Consumer Power: Changing Laws In The Us

Consumer protection laws are an expansive area of law, primarily in place to protect consumers' privacy and human rights at each consumer touchpoint. These laws are enforced by the Federal Trade Commission (FTC), which was created by the Federal Trade Commission Act (FTCA) in 1914. The FTC enforces antitrust statutes and promotes consumer protection. In addition to the federal consumer protection laws, state and local governments regulate consumer protection in a variety of ways, including false advertising law, unfair business practice regulation, and food safety requirements for local restaurants. Consumers can also take action by filing complaints, which can trigger investigations and lead to refunds or lawsuits against deceptive or fraudulent businesses.

Consumer protection laws

The FTC, created by the Federal Trade Commission Act (FTCA) in 1914, is responsible for enforcing antitrust statutes and promoting consumer protection. It has eight divisions, including Privacy and Identity Protection, Advertising Practices, and Consumer and Business Education. The CFPB regulates entities that provide consumer financial products or services, while the FCC, CPSC, FDA, and USDA enforce laws related to communications, consumer product safety, specific consumer products, and certain agricultural products, respectively.

At the state level, each Attorney General investigates and enforces consumer protection laws, and in some states, District Attorneys also have the authority to prosecute consumer protection claims. States have their own consumer protection statutes that guard against deception and fraud, such as California's Consumers Legal Remedies Act (CLRA), which prohibits various forms of false advertising. State and local governments regulate consumer protection in areas such as false advertising law, unfair business practice regulation, food safety requirements, product labeling, privacy, biometrics, and artificial intelligence.

In terms of product safety, most consumer protection statutes are aimed at preventing injuries from defective products, and consumers can sue for damages if they are injured. State laws, such as "lemon laws," also protect consumers against false or misleading practices by used car dealers. Additionally, the Telephone Consumer Protection Act of 1991 prohibits unsolicited faxes, and the National Do Not Call Registry (DNCR) allows consumers to register to stop receiving telemarketing calls.

Consumer privacy rights

In the United States, consumer privacy rights are protected by a combination of federal and state laws. At the federal level, the Federal Trade Commission Act (FTCA) empowers the Federal Trade Commission (FTC) to enforce antitrust statutes and promote consumer protection. The FTC can investigate violations of marketing language related to privacy and take action against companies that violate their own privacy policies. For example, the FTC issued a complaint against Zoom for falsely claiming that video chats were end-to-end encrypted. Additionally, the FTC Act includes Section 5, which demands that consumers not be deceived or put at risk by businesses. This includes protections against deceptive telemarketers and unsolicited emails.

Beyond federal laws, individual states have enacted their own consumer privacy laws. California was the first state to implement comprehensive data privacy legislation with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). California's laws are considered among the strongest in the US, as they include a limited "private right of action," allowing consumers to sue companies for certain types of data breaches. Other states with comprehensive consumer privacy laws include Virginia (Virginia Consumer Data Protection Act, VCDPA) and Colorado (ColoPA).

State consumer privacy laws can vary significantly. For example, the Minnesota Consumer Data Privacy Act (MCDPA) allows consumers to question automated decisions made through profiling, while the New Hampshire Privacy Act (NHPA) gives consumers the right to know what data a company collects and to opt out of certain uses, such as targeted advertising. Rhode Island's data privacy law has been criticised for not meaningfully limiting how companies collect or use personal information, but it does grant consumers the right to confirm and correct their data.

The growing complexity of state privacy legislation has led to initiatives like the US State Comprehensive Privacy Laws Report, which aims to inform privacy professionals about the rights offered to consumers and the obligations of regulated entities under these laws. As of 2024, 20 US states have enacted comprehensive consumer data privacy laws, and more states are expected to follow suit in the coming years to protect consumers from cyber risks and stay competitive with international data regulations.

Consumer financial services

The US Consumer Financial Protection Bureau (CFPB) was created in 2010 to enforce financial laws that affect consumers, implement changes to the law, and provide support for consumers. The CFPB is a US government agency that works to ensure that consumers are treated fairly by banks, lenders, and other financial institutions. It also aims to make consumer financial markets work for consumers, responsible providers, and the economy as a whole.

The CFPB has primary authority over many consumer financial products, such as mortgages, credit cards, loan servicing, and debt collection. The bureau's enforcement actions have returned almost $12 billion to 29 million consumers, and it has enacted new financial regulations. For example, the CFPB has sued credit card companies for engaging in unfair, deceptive, and abusive practices, prosecuted banks for charging overdraft fees to consumers who had not agreed to overdraft services, and brought lawsuits against payday lenders.

