Marketers and lead generators have new guidance in the form of enforcement orders on what the Federal Trade Commission (FTC) appears to consider required practice when obtaining consumer consent prior to the sale, transfer, or disclosure of consumer information that will be used in marketing.
The upshot is that the FTC provided several affirmative requirements it would want to see relating to the sale, transfer, or disclosure of consumer information by lead generators, including when obtaining consumer consent prior to transfer to a third-party marketer. But the FTC has also taken direct aim at the use of hyperlinks used to make disclosures of the identities or names of persons to whom the information will be sold and other information, prior to the consumer providing consent, a step taken by many lead generators to avoid violating the FTC Act and the Telemarketing Sales Rule (TSR).
The FTC and other federal and state law enforcement partners recently announced "Operation Stop Scam Calls." A focus of the announcement was several enforcement actions against marketers and lead generators, including actions where the FTC alleged the defendants acted as "consent farms," which, in the FTC's opinion, improperly obtained consumers' consent by using deceptive ads and "dark patterns" to trick consumers into providing their personal information and consenting to receive prerecorded calls and other marketing solicitations.
In one particularly harsh complaint, the FTC alleged the Defendants sold millions of leads to other companies, and in the process violated the FTC Act, the TSR, and the CAN-SPAM Act. To settle the case, the Defendants agreed to pay a $2.5 million civil money penalty and destroy previously collected consumer information. Furthermore, the Defendants are banned from engaging in, assisting, or facilitating prerecorded calls (referred to as robocalls).
Of particular interest to lead generators seeking a roadmap from the enforcement action, the FTC's Order in our example requires Defendants, among other things, to comply with injunctive relief provisions concerning: (i) restrictions on collection of information used to generate and sell leads, (ii) prohibitions against potential misrepresentations, (iii) prohibitions on unsolicited, unauthorized, or deceptive commercial e-mail messages, (iv) due diligence requirements and monitoring of publishers and publisher networks, (v) monitoring of internal advertisements, (vi) a ban on robocalls, (vii) restrictions related to the sale, transfer, or disclosure of consumer information used for lead generation, and (viii) restrictions on previously collected customer information.
Legal Authority over Defendants' Lead Generation Activity
The FTC's complaint alleged violations of:
- The FTC Act, which prohibits "unfair or deceptive acts or practices in or affecting commerce"
- The TSR, which was adopted by the FTC in 1995, amended in 2003, and other times since. The TSR prohibits initiating any outbound telephone calls that deliver a prerecorded message to induce the purchase of any good or service, unless the seller has obtained from the recipient of the call an express agreement, in writing, that evidences the willingness of the recipient of the call to receive calls delivering prerecorded messages by or on behalf of a specific seller.
- According to the FTC, the express agreement may not be obtained by a lead generator who does not qualify as a seller or telemarketer under the TSR, because the express agreement must be obtained by the seller or the telemarketer directly from the recipient
- Furthermore, the TSR provides, among other things, that it is a violation of the Rule to initiate any outbound telemarketing call to a person when that person's telephone number is on the National Do Not Call Registry unless the seller or telemarketer can demonstrate that the seller has an express agreement, in writing, or has an existing business relationship with such person
- It is a violation of the TSR for any person to provide substantial assistance to or support any seller or telemarketer when that person knowns or consciously avoids knowing that the seller or telemarketer is engaged in any practice that violates the TSR
- The CAN-SPAM Act, which sets out restrictions on the use of commercial email, establishes requirements for commercial messages, and gives recipients the right to request an entity cease from sending them commercial email. Among other things, it is a violation of the CAN-SPAM Act to send any commercial email with a header or subject line that would mislead a recipient regarding the content of the message. Also prohibited is initiating a commercial email to a recipient where the sender received a request not to receive commercial emails more than ten days prior
Guidance on Obtaining Consent
While the Order describes in relative detail the FTC's requirements for the Defendants, the requirements can serve as a roadmap for how the FTC would expect companies subject to its enforcement authority to engage in lead generation activity. These elements have been identified before in various public and nonpublic statements by staff during confidential investigations, but the Order (and other aspects of the enforcement sweep) puts the requirements in writing, in a manner that goes beyond prior public guidance, in a detailed fashion. Notably, the requirements in the Order go well beyond informal staff guidance previously made public on the topic of TSR compliance (prior to amendments in 2009) and other actions taken by the FTC related to obtaining consumer consent. But the requirements in the Order are not directly found in the FTC Act or TSR, which is subject to periodic review by the FTC and is a product of notice and comment rulemaking under the Administrative Procedures Act.
