Unfair or Deceptive Acts or Practices (UDAP) Enforcement Authority Under the Federal Trade Commission Act

The Federal Trade Commission (FTC) is the principal agency responsible for enforcing federal consumer protection laws. In addition to enforcing several specific laws, the agency enforces Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) against all U.S. persons, partnerships, and corporations, subject to a few exceptions. Section 5 identifies two categories of acts under the FTC's enforcement authority: "unfair or deceptive acts or practices in or affecting commerce" and "unfair methods of competition." The first of these provisions, frequently referred to as the "UDAP" provision, provides the basis for many of the FTC's consumer protection actions when the agency lacks more specific statutory authority.

The FTC has used its UDAP authority to pursue objectives not explicitly granted to the agency by statute, including policing commercial entities' data privacy and cybersecurity practices. Although the FTC has express statutory authority relating to privacy and cybersecurity in certain situations, its UDAP authority underpins many of the agency's enforcement actions, including a complaint against Facebook that resulted in a $5 billion civil penalty. This In Focus provides an overview of the FTC's consumer protection authority and the remedies available to the agency to enforce the UDAP provision.

What is an Unfair or Deceptive Act or Practice?

Section 5 does not define "unfair or deceptive acts or practices," though it does set a limit on the FTC's authority to declare a practice unfair. Section 5(n) provides that a practice is not "unfair" unless it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition." Apart from this provision, the FTC has broad latitude to declare acts or practices unlawful.

The FTC has a number of tools to declare particular acts or practices UDAPs:

• The agency may issue policy statements or guidance. Policy statements and guidance reflect the agency's position and interpretation of particular legal terms but are not legally binding. The FTC has issued policy statements on both deception and unfairness. In its policy statement on deception, the agency defines a deceptive act or practice as an act or practice that, when considered from the perspective of a reasonable consumer, is both likely to mislead and "material" (i.e., the act or practice is likely to influence a consumer's choice regarding a product). Section 5(n) of the FTC Act discussed above partially codified the FTC's policy statement on unfairness. See CRS Report R44468, General Policy Statements: Legal Overview, by Jared P. Cole and Todd Garvey for more information on policy statements.
• The agency may issue rules defining practices as UDAPs. These rules are sometimes referred to as Trade Regulation Rules (or TRRs). Unlike policy statements or enforcement actions (see below), TRRs may create legally binding obligations for all entities under the FTC's jurisdiction. Section 18 of the FTC Act, as added by the Magnusson-Moss Warranty Act, sets forth the agency's required rulemaking process for designating a practice a UDAP by TRR. This process differs from the rulemaking process set forth in the Administrative Procedure Act (APA) (5 U.S.C. § 553) in several ways, such as requiring that the agency publish an advance notice of proposed rulemaking and permitting interested persons an opportunity for an informal hearing. See CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh for more information on the use of TRR authority generally; see CRS Legal Sidebar LSB10839, FTC Considers Adopting Commercial Surveillance and Data Security Rules, by Chris D. Linebaugh, for a discussion of how the FTC is considering using this authority to protect electronic consumer data.
• The agency may pursue enforcement actions against entities it believes have behaved unfairly or deceptively. Although these enforcement actions do not legally bind anyone other than the parties to the action, the FTC may pursue remedies against non-parties in certain situations discussed below. The FTC has statutory authority to litigate its own enforcement actions, rather than being represented by the U.S. Attorney General. In certain proceedings, the FTC shares enforcement authority with the Attorney General and may litigate only if the agency gives written notification to the Attorney General and the Attorney General fails to act within 45 days.

Relief Available

The FTC may take several actions to address a potential UDAP. The agency has more enforcement options when the alleged UDAP violates a TRR or specific federal statute.

