The FTC and Federal Security Rules

Lesson 01 laid out the map: sector laws, state laws, the Constitution for government, and the FTC Act covering whatever is left (The Terms and the Map). This lesson is about that last layer and the federal security rules that sit beside it. The business compliance version of several of these rules is in course 73's Federal Laws That Reach Your Business; here the focus is how the law works and who enforces it.

Section 5: one sentence doing a lot of work

The FTC Act was first written about competition. The operative consumer protection words today are in Section 5(a)(1): "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." Nothing in that sentence mentions privacy, data or security. The FTC built a privacy practice out of it anyway, using its two halves.

Deception is the simpler theory. If a company says it does not sell your data, or that it encrypts your files, or that you can delete your account, and that is false, the statement is deceptive. Privacy policies, app store descriptions, consent screens and even customer service scripts count. Many early FTC privacy cases were deception cases built on a company's own written promises.

Unfairness reaches conduct a company never promised anything about. Congress defined it in Section 5(n): a practice is unfair only if it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition." Public policy can support the analysis but cannot be the main basis. Poor data security, selling precise location data that reveals clinic visits, and deploying facial recognition that falsely flags shoppers have all been charged as unfair.

Section 5 has limits that matter for readers trying to figure out who regulates what. Under Section 5(a)(2), the FTC's power does not extend to banks, savings and loan institutions, federal credit unions, common carriers subject to the federal acts regulating commerce, air carriers, or businesses to the extent they are subject to the Packers and Stockyards Act. Those have their own regulators. And the FTC Act gives individuals no right to sue. Only the Commission enforces it.

How a case actually runs

Most FTC privacy matters end in a consent order. The company does not admit the charges but agrees to specific terms: stop the practice, delete certain data, build a privacy or security program, get independent assessments every two years, and report to the FTC. Orders commonly run 20 years. The 2019 Facebook order and the 2026 General Motors order are both 20-year orders. The order is where the teeth are. Once it is in place, every later violation of its terms can carry a civil penalty under Section 5(l), and the statutory $10,000 cap has been raised by inflation adjustments to $53,088 per violation under 16 CFR 1.98 (adjusted January 17, 2025). Each day of a continuing violation counts separately.

The same per-violation amount applies under Section 5(m) when a company knowingly violates an FTC rule, which is why the FTC's specific rules (COPPA, the Safeguards Rule, the Health Breach Notification Rule, the Telemarketing Sales Rule) matter so much more than their length suggests. A first-time COPPA violation can draw a penalty. A first-time Section 5 privacy violation, with no rule involved, usually cannot. COPPA is covered in lesson 05, the Safeguards Rule in lesson 04, and the Health Breach Notification Rule in lesson 03.

Three court decisions that shaped the FTC's reach

FTC v. Wyndham Worldwide (3d Cir. 2015). Hackers got into Wyndham hotel systems three times in 2008 and 2009 and took payment card data for more than 619,000 consumers, with at least $10.6 million in fraud losses alleged. Wyndham argued that the FTC had no authority to police cybersecurity under unfairness and that it had no fair notice of what the FTC expected. The Third Circuit rejected both arguments on August 24, 2015, holding that unfairness covers inadequate security and that Wyndham had fair notice its practices could fall short. Wyndham is the case every FTC data security complaint now leans on.

LabMD v. FTC (11th Cir. 2018). After finding LabMD's data security unreasonable, the FTC ordered the company, a medical testing laboratory, to build a reasonably designed security program. On June 6, 2018 the Eleventh Circuit assumed, without deciding, that negligent security could be unfair, but vacated the order because it contained no specific prohibitions. Requiring a program that meets "an indeterminable standard of reasonableness," the court said, gives a judge no way to decide compliance and would make the court the company's manager. After LabMD, FTC data security orders became far more specific: named controls such as multi-factor authentication, encryption, access limits, data inventories, retention schedules and vendor oversight.

AMG Capital Management v. FTC (2021). For decades the FTC used Section 13(b), which lets it seek a "permanent injunction" in court, to win restitution and disgorgement. On April 22, 2021 a unanimous Supreme Court, in an opinion by Justice Breyer, held that 13(b) authorizes forward-looking relief only. The FTC can still get money by running its administrative process and then suing under Section 19, or by seeking civil penalties where a rule or order is violated. In April 2026 testimony to the Senate Commerce Committee, the Commission again asked Congress to restore its ability to return money to consumers. Congress has not done so as of October 2026.

