Consumer Law & Policy Blog

Hoofnagle on the FTC's Privacy Assessments

Chris Jay Hoofnagle of Berkeley has written Assessing the Federal Trade Commission's Privacy Assessments, 14(2) IEEE Security & Privacy 58–64 (Mar/Apr. 2016).  Here is the abstract:

Consumer protection regulators worldwide share basic problems: the companies that regulators police are so powerful and rich that fines do not matter. Consider the French with their €150,000 fine against Google in 2014. Efficacious fines against dominant platforms would have to rise to nine-figure levels to cause change, but consumer protection agencies generally lack the authority and political will to levy such fines.

As a result, consumer protection officials ensure compliance by monitoring defendant companies. However, even this is a challenge. Although consumer protection agencies such as the US Federal Trade Commission (FTC) have decades of experience in evaluating misleading advertising, information security and privacy oversight challenges differ from advertising matters.

Because information security and privacy issues are difficult to observe and, even if detected, difficult to understand, the FTC and other enforcement agencies rely on outside “assessments” by accounting and security consultants. These assessments evaluate the veracity of defendant company managers’ claims about privacy and security protection of consumer information. Accounting and security firms now have a lucrative and growing business in performing assessments required by the FTC and state attorneys general. In a real sense, consumer privacy worldwide depends on these assessments, as international regulators rely on the FTC’s oversight of companies serving consumers in other countries.

Unfortunately, assessments are misunderstood by many in the policy realm, who mistakenly see them as rigorous as a formal audit. The lack of knowledge of the differences between assessments and audits allows the FTC and respondent companies to tout assessments as an effective tool to improve practices.

In this article, I discuss efforts to oversee companies’ privacy and security programs through the lens of two assessment reports on TRENDnet and Google and offer five suggestions to increase accountability in the assessment process.

Bar-Gill & Davis on Consumer Misconceptions About Law

Oren Bar-Gill of Harvard and Kevin E. Davis of NYU have written (Mis)perceptions of Law in Consumer Markets.  Here's the abstract:

There are good reasons to believe that consumers’ behavior is sometimes influenced by systematic misperceptions of legal norms that govern product quality. Consumers might misperceive specific rules, such as those found in food safety regulations, as well as more general standards, such as the unconscionability doctrine or limitations on waivers of default substantive or procedural rights. When demand is affected by systematic misperceptions of legal norms, lawmakers may be able to maximize welfare by deviating from the legal standard that would be optimal in the absence of misperception. We use a formal model to characterize these optimal deviations under different legal regimes (with different types and magnitudes of sanctions).

Call for Papers for Students and Young Lawyers

We have received the following Call for Papers:

The three Consumer-Protection related committees of the ABA Antitrust Section (Consumer Protection, Privacy, and Advertising Disputes & Litigation Committees) are excited to announce a new initiative geared towards young lawyers and law students interested in the consumer protection and privacy fields – an opportunity to get published in a special edition of our newsletter, What’s in Store.  This edition will be devoted to issues of concern and interest to the next generation of consumer-protection scholars & practitioners – you!   

To be considered for publication:

• Select a topic relating to an emerging issue of consumer protection or privacy law (we are happy to provide potential topics to get you started); 
• Prepare a 2,000-2,500 word paper on that topic; and 
• Submit your article by May 20, 2016 to antitrust@americanbar.org with subject line – Consumer Protection Article Submission
• Include in your submission the following information:
• Certification that you have been in practice for 5 years or less or are under 36;
• Your law school/organization;
• Why you selected the topic; and
• The paper’s word count

We will notify you if your piece has been selected for publication by June 10, 2016.  We are eager to receive entries from law students, young government attorneys (federal and state), economists, or young lawyers from private practice (big, small, plaintiff or defense, think tanks, or business organizations).  If you have any questions, please email Consumer Protection Committee Co-Chair, Svetlana Gans, at whatsinstorecp@gmail.com.