Conduct That Does Not Violate A TRR or Statute

• The FTC may initiate an administrative proceeding pursuant to Section 5(b) of the FTC Act. Section 5(b) proceedings allow the FTC to seek a cease-and-desist order against a person or entity that has committed a UDAP. Proceedings under Section 5(b) are adjudicated before an Administrative Law Judge (ALJ), and the person or entity charged with committing a UDAP has an opportunity to respond to the FTC's allegations before the ALJ. A cease-and-desist order issued under Section 5(b) may be challenged in a federal appeals court. When issuing a cease-and-desist order, the FTC may require corrective action beyond simply refraining from the unlawful conduct. Cease-and-desist orders may, for example, require violators to engage in corrective advertising.
• If the agency has previously issued an order against the party, the agency may seek civil penalties in federal district court for violations of the order under Section 5(l) of the FTC Act. Many of the FTC's cybersecurity enforcement actions, such as its $5 billion penalty assessed against Facebook, seek penalties for violations of FTC orders. Pursuant to Section 5(m), the FTC may also recover civil penalties for violations of cease-and-desist orders by non-parties if the offending party has actual knowledge that their conduct was unfair or deceptive and was unlawful under Section 5 of the FTC Act. The FTC and the Department of Justice (DOJ) share authority over these proceedings, so the FTC must notify the DOJ before pursuing civil penalties. Once notified, the Attorney General has 45 days to initiate a proceeding. Consequently, civil penalty proceedings are frequently initiated by the Department of Justice.
• Under Section 19(a)(2) of the FTC Act, the agency may bring a civil action against an entity that is subject to an FTC cease-and-desist order if a "reasonable man would have known" that the conduct described in the order was dishonest or fraudulent. Courts may provide a broad range of relief in these actions: Section 19(b) permits courts to "grant such relief as the court finds necessary to redress injury to consumers." By contrast, actions for civil penalties under Section 5(l) or 5(m) limit recovery to a specified inflation-adjusted amount per violation ($46,517 as of 2022).
• Under Section 13 of the FTC Act, the FTC may bring an action for an injunction in federal district court when the agency has "reason to believe" that an entity is "violating, or is about to violate," any law enforced by the FTC. For many years, the FTC relied on its authority under Section 13 to seek monetary relief against first-time violators. The Supreme Court disallowed this practice in AMG Capital Management, LLC v. FTC, 141 S. Ct. 1341 (2021). This case is discussed in more detail in CRS Legal Sidebar LSB10596, AMG Capital Management v. FTC: Supreme Court Holds FTC Cannot Obtain Monetary Relief in Section 13(b) Suits, by Chris D. Linebaugh.

Conduct That Violates a TRR or Federal Statute

• Section 5(m) permits the FTC to recover civil penalties from any entity that violates a TRR if the entity has "actual knowledge or knowledge fairly implied on the basis of objective circumstances" that its conduct is prohibited by a TRR.
• Under Section 19(a)(1), the FTC may bring a civil action against any entity that violates a TRR. The same relief is available in these actions as in those brought under Section 19(a)(2), discussed above. In contrast to actions for civil penalties, the agency may bring a civil action for monetary relief under Section 19(a)(1) regardless of the offending party's knowledge.

The FTC has rarely used its TRR authority to define UDAPs. The agency does, however, enforce several federal statutes that treat statutory violations as violations of a TRR. Some statutes, such as the Children's Online Privacy Protection Act (COPPA), also permit the FTC to issue regulations using the APA's procedures rather than the distinct procedures for TRRs. The rulemaking authority granted by these statutes is typically limited.

Considerations for Congress

The tools available to the FTC may be important if Congress wishes the agency to enforce new consumer protection laws. Many legislative proposals to protect consumer data privacy vest enforcement authority in the FTC, such as the American Data Privacy and Protection Act, H.R. 8152, 117th Cong. (2022). Rather than provide a specific enforcement scheme, enacted and proposed legislation may instead provide that violations of the legislation shall be enforced as violations of Section 5.

The FTC has limited authority to seek monetary relief against entities who are not subject to existing FTC cease-and-desist orders. If the FTC believes an entity has engaged in a UDAP, but the entity's conduct does not violate a TRR or an existing FTC order, the agency must determine in an administrative proceeding that the conduct is a UDAP and must issue a cease-and-desist order before it may seek any monetary relief. When granting new enforcement authority to the FTC, one question may be whether Congress wishes to permit the agency to seek penalties or other monetary relief against first-time violators.

Some proposals would provide that a violation of the law be treated as a violation of a TRR—doing so would allow the agency to seek civil penalties without first obtaining a cease-and-desist order. Another approach may be to modify the agency's authority. For example, the Consumer Protection and Recovery Act, H.R. 2668, 117th Cong. (2021), would expressly authorize the agency to seek permanent injunctions and pursue equitable relief in areas within its jurisdiction in addition to the temporary injunctions the agency may currently pursue under Section 13.