The CFPB's rule-making process typically starts with research and is informed by public input, including field hearings, consumer and industry roundtables, advisory bodies, and small business review panels. The bureau publishes notices requesting public comment on proposed rules and requests for information, encouraging everyone to share their views. Once a regulation is in place, the CFPB provides support and resources to help stakeholders understand and comply with the rule.

The CFPB also works with community banks and credit unions to ensure that consumers can choose from a variety of products, services, and financial relationships. The bureau considers how its rules affect these smaller financial institutions. Additionally, the CFPB has taken steps to protect consumers in the rapidly changing financial marketplace, where financial technology products and services offer benefits but also pose potential risks, including data security and privacy concerns.

The Consumer Financial Protection Act of 2010 (CFPA) authorizes states to enforce its provisions, including federal consumer financial laws. This allows states to take action against violations of consumer financial laws and bring concurrent enforcement actions with the CFPB.

Consumer product safety

In the United States, consumer protection laws are enforced by the Federal Trade Commission (FTC), created by the Federal Trade Commission Act (FTCA) in 1914. The FTC enforces antitrust statutes and promotes consumer protection. Investigations may be triggered by consumer complaints, whistleblower reports, press articles, social media posts, and more. The FTC can demand documents, testimony, and investigational hearings, and if a matter is not resolved, it can file a complaint in an administrative forum or federal court.

The mission of the Consumer Product Safety Commission (CPSC) is to protect the public from unreasonable risks of injury or death associated with consumer products. The CPSC administers and enforces several federal laws, including the Consumer Product Safety Act and the Consumer Product Safety Improvement Act (CPSIA). The CPSIA, which amended the CPSA in 2008, provided the CPSC with new regulatory and enforcement tools, including addressing lead and phthalate limits in toys, tracking labels, civil and criminal penalties, and more. The CPSC also publishes regulations to implement the laws it enforces and oversees thousands of consumer products.

At the federal level, unfair or deceptive acts or practices are subject to a statutory civil penalty of $46,517 per violation if the FTC can demonstrate that the perpetrator had actual knowledge that their conduct was in violation of the FTC Act, and that the FTC had already issued a written decision that such conduct was unfair or deceptive. Additionally, many state consumer protection laws provide remedies for victims of false and deceptive conduct, including statutory damages, restitution, and injunction relief.

State and local governments also regulate consumer protection in a variety of ways, including false advertising laws, unfair business practice regulations, food safety requirements for restaurants, product labeling, privacy, biometrics, and artificial intelligence. For example, California's Consumers Legal Remedies Act prohibits various forms of false advertising, such as misrepresenting the source or quality of goods. Illinois enacted the Biometric Information Privacy Act, which institutes collection, use, and sharing limits for companies handling the biometric information of Illinois residents.

In addition to federal and state laws, there are also specific consumer protection statutes related to product safety, such as the Electronic Funds Transfer Act, the Fair Credit Billing Act, and the Home Owner Protection Act. These laws aim to prevent injuries from occurring and allow consumers to sue for damages if they are injured by a defective product.

Consumer data protection

In the United States, consumer protection laws are enforced at both the federal and state levels. These laws aim to prevent scams, fraud, and theft, protecting consumers' rights and interests. While the Federal Trade Commission Act (FTCA) is a significant federal statute, states also have their own consumer protection laws that address specific issues such as false advertising, unfair business practices, food safety, and privacy.

At the federal level, the Fair Credit Reporting Act (FCRA) regulates credit information and limits who can access it. It also allows consumers to contest inaccurate information. The Gramm-Leach-Bliley Act (GLBA) requires consumer financial product providers to explain how they share data and gives customers the right to opt out. Additionally, the Telephone Consumer Protection Act of 1991 prohibits unsolicited faxes, and the Do-Not-Call Implementation Act of 2003 created the National Do Not Call Registry (DNCR) to protect consumers from unwanted telemarketing calls.

While there is no national law standardizing data breach notifications, individual states have laws addressing this issue. For example, California's privacy protections are considered the strongest in the US, as they include a "private right of action," allowing individuals to sue companies for specific types of data breaches. However, the lack of standardized laws can lead to confusion for both companies and consumers.

To address evolving technologies, the Federal Trade Commission (FTC) has demonstrated its commitment to protecting consumers. In late 2023, the FTC served a civil investigative demand on OpenAI to examine its data protection efforts and the use of personal data for AI training without proper notice, consent, or compensation. The FTC has also warned companies that quietly changing privacy policies to gain consent for AI training may qualify as fraud and deception under the law. These actions highlight the dynamic nature of consumer data protection laws in the US, adapting to new challenges and threats to consumer privacy.

Frequently asked questions