December 2022

The Federal Trade Commission is ordering an end to illegal business tactics that Mastercard has been using to force merchants to route debit card payments through its payment network, and is requiring Mastercard to stop blocking the use of competing debit payment networks.

Under a proposed FTC order, Mastercard will have to start providing competing networks with customer account information they need to process debit payments, reversing a practice the company allegedly had been using to keep them out of the ecommerce debit payment business and, according to the FTC, that violated provisions of the 2010 Dodd-Frank Act known as the Durbin Amendment and its implementing rule, Regulation II.

“This is a victory for consumers and the merchants who rely on debit card payments to operate their businesses,” said Holly Vedova, Director of the FTC’s Bureau of Competition. “Congress directed the FTC to enforce this part of the Dodd-Frank Act and prevent precisely this kind of illegal behavior. We take this responsibility seriously, as demonstrated by our action today.”

Debit Card Payment Networks

With more than 80 percent of American adults carrying at least one debit card and over $4 trillion in debit card purchases made every year, debit cards occupy a significant place in the current payment landscape. The popularity of debit cards has been growing especially quickly for purchases consumers make using their personal devices equipped with ewallet applications such as Apple Pay, Google Pay, and Samsung Wallet.

Payment card networks play a critical role in those debit card transactions. When a customer presents their debit card to make a purchase, the network transmits the payment information to the card’s corresponding bank for approval, and then transfers the payment approval or denial back to the merchant. Payment card networks compete for the business of banks that issue cards and for the business of merchants that accept card payments.

Mastercard, along with Visa, is one of the two leading payment card networks in the United States. The processing fees charged by networks total billions of dollars every year, affecting every purchase made with a debit card, according to the FTC. Most of these fees are paid by the merchants to the card-issuing banks and the payment card networks.

To spur more competition among payment card networks, Congress enacted a provision of the 2010 Dodd-Frank Act known as the Durbin Amendment, which required banks to enable at least two unaffiliated networks on every debit card, thereby giving merchants a choice of which network to use for a given debit transaction. The Durbin Amendment—along with its implementing rule, Regulation II—also bars payment card networks from inhibiting merchants from using other networks.

Mastercard’s Illegal Tactics

With the post-Durbin rise of debit ecommerce and ewallet debit transactions, Mastercard was flouting the law by setting policies to block merchants from routing ecommerce transactions using Mastercard-branded debit cards saved in ewallets to alternative payment card networks, including networks that may charge lower fees than Mastercard, the FTC alleged.

Specifically, Mastercard used its control over a process called “tokenization” to block the use of competing payment card networks, the agency alleged. Transactions commonly are “tokenized” by replacing the cardholder’s primary account number with a different number to protect the account number during some stages of a debit transaction.

Tokens are stored in ewallets such as Apple Pay, Google Pay, and Samsung Wallet and serve as a substitute credential to provide additional protection for a cardholder’s account number.

When a debit cardholder makes a debit purchase using an ewallet, the merchant receives a token from the cardholder’s device and sends it to the merchant’s bank, which in turn sends the token to a payment card network for processing. For the transaction to proceed, however, the network must be able to convert the token to its associated account number.

Mastercard’s policy requires use of a token when a cardholder loads a Mastercard-branded debit card into an ewallet, while banks issuing Mastercard-branded debit cards nearly universally use Mastercard to generate the tokens and store the corresponding primary account numbers in its Mastercard “token vault,” the FTC alleged. Since competing networks do not have access to Mastercard’s token vault, merchants are dependent on Mastercard’s converting the token to process ewallet transactions using Mastercard-branded debit cards.

According to the FTC, Mastercard refuses to provide conversion services to competing networks for remote ewallet debit transactions (i.e., online and in-app transactions, as opposed to in-person transactions made by the customer in a store), thereby making it impossible for merchants to route their ewallet transactions on a network other than Mastercard.

Under the FTC consent order, when a competing network receives a token to process a debit card payment, Mastercard is required to provide them with the customer’s personal account number that corresponds to the token. The order also bans Mastercard from taking any action to prevent competitors from providing their own payment token service or offer tokens on Mastercard-branded debit cards and requires Mastercard to comply with provisions of Regulation II.

The Commission vote to issue the administrative complaint and to accept the consent agreement was 4-0. The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment, after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments appear in the published notice. Comments must be received 30 days after publication in the Federal Register. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $46,517.