The biggest privacy penalty: Facebook, 2019

The $5 billion penalty announced July 24, 2019 shows how the order system works. Facebook was already under a 2012 FTC order. The FTC alleged it violated that order by letting third-party apps collect data on users' friends despite stricter privacy settings, by misrepresenting control over facial recognition, and separately by using phone numbers collected for security to target ads. The FTC called the penalty about 20 times larger than any privacy or data security penalty imposed anywhere before. The new 20-year order created an independent board privacy committee, required personal quarterly compliance certifications from the chief executive and designated compliance officers, required privacy reviews of new products, and required Facebook to document incidents affecting 500 or more users and report them to the FTC within 30 days.

Recent FTC privacy cases

The FTC's caseload since 2022 has concentrated on location data, sensitive inferences, and new kinds of data collection. The cases below were checked on the FTC's own pages.

Case	Key dates	What the FTC alleged	What the order does
FTC v. Kochava (Idaho-based data broker)	Sued Aug. 29, 2022 in federal court in Idaho; settlement announced May 4, 2026; stipulated order filed June 26, 2026	Sold precise location data from mobile devices that could reveal visits to clinics, places of worship and other sensitive places	Bans selling or sharing sensitive location data without affirmative express consent and a consumer-requested service; sensitive location program; supplier checks; retention schedule. No money mentioned
Rite Aid (facial recognition)	Dec. 19, 2023	From 2012 to 2020, store systems falsely flagged customers as shoplifters, with more false matches in plurality Black and Asian communities; also failures under a 2010 data security order	Five-year ban on facial recognition for surveillance; delete images and any algorithms or products built from them
Gravy Analytics and Venntel	Proposed Dec. 3, 2024; final Jan. 14, 2025	Sold location data that tracked people to sensitive sites	Bans selling sensitive location data
Mobilewalla	Proposed Dec. 3, 2024; final Jan. 14, 2025	Collected data from ad auctions, including bids it lost, paired over 500 million ad IDs with location, built audience segments from pregnancy center and protest attendance	Bans using or selling sensitive location data; limits ad auction data to bidding; deletion and consent verification
General Motors and OnStar	Proposed Jan. 16, 2025; final Jan. 14, 2026 (2 to 0 vote)	Enrolled drivers in OnStar Smart Driver through a misleading process and sold precise location and driving behavior data without consent	Five-year ban on sharing that data with consumer reporting agencies; affirmative express consent for connected vehicle data; access, deletion and opt-out rights; 20-year order

Two other 2026 matters on the FTC's press page show where the agency is now: an action against Match and OkCupid in March 2026 for sharing personal data with a third party contrary to what users were told, and a joint action with states against Hims and Hers in July 2026 over privacy practices. The FTC also told Congress in April 2026 that it has brought approximately 90 data security cases and settled more than 100 privacy cases.

Algorithmic disgorgement

When a company trains a model on data it should not have had, deleting the data alone leaves the benefit in place. The FTC's answer has been orders requiring deletion of the models and algorithms too. The FTC's own summary of its 2021 to 2025 technology work lists model or algorithm deletion orders against Avast, Amazon (Alexa), Kurbo and WW (Weight Watchers), Ring and Edmodo, and the Rite Aid order requires deletion of algorithms built from the facial images. The remedy depends on a settlement or a court order; no statute names it.

The SEC: disclosure, not privacy

The Securities and Exchange Commission's job is protecting investors, and since 2023 it treats a serious cyberattack as information investors are owed. The rules adopted on July 26, 2023 have two parts.

• Form 8-K Item 1.05: a public company must disclose a material cybersecurity incident, generally within four business days after it determines the incident is material. The clock runs from the materiality decision, and the company must make that decision without unreasonable delay after discovery. Disclosure can be delayed only if the U.S. Attorney General finds that immediate disclosure would pose a substantial risk to national security or public safety and notifies the SEC in writing. Foreign private issuers report on Form 6-K.
• Regulation S-K Item 106: each annual report on Form 10-K must describe the company's processes for assessing and managing cyber risk, the board's oversight, and management's role and expertise. Foreign private issuers use Form 20-F.

The annual disclosures applied to fiscal years ending on or after December 15, 2023. Form 8-K reporting began December 18, 2023, and smaller reporting companies had until June 15, 2024. The SEC also amended Regulation S-P, its customer privacy rule for brokers, investment advisers and similar firms, in 2024; that rule's breach notice duties are covered in lesson 04.

