November 2022

The Federal Trade Commission today announced it is extending by six months the deadline for companies to comply with some of the changes the agency implemented to strengthen the data security safeguards financial institutions must put in place to protect their customers’ personal information. The deadline for complying with some of the updated requirements of the Safeguards Rule is now June 9, 2023.

The Safeguards Rule requires non-banking financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, to develop, implement, and maintain a comprehensive security program to keep their customers’ information safe.

The Commission is extending the deadline based on reports, including a letter from the Small Business Administration’s Office of Advocacy, that there is a shortage of qualified personnel to implement information security programs and that supply chain issues may lead to delays in obtaining necessary equipment for upgrading security systems. These difficulties were exacerbated by the COVID-19 pandemic. These issues may make it difficult for financial institutions, especially small ones, to come into compliance by the deadline.

The FTC approved changes to the Safeguards Rule in October 2021 that include more specific criteria for what safeguards financial institutions must implement as part of their information security programs. While many provisions of the rule went into effect 30 days after publication of the rule in the Federal Register, other sections of the rule were set to go into effect on December 9, 2022. The provisions of the updated rule specifically affected by the six-month extension include requirements that covered financial institutions:

• designate a qualified individual to oversee their information security program,
• develop a written risk assessment,
• limit and monitor who can access sensitive customer information,
• encrypt all sensitive information,
• train security personnel,
• develop an incident response plan,
• periodically assess the security practices of service providers, and
• implement multi-factor authentication or another method with equivalent protection for any individual accessing customer information.

The Commission vote to extend the deadline was 4-0.  Commissioner Wilson issued a separate statement.

The Federal Trade Commission is sending payments totaling more than $9.8 million to consumers who were harmed by Illinois-based Napleton Automotive Group’s junk fees and discriminatory practices.

The agency is sending 66,355 checks, averaging $147 each. Recipients should cash checks within 90 days. Consumers who have questions about their refund should call the refund administrator, Epiq, at 1-888-691-6050. The Commission never requires people to pay money or provide account information to get a refund.

The FTC and the State of Illinois sued Napleton Automotive Group in March 2022, alleging that Napleton employees were sneaking illegal junk fees for unwanted “add-ons” onto vehicle purchases and discriminating against Black consumers. According to the joint complaint, eight of the company’s dealership illegally tacked on junk fees for unwanted “add-on” products such as payment insurance and paint protection, costing consumers hundreds or even thousands of dollars. The complaint also alleged that Napleton discriminated against Black consumers by charging them more for add-ons and financing.

The Commission’s interactive dashboards for refund data provide a state-by-state breakdown of refunds in FTC cases. In 2021, Commission actions led to more than $472 million in refunds to consumers across the country, but these refunds were the result of cases resolved before the U.S. Supreme Court ruled in 2021 that the Commission lacks authority under Section 13(b) to seek monetary relief in federal court. Because of that ruling, the Commission no longer has its strongest tool to return money to consumers, and it will become harder to provide refunds to consumers harmed by deceptive and unfair conduct. The Commission has urged Congress to restore its ability to get money back for consumers.

The Federal Trade Commission is sending payments totaling more than $830,300 to 1,376 people who began their enrollment at Saint James School of Medicine between Fall 2016 and Summer 2021. The for-profit medical school in the Caribbean and its Illinois-based operators allegedly misled prospective students about their chances of success—both in passing a medical school standardized test and in matching with a residency program after graduation.

In April 2022, the FTC took action against Saint James and its operators, alleging that since at least April 2018, the medical school lured students with false guarantees of student success.  According to the complaint, in sales calls, marketing materials, and presentations, the defendants deceived consumers with false claims of very high pass rates for a critical medical school standardized test, the United States Medical Licensing Examination Step 1 Exam. In reality, the pass rate was only 35 percent. Additionally, the defendants claimed Saint James students’ residency match rates were “the same” as American medical schools. However, since 2017, their match rates have been approximately 20 percent lower than advertised.

In the final order with the FTC, Saint James and its operators were ordered to pay money towards refunds and cancel certain debts for students harmed by the deceptive marketing. They were also banned from misrepresenting their test pass rate or residency match rate or making any other unsubstantiated claims. They were also required to notify consumers whose debts were canceled.

