, Inc. All Rights Reserved.
Law blog design & platform by LexBlog LexBlog Logo