The SEC's most aggressive cyber case ended quietly. On October 30, 2023 it sued SolarWinds and its chief information security officer in the Southern District of New York over the company's cybersecurity disclosures. On November 20, 2025 the SEC and the defendants filed a joint stipulation dismissing the case with prejudice, and the litigation release says only that the Commission acted "in the exercise of its discretion" and that the decision does not necessarily reflect its position in any other case.

CIRCIA: the reporting law still waiting for its rule

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 told CISA to write a rule requiring covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of paying. The statute sets those windows. Everything else (who is covered, what counts as a covered incident, what goes in a report) is left to the rule.

CISA published its proposed rule on April 4, 2024. CISA estimated it would reach more than 300,000 entities across 16 sectors, which drew heavy comment that the proposal was too broad and duplicated other reporting rules. CISA missed the statutory deadline of October 2025, set a May 2026 target, held town halls in June 2026 after a lapse in DHS appropriations postponed them, and then told the 2026 regulatory agenda it expected a final rule in September 2026, according to a July 2026 law firm summary. The White House regulatory office logged receipt of the final rule on October 1, 2026, and as of mid-October it had not been published. Until a final rule takes effect, CISA's CIRCIA page says reporting is voluntary. Check the Federal Register before relying on this status, since publication could come any week.

Foreign adversaries: PADFA, the DOJ data rule and TikTok

Three measures from 2024 and 2025 treat Americans' data as a national security issue.

PADFA. The Protecting Americans' Data from Foreign Adversaries Act of 2024, codified at 15 U.S.C. 9901, makes it unlawful for a data broker to sell, license, rent, trade, transfer, release or disclose personally identifiable sensitive data of U.S. individuals to a foreign adversary country or an entity it controls. The countries are the four named in 10 U.S.C. 4872: North Korea, China, Russia and Iran. A data broker here means an entity that sells data it did not collect directly from the people involved; service providers, news reporting, and companies passing data at the person's own request are excluded. The law took effect 60 days after its April 24, 2024 enactment. A violation counts as a violation of an FTC rule, so the FTC can seek civil penalties on the first offense. The FTC told Congress in April 2026 that it had sent warning letters to 13 data brokers in February 2026; it reported no PADFA enforcement case.

The DOJ bulk data rule. Executive Order 14117 (2024) led the Justice Department's National Security Division to write 28 CFR Part 202, published January 8, 2025 and effective April 8, 2025. It reaches more than data brokers. It prohibits data brokerage with "countries of concern" (China including Hong Kong and Macau, Cuba, Iran, North Korea, Russia and Venezuela) and covered persons, and restricts vendor, employment and investment agreements that would give them access to bulk sensitive data, unless CISA security requirements are met. Bulk thresholds are counted over 12 months: human genomic data on more than 100 U.S. persons, biometric identifiers or other omic data on more than 1,000, precise geolocation on more than 1,000 devices, health or financial data on more than 10,000, and covered personal identifiers on more than 100,000. Government-related data, such as location data at listed sensitive government sites, is covered at any volume.

TikTok. The Protecting Americans from Foreign Adversary Controlled Applications Act made it unlawful, starting January 19, 2025, for U.S. companies to distribute or update TikTok unless its U.S. operations were divested from Chinese control. In TikTok v. Garland, decided per curiam on January 17, 2025, the Court held the law did not violate the First Amendment as applied. It treated the provisions as content neutral and accepted the government's data collection rationale: that China could use its control over ByteDance to collect sensitive data on roughly 170 million U.S. users.