The Federal Trade Commission has stopped internet phone service provider Vonage from imposing junk fees and creating obstacles to those who try to cancel their service. The FTC alleges that the company used dark patterns to make it difficult for consumers to cancel and often continued to illegally charge them even after they spoke to an agent directly and requested cancellation. Under the proposed court order, Vonage will be required to pay $100 million in refunds to consumers harmed by the company’s actions, make its cancellation process simple and transparent, and stop charging consumers without their consent.

“Today the FTC delivers on our commitment to protect consumers from illegal dark pattern tactics by companies that prevent consumers from cancelling their services,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “This record-breaking settlement should remind companies that they must make cancellation easy or face serious legal consequences.”

New Jersey-based Vonage, a subsidiary of Ericsson, provides internet-based telephone services (commonly known as Voice over Internet Protocol, or VoIP) to consumers and small business. According to the FTC’s complaint, the company bills their customers for these services on an automatic basis every month, either by charging a credit or debit card or withdrawing money from a customer’s bank account directly. Consumer accounts ranged from $5 to around $50 each month, while business accounts could cost up to thousands of dollars each month. In many cases, the company signs customers up using “negative option” plans that begin with a free trial, but require the customer to take action to avoid being charged.

The FTC’s complaint alleges that while Vonage has provided numerous ways to easily sign up for their plans, it has made the cancellation process markedly more difficult, leaving consumers and businesses on the hook for services they no longer want. Vonage’s practices, the complaint alleges, harmed consumers in numerous ways, specifically by:

• Eliminating cancellation options: Despite allowing its customers to sign up for services online, over the phone, and through other venues, the complaint alleges that starting in 2017, Vonage made the decision to force customers to cancel only by speaking to a live “retention agent” on the phone. The complaint notes that this practice runs counter to Vonage’s own advice to its clients not to “frustrate customers by requiring them to contact you for support that should be available on a self-service basis” and that “[i]t should be just as easy to return your product as it is to buy it.”

• Making cancellation process difficult: In addition to forcing customers into one cancellation method, it made that method difficult. The company created significant cancellation hurdles, including by making it difficult to find the phone number on the company website, not consistently transferring customers to that number from the normal customer service number, offering reduced hours the line was available and failing to provide promised callbacks. The complaint cites one internal Vonage email saying customers were “sent in a circle when they want to downgrade or remove the service.”

• Surprising customers with expensive junk fees when they tried to cancel: In many cases, customers who are able to access the cancellation line are told they will have to pay an unexpected early termination fee that was not clearly disclosed when they signed up for Vonage service. In some cases, these fees were in the hundreds of dollars.

• Continuing to charge customers even after they canceled: Customers who managed to speak to an agent and request cancellation often found that their accounts continued to be charged. Even when they contacted Vonage to complain, they received only partial refunds of the money they were charged without authorization.

Enforcement Action

As a result of the FTC’s action, Vonage has agreed to a proposed court order that would require it to:

• Stop unauthorized charges: Vonage will be required to have consumers’ express, informed consent to charge them.

• Simplify cancellation: Vonage will be required to put in place a simple cancellation process that is easy to find, easy to use, and will be available through the same method the consumer used to enroll (e.g., website, email address, or other application).

• Stop using dark patterns: The order prohibits Vonage from using dark patterns to frustrate consumers’ cancellation efforts.

• Be upfront with consumers about subscription plans: The order requires Vonage to be upfront with customers about the terms of any negative option subscription plans, including any action that must be taken to avoid being charged and timeline in which that action is required.

• Pay $100 million to be used for refunds: Vonage would be required to turn over $100 million to the FTC to be used to provide refunds to consumers.

The Commission vote authorizing the staff to file the complaint and proposed stipulated final order was 4-0. The FTC filed the complaint and proposed order in the U.S. District Court for the District of New Jersey.

NOTE: The Commission files a complaint when it has “reason to believe” that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest. Stipulated final orders have the force of law when approved and signed by the District Court judge.