The FTC Order identified three main requirements, including especially detailed consent requirements that the Defendants must meet related to the sale, transfer, or disclosure of consumer information. The Order is an indication that the FTC disfavors lead generation disclosures made through hyperlinks or requiring an affirmative consumer action to view or access the disclosure—even though much of the Complaint and alleged violations stem from alleged deceptive advertising to attract leads and the resulting telemarketing activities of purchasers of the leads.
1. Due Diligence and Monitoring of Publishers and Publisher Networks
The Order requires the Defendants, among other things, to meet the following due diligence and monitoring obligations when doing business with publishers and publisher networks as defined by the Order:
- Provide publishers and publisher networks a copy of the final order and a disclosure that engaging in any acts or practices prohibited by the final order will result in disciplinary action, including the immediate termination and forfeiture of funds
- Within 45 days of entry of the final order, Defendants must obtain a signed and dated statement from each publisher and publisher network acknowledging receipt of the final order and expressly agreeing to comply with the final order. If such statement is not obtained, Defendants must suspend all business with any publisher or publisher network until they provide the statement
- Establish, implement, and maintain a system to review and monitor all materially distinct material provided to consumers referring the consumer to the Defendants by any publisher or publisher network. The system must include, among other requirements:
- Obtaining from each publisher or publisher network, among other things:
- A copy of all materially distinct material, including text, graphic, video, audio, and photographs used to advertise, promote, market, or offer for sale any of the Defendants' goods or services before they are publicly displayed or disseminated
- A list of each website or social media location, including URL, where the foregoing information has appeared that the publisher or publisher network maintains or controls
- Each ad platform to which the publisher or publisher network submitted the material and the dates corresponding to each advertising campaign
- Reviewing all material submitted to the Defendants for compliance with the final order and the Defendants' policies and guidelines for publishers. If the material does not comply, providing written notice to the publisher or publisher network that approval to use such material is denied, and if the material does comply, providing written notice of that fact
- If the Defendants know or should know that a publisher or publisher source and those providing services for a publisher network have displayed or disseminated any material that contains a misrepresentation prohibited by the final order or emails any consumer on the Defendants' behalf without downloading the Defendants' suppression list ten days prior to confirm the consumer is not on the Defendants' suppression list, then Defendants must immediately suspend, deny payment to, and reject all future consumer referrals from such publisher or publisher source until the suspension is lifted in accordance with the final order
- If Defendants receive complaints or other information that any publisher, publisher network, or publisher source is engaged in activities prohibited by the final order, the Defendants must notify the publisher, publisher network, or publisher source that it is under investigation. At the end of such an investigation, Defendants must generate a written report, send that report to the investigated party, and, if the party is found to violate the final order, immediately suspend or permanently terminate the investigated party
- Obtaining from each publisher or publisher network, among other things:
Court Order, Section IV.
2. Monitoring of Internal Advertisements
Before the Defendants disseminate any material, including text, graphic, video, audio, and photographs to advertise, promote, market, or offer for sale any goods or services, the Order requires:
- Defendants to establish, implement, and maintain a system to review and monitor all materially distinct materials sufficient to:
- Review the following to ensure it complies with the final order and Defendants' advertising policies and guidelines:
- A copy of any materially distinct materials
- Each website or social media location where the material will appear that any Defendant maintains, or directly or indirectly controls, including any social media account or URL of any website
- Each ad platform to which the material is submitted and the dates corresponding to when the material will be disseminated
- The URL for any hyperlinks contained in the material
- The landing pages associated with any URL contained within the material
- After review, document in writing that the reviewed material complies with the requirements of the final order and Defendants' advertising guidelines and policies
- Review the following to ensure it complies with the final order and Defendants' advertising policies and guidelines:
Court Order, Section V.