The other federal security rules

Rule	Who it binds	What it requires	Enforcer
FTC Act Section 5, 15 U.S.C. 45	Most businesses; not banks, savings and loans, federal credit unions, common carriers or air carriers	Keep privacy promises; reasonable security; no unfair data practices	FTC (no private suits)
SEC Form 8-K Item 1.05 and Reg. S-K Item 106	Public companies	Material incident disclosure within four business days of the materiality decision; annual risk and governance disclosure	SEC
CIRCIA (rule pending)	Covered critical infrastructure entities as the final rule defines them	72-hour incident reports and 24-hour ransom payment reports to CISA	CISA (subpoena and referral powers)
PADFA, 15 U.S.C. 9901	Data brokers	No transfer of sensitive data to North Korea, China, Russia, Iran or entities they control	FTC
28 CFR Part 202	U.S. persons engaging in covered data transactions	No data brokerage with countries of concern; security conditions on vendor, employment and investment deals	DOJ National Security Division
12 CFR Part 53 (OCC version, adopted November 2021)	National banks and their service providers	Notify the primary regulator within 36 hours of determining a notification incident occurred; providers notify bank customers as soon as possible after a disruption of four hours or more	OCC (other bank regulators for their banks)
47 CFR 64.2011 (CPNI breach rule)	Telecommunications carriers	Notify the Secret Service and FBI no later than seven business days after reasonably determining a breach; customer notice after that wait unless an investigating agency asks for delay	FCC
TSA security directives	Owners and operators of designated pipelines and railroads	Cybersecurity programs, mitigation, testing and incident reporting under directives first issued in 2021 and reissued through May 2025	TSA
TAKE IT DOWN Act, Pub. L. 119-12	Covered online platforms	Remove nonconsensual intimate images within 48 hours of a valid request, since May 19, 2026	FTC (plus federal criminal penalties for publishers)

The FCC and carrier location data. The FCC regulates what carriers do with customer proprietary network information (CPNI). In 2024 it fined the major carriers after investigating how they handled and shared customer location data: about $80 million for T-Mobile, $57 million for AT&T, nearly $47 million for Verizon, and $12 million for Sprint, according to the Congressional Research Service. The carriers paid and appealed, arguing that penalties imposed without a jury violate the Seventh Amendment. The Fifth Circuit agreed for AT&T; the Second and D.C. Circuits upheld the orders against Verizon, T-Mobile and Sprint. On June 4, 2026, in FCC v. AT&T, the Supreme Court ruled 8 to 1 for the FCC: a forfeiture order is not binding until the government wins a collection suit in which the carrier gets a jury, so no Seventh Amendment problem arises. For carrier breaches, the current eCFR text of 47 CFR 64.2011 as checked in October 2026 requires notice to the Secret Service and FBI no later than seven business days after the carrier reasonably determines a breach occurred, and defines a breach as someone having "intentionally gained access to, used, or disclosed" CPNI without authorization. Customers are told after that wait unless an investigating agency asks for a delay of up to 30 days at first.

HHS, GLBA and the overlaps. A hospital that is also a public company owes HIPAA breach notices to patients and HHS within 60 days (lesson 03), may owe a Form 8-K within four business days if the attack is material, may owe CISA a 72-hour report once CIRCIA is in force, and owes state breach notices (lesson 09). A tax preparer owes the FTC a Safeguards Rule notice within 30 days for 500 or more consumers (lesson 04). The federal rules generally do not replace each other, and none of them replaces the state laws. Course 72's When Something Goes Wrong walks through the first hours of a real response.

The federal privacy bills that did not pass, and the ones that did

The American Data Privacy and Protection Act (H.R. 8152) came closest. The House Energy and Commerce Committee reported it on December 30, 2022, and it never got a floor vote. The American Privacy Rights Act of 2024 (H.R. 8818), introduced June 25, 2024, had sections on enforcement by individuals and on its relation to state laws, and it died with the 118th Congress. Both foundered on the same two questions: how much a federal law should override state laws like California's, and whether individuals should be able to sue.

In February 2025 the Energy and Commerce chairman formed a privacy working group. Its product, the SECURE Data Act (H.R. 8413), was introduced April 22, 2026, according to an IAPP analysis. It would broadly preempt state laws that relate to its provisions, would be enforced by the FTC and state attorneys general, and has no private right of action. As of October 2026 it had not passed either chamber.

Children's bills moved further. On June 29, 2026 the House passed the KIDS Act (H.R. 7757), which folds in parts of the Kids Online Safety Act and COPPA 2.0, according to a Crowell summary. It drops KOSA's duty of care, and Senate KOSA sponsors have said the House version will not pass the Senate as written. Lesson 05 covers the children's rules in force.

The one recent privacy-adjacent law that passed is the TAKE IT DOWN Act, Public Law 119-12, signed May 19, 2025. It makes it a federal crime to publish nonconsensual intimate images, including AI-generated digital forgeries (up to two years in prison where the victim is an adult, three where a minor), and gave covered platforms one year to set up a notice-and-removal process that takes material down within 48 hours of a valid request. The FTC enforces the platform duty as a rule violation, and it announced it began enforcing on May 19, 2026, followed by warning letters on May 20.

Questions and answers

Can I sue a company under the FTC Act?