Wilkinson-Ryan Paper: Contracts Without Terms

Tess Wilkinson‐Ryan of Penn has written Contracts Without Terms.  Here is the abstract:

In consumer contracting, the ritual of documentation and provision of terms is essentially vestigial, at least as a form of deal-making communication between the parties. This paper starts with a thought experiment: what would it look like to have contracts but no standard terms? Most scholarly and political approaches to the mismatch of contract law and consumer contracting have focused on the information problem in consumer contracting — the difficulty of the required cognitive processing — and thus the proposed solutions have focused on how to make terms more salient or easier to assimilate. I argue that the focus on salience is not only futile but misleading. Promulgating a policy by contract lends it social or moral legitimacy, as well as a presumption of legal legitimacy. I report the results of an experimental questionnaire study designed to assess how the form of a policy — i.e., provided in standard terms or available in a non-contractual document, affects consumer behavior when there is a plausible complaint against the drafter. Subjects reported that company policies embedded in contracts were more likely to be legally enforceable, judged those policies as more fair, and reported that they would be less likely to challenge such those policies in court. Furthermore, subjects appeared to grant all but the most clearly non-contractual documents the status of contract, with all of its legal, moral, and social baggage. In the final section of the paper I consider the doctrines of assent and unconscionability in light of these results.

More on Hoofnagle's FTC Privacy Law and Policy

by Jeff Sovern

I've gradually been making my way through Chris Hoofnagle's new book, Federal Trade Commission Privacy Law and Policy (more about that below).  For those who want to sample the book before ordering it, Chris has posted the Introduction and an excerpt to SSRN here.  The book opens with an interesting history of the FTC and advertising law generally.  One of the remarkable things about that history, which I had not known, was that well into the Twentieth Century, advertising law was confined to mandating disclosure of ingredients.  An excerpt from the book (footnote omitted):

* * * Arthur Kallet and Frederick J. Schlink shocked the public with the publication of their bestselling 1,000,000 Guinea Pigs in 1933. It illuminated the extent of dangerous products sold, the marketing of those products, and the weakness of federal regulation. The book, which underwent over a dozen printings and was widely read, led directly to the passage of stronger laws in 1938. Throughout the book’s anecdotes, a common theme emerged: individuals could become very affluent by experimenting on the public. When individuals were harmed, the government and victims could do little to remedy the problem because the law primarily was concerned with giving consumers notice of ingredients. If an experiment failed, the entrepreneur could simply move on to some other product. Kallet and Schlink saw the law as a license to kill. Consider these examples:

• Kopp’s Baby Friend, marketed as a soothing agent for babies, secretly contained morphine, and it led to the deaths of nine infants. The government’s remedy at the time was limited to prosecuting mislabeling. Thus, after a $25 fine, Kopp’s reappeared on the market, albeit with a disclosure of morphine as an ingredient.

• Entrepreneurs were free to create “cures” that were crude and dangerous experiments on the consumer. For instance, William J. A. Bailey marketed Radithor, water irradiated with radium, to affluent people. When a prominent patient died, Bailey told the New York Times that “I have drunk more radium water than any man alive and I never have suffered any ill effects.”

• Pebeco Toothpaste contained potassium chlorate (a poisonous, combustible chemical originally used to ignite bullets), so much that, “[i]n 1910, a German army officer committed suicide by eating the contents of a tube of Pebeco.”

While we have come a long way, it is interesting that the debate over disclosure versus other forms of regulation continues today.

 

Johnson on Payment Cards

D. Bruce Johnsen of George Mason has written A Closer Look at Payment Cards. Here is the abstract:

This essay takes a closer look at the U.S. payment card system, primarily debit cards. I examine the bundle of transactional services this and other types of payment cards provide. My goal, in large part, is to assess the competitive effects of the debit card interchange fee cap under the Durbin Amendment to the Dodd-Frank Act (2011). In addition to a binding fee cap, it mandated a change in the way the fee is metered. A maximum per transaction fee of 20 cents, binding for most transactions, replaced a typical two-percent negotiated fee. I test hypothesis that the cap caused or contributed to a decline in the willingness of payment card intermediaries to invest in security, possibly increasing the system’s vulnerabilities to the kind of data breaches that have become ever more commonplace.

Pasquale on Student Loan IBR

Frank A. Pasquale III of Maryland has written Democratizing Higher Education: Defending and Extending Income-Based Repayment Programs, Loyola Consumer Law Review (Forthcoming). Here is the abstract:

This article addresses many critiques of income-based repayment programs for student loan debt. These programs are not helping many of the students they were designed to aid. Their terms are too harsh, especially given repeated failures by relevant authorities to fully account for the benefits of higher education. If reformers fail to substantially improve the terms and accessibility of IBR programs, they will lose popularity and credibility.