3. Requirements Related to the Sale, Transfer, or Disclosure of Covered Information
Defendants are permanently restrained and enjoined from:
- Collecting and selling, transferring, or otherwise disclosing any consumer information specified in the Order as "Covered Information" to any person, other than another Defendant or a service provider that does not pay for such information, unless the Defendants:
- Clearly and conspicuously disclose to the consumer, separate and apart from any "privacy policy," "terms and conditions," "terms of service" or other similar document and without requiring the consumer to click a hyperlink or take any other affirmative act to view or access the disclosure, the following:
- The specific purpose for which the information is being collected, sold, transferred, or disclosed
- The types of information that may be sold, transferred, or disclosed
- The name of every person collecting the information
- The name of every person that the information will be sold, transferred, or disclosed to
- All purposes for which the Defendants and recipients will use the information
- A simple, easily located means for the consumer to withdraw authorization of the sale, transfer, or distribution of the consumer's information
- Any limits to the consumer's ability to withdraw authorization of the sale, transfer, or distribution of the consumer's information
- All other information material to the provision of authorization of the collection, sale, transfer, or distribution of the consumer's covered information
- Obtain the consumer's affirmative express consent for the collection, sale, transfer, or disclosure of the consumer's information after receiving the foregoing disclosures
- Obtain signed and dated contract documents or a certification from the recipient of the consumer's information stating, among other requirements:
- Confirmation that the recipient possesses all relevant required business licenses and business registrations
- A description of the recipient's business, including the nature of goods or services sold and the nature of the sale
- That the consumer's information will not be sold, transferred, or disclosed to any other person or used for any purpose other than the specified purposes disclosed to the consumer
- The identity of each person with whom the recipient will share the consumer's information and all purposes for which each person will use the covered information obtained from the recipient
- Affirmation that the consumer's information will be permanently destroyed within 2 weeks of notice from the Defendants that the consumer has requested its deletion or has rescinded consent to its use, unless it need not be destroyed to the extent requested by a government agency or as required by law, regulation, or court order
- Ensure that no action is taken to encourage, compel, or mislead any consumer to provide affirmative express consent, including requiring such consent as a condition for the use of the service, or obtaining such consent using a user interface that fails to provide a clear option to proceed without providing consent
- Clearly and conspicuously disclose to the consumer, separate and apart from any "privacy policy," "terms and conditions," "terms of service" or other similar document and without requiring the consumer to click a hyperlink or take any other affirmative act to view or access the disclosure, the following:
Court Order, Section VIII.
Order's Implications for Lead Generators
The FTC's actions against lead generators, and the injunctive requirements in the settlement discussed above, provide lead generators with a roadmap to obtain consumer consent to be contacted by a lead generator's partners, but also raise the risk for certain practices, including disclosures through hyperlinks and use the use of leads for certain telemarketing purposes.
The Order places substantial and onerous obligations on the lead generators targeted and essentially requires the entity to become its own monitor and closely monitor third parties it works with through enhanced due diligence requirements. The Order also nullifies any further use of consumer data previously collected to sell leads moving forward, regardless of whether the FTC requests the entity to permanently delete the previously collected information. And the Order bans making or assisting others with making telemarketing calls using prerecorded messages.
Between the FTC's actions; the FCC's recent proposal to "ban the practice of obtaining a single consumer consent as grounds for delivering calls and text messages from multiple marketers on subjects beyond the scope of the original consent," discussed here; and prior FCC enforcement actions, including one against a telemarketer for improperly making prerecorded voice calls without proper consent, discussed here, companies involved in generating leads and relying on consumer consent obtained by lead generators must be especially mindful of how consumer consent is obtained and how resulting lead information may be used.
Related Articles
FCC Proposes Rule to "Close the Lead Generator Loophole," with Business-Changing Ramifications
Lead Generators' Due Diligence – Up One Stream and Down the Other
Lead Generation Compliance and Regulation in Today's World. Who's Minding the Store?
FTC Complaint Confirms Interest in Lead Generation
Five "Lessons" for Lead Generation Advertisers
Government Puts Squeeze on Lead Generation Marketing
FTC Releases Staff Perspectives on Lead Generation
Navigating CFPB, FTC, and State Attorneys General Consumer Protection Investigations