No. Section 5 is enforced only by the FTC. Individuals can sue under state consumer protection laws that allow private suits, under statutes with their own private rights such as the Illinois Biometric Information Privacy Act (lesson 08) and several federal communications laws (lesson 06), and in contract or tort.

Why does the FTC settle instead of going to trial?

Because the payoff of a case is the order, and a settlement gets one faster with specific terms both sides understand. Litigated cases take years: Kochava ran from August 2022 to a May 2026 settlement. After AMG Capital, a trial also cannot produce restitution under Section 13(b), which removed one reason to litigate.

How much can the FTC fine for an order violation?

Up to $53,088 per violation under the January 2025 adjustment in 16 CFR 1.98, with each day of a continuing violation counted separately. Because a single practice can touch millions of consumers over many days, the theoretical maximum in a large case is enormous, which is the pressure behind settlements like Facebook's $5 billion.

Does the SEC rule apply to private companies?

No. It applies to companies that file reports with the SEC. A private company's breach is governed by the FTC Act, any sector law, and state breach laws.

Does PADFA apply to an app that sends data to a Chinese-owned cloud host?

PADFA reaches data brokers: entities that make available data they did not collect directly from the people involved, other than as a service provider. An app passing data to its own hosting vendor is closer to the DOJ rule's vendor agreement category, which can apply if the volume crosses the bulk thresholds and the vendor is a covered person.

What happened to TikTok after the ruling?

This lesson covers only the law and the January 17, 2025 decision. Later executive actions and any divestiture are outside what was verified here.

Is there any federal law requiring every company to report breaches?

No. Federal breach duties are sector by sector: HIPAA, the FTC Safeguards Rule and Health Breach Notification Rule, the SEC rule, the banking 36-hour rule, the FCC CPNI rule, and CIRCIA once it takes effect. Every state has its own breach law that fills the gaps (lesson 09).

What does the TAKE IT DOWN Act require of a website I run?

If it is a covered platform that hosts user-generated content, it must have a clear process to receive removal requests for nonconsensual intimate images and take the material and known copies down within 48 hours of a valid request. The FTC enforces that duty; failing to reasonably comply is treated as a rule violation.

Hard questions

Should the FTC be able to fine first-time privacy violators?

The Commission has asked Congress for more remedial power for years, and its April 2026 testimony repeated the request to restore money remedies lost in AMG Capital. The argument for: without a penalty on the first offense, a company can profit from a practice until caught and then sign an order. The argument against: Section 5 is a general standard, and penalties for violating a standard written after the fact raise the fair notice problem the Wyndham and LabMD defendants pressed. Rules, which give advance notice, are the route Congress has used so far (COPPA, PADFA).

Should a federal privacy law preempt state laws?

Businesses and the SECURE Data Act's sponsors argue that 20-plus state laws with different thresholds, definitions and cure periods impose real costs, and that one national standard would be easier to follow and enforce. State attorneys general, California officials and privacy groups argue that preemption would wipe out stronger state protections and freeze the law at a lower level, and they point out that state laws are where most innovation has happened. ADPPA and APRA tried a middle path with carve-outs; both died. The fight now turns on how broad the preemption clause is.

Should individuals be able to sue under a federal privacy law?

Supporters say agencies cannot police millions of companies, that by its own April 2026 count the FTC has settled only a little more than 100 privacy cases in its history, and that statutes with private rights (BIPA, the TCPA) are the ones companies take most seriously. Opponents point to those same statutes as proof that private suits produce large settlements for technical violations and class action fees, and argue that state and federal enforcers can prioritize real harm. APRA included a private right; the SECURE Data Act does not.

Is disgorging algorithms a fair remedy?

The FTC argues that deleting only the data lets a company keep the value it took unlawfully, and that model deletion is the only remedy that removes the benefit. Companies argue that models mix lawful and unlawful data, that deletion can destroy far more value than the violation produced, and that no statute names the remedy. So far it has appeared only in negotiated orders, so no court has tested its limits.

Is the SEC's four-day rule good for investors or for attackers?

The SEC adopted it to end inconsistent and delayed disclosures, and investors gained a fixed date. Companies and some security officials argued that public disclosure within days can tip off attackers and push firms to file before they understand the incident. The rule's answer is the Attorney General delay for national security or public safety risk. The SolarWinds dismissal in 2025 removed the main test of how far the SEC would go in charging disclosure failures, leaving the four-day rule itself unchanged.