David Adam Friedman Paper: Refining Advertising Regulation

David Adam Friedman of Willamette has written Refining Advertising Regulation.  Here's the abstract:

Why did the Federal Trade Commission (FTC) aggressively pursue Volkswagen’s claims about “clean-diesel” technology, while ignoring widespread practices like deceptive discount pricing? Why did the FTC offer formal guidance to industry about “native advertising,” but only casual guidance to consumers about widely-used, peer-review aggregators like Yelp! and Fandango?

For decades, the FTC has only loosely employed a cost-benefit-analysis approach toward prioritizing enforcement of advertising regulation. I contend that federal regulators can best refine enforcement priorities by looking to the information economics literature for an established framework for classifying advertising claims. This Article shows that classifying advertising into search claims, experience claims, and credence claims offers a structure for more rigorous cost-benefit analysis of enforcement opportunities. Expressly incorporating this search-experience-credence claim framework into regulatory decision making and prioritization will lead to improved stewardship of FTC resources.

Article: How Legal Rules Can Improve Search Behavior & Decision Quality

Brigitta Lurger of Graz and four co-authors have written Consumer Decisions Under High Information Load: How Can Legal Rules Improve Search Behavior and Decision Quality?.  Here's the abstract:

EU consumer protection legislation is designed to enable consumers to make "good" contract decisions in the market place. This legislation heavily relies on the model of rational homo oeconomicus: It assumes that consumers want to and can process large amounts of information in order to maximize their own outcomes, and requires businesses to provide a wealth of information to their customers. In an interdisciplinary study conducted by lawyers and psychologists, we wanted to describe the precise flaws of this strategy, based on the EU consumer protection regulation presently in force, and to formulate assumptions about promising regulatory means to overcome them.

We examined search behavior and decision strategies in a sample of 363 persons who we asked to choose a cellular service contract. Participants were presented with contract offers which reflected the demands of the law and which closely matched offers that can be found in the Austrian market. The multiple offers of 11 providers, with variation in rates and conditions, comprised each a large amount of detail and information. Hence, the choice situation was complex and information load was high. Two different user profiles were randomly assigned to the participants. Choice quality was measured on three levels (tariff quality, term quality, and subjective quality). We assessed the information processing behavior (including personal and contextual variables) with a palette of measures, identified discrete choice strategies, and examined how these related to choice quality. We found that most successful search strategies were not exhaustive, but instead involved the focused selection and processing of a medium amount of information. Successful decision behavior of that kind seems to be only partly and most imperfectly supported by present regulation. Research is now underway to explore a more "ergonomic" (i.e., psychologically realistic and effective) regulation of consumer information that may lead to a higher number ob "good" contract choices by cellular service customers.

Citron Article on State AGs and Privacy Law Development

Danielle Keats Citron of Maryland, Yale and Stanford has written Privacy Enforcement Pioneers: The Role of State Attorneys General in the Development of Privacy Law, Forthcoming in the Notre Dame Law Review,   Here's the abstract:

Accounts of privacy law have focused on legislation, federal agencies, and the self-regulation of privacy professionals. Crucial agents of regulatory change, however, have been ignored: the state attorneys general. This article is the first in-depth study of the privacy norm entrepreneurship of state attorneys general. Because so little has been written about this phenomenon, I engaged with primary sources — first interviewing state attorneys general and current and former career staff, and then examining documentary evidence received through FOIA requests submitted to AG offices around the country.

Much as Justice Louis Brandeis imagined states as laboratories of the law, offices of state attorneys general have been laboratories of privacy enforcement. State attorneys general have been nimble privacy enforcement pioneers where federal agencies have been more conservative or constrained by politics. Their local knowledge, specialization, multi-state coordination, and broad legal authority have allowed them to experiment in ways that federal agencies cannot. These characteristics have enabled them to establish baseline fair information protections; expand the frontiers of privacy law to cover sexual intimacy and youth; and pursue enforcement actions that have harmonized privacy policy.

Although certain systemic practices enhance AG privacy policy making, others blunt its impact, including an over reliance on informal agreements that lack law’s influence and a reluctance to issue closing letters identifying data practices that comply with the law. This article offers ways state attorneys general can function more effectively through informal and formal proceedings. It addresses concerns about the potential pile-up of enforcement activity, federal preemption, and the dormant Commerce Clause. It urges state enforcers to act more boldly in the face of certain shadowy data practices.