The Federal Trade Commission has voted to extend the public comment period for its advanced notice of proposed rulemaking on changes to the Funeral Rule to January 17, 2023. A number of commenters requested that the FTC extend the current deadline due to the holiday season. Information on how to submit comments can be found in the Federal Register notice.

In October 2022, the FTC announced that after a rule review, it would retain the Funeral Rule and issued an Advance Notice of Proposed Rulemaking concerning potential amendments to the rule, including whether and how funeral providers should be required to display or distribute their price information online and through electronic means.

The Commission vote approving the public comment period extension was 4-0.

On October 22, 2022, the Federal Trade Commission announced it is seeking public comments on whether it should explore a rule regarding the harms caused by junk fees and the unfair or deceptive tactics companies use to impose them. Junk fees are unnecessary, unavoidable, or surprise charges that inflate costs while adding little to no value for consumers. The notice announcing this initiative was published in the Federal Register on November 8.

At the request of interested persons, the Commission has extended the public comment period until February 8, 2023. Information about how to submit comments can be found in the Federal Register notice.

The Commission vote approving extension of the public comment period was 4-0.

The Federal Trade Commission’s Bureau of Consumer Protection today announced the issuance of Health Products Compliance Guidance, the agency’s first revision of its business guidance in this area in nearly 25 years.

The revised business guide represents a substantial update to the staff’s 1998 guide, Dietary Supplements: An Advertising Guide For Industry. Since that guide was issued, the FTC has brought more than 200 cases challenging false or misleading advertising claims for dietary supplements, foods, over-the-counter drugs, and other health-related products. The revised guide draws on those cases with 23 new examples.

One major revision is to extend the guidance covering dietary supplements to all health-related products. The revised guide also reflects updates to other FTC guidance documents, including the guidance on endorsements and testimonials and the enforcement policy statement on homeopathic drugs.

Among other things, the new guide includes a much more detailed discussion of the amount and type of evidence needed to substantiate health-related claims, with more emphasis on the fact that the FTC, as a general rule, expects high quality randomized, controlled human clinical trials.

The Federal Trade Commission has secured agreements requiring Epic Games, Inc., creator of the popular video game Fortnite, to pay a total of $520 million in relief over allegations the company violated the Children’s Online Privacy Protection Act (COPPA) and deployed design tricks, known as dark patterns, to dupe millions of players into making unintentional purchases.

The FTC’s action against Epic involves two separate record-breaking settlements. As part of a proposed federal court order filed by the Department of Justice on behalf of the FTC, Epic will pay a $275 million monetary penalty for violating the COPPA Rule—the largest penalty ever obtained for violating an FTC rule. Additionally, in a first-of-its-kind provision, Epic will be required to adopt strong privacy default settings for children and teens, ensuring that voice and text communications are turned off by default. Under a separate proposed administrative order, Epic will pay $245 million to refund consumers for its dark patterns and billing practices, which is the FTC’s largest refund amount in a gaming case, and its largest administrative order in history.

“As our complaints note, Epic used privacy-invasive default settings and deceptive interfaces that tricked Fortnite users, including teenagers and children,” said FTC Chair Lina M. Khan. “Protecting the public, and especially children, from online privacy invasions and dark patterns is a top priority for the Commission, and these enforcement actions make clear to businesses that the FTC is cracking down on these unlawful practices.”

“The Justice Department takes very seriously its mission to protect consumers’ data privacy rights,” said Associate Attorney General Vanita Gupta. “This proposed order sends a message to all online providers that collecting children’s personal information without parental consent will not be tolerated.”

Epic’s video game Fortnite is generally free to download and play but charges users for in-game items such as costumes and dance moves. The game has more than 400 million users worldwide. The FTC alleged in two separate complaints that North Carolina-based Epic engaged in several unlawful practices.

“Epic put children and teens at risk through its lax privacy practices, and cost consumers millions in illegal charges through its use of dark patterns,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “Under the proposed orders announced today, the company will be required to change its default settings, return millions to consumers, and pay a record-breaking penalty for its privacy abuses.”

Privacy Violations

In a complaint filed in federal court, the FTC alleged that Epic violated the COPPA Rule by collecting personal information from children under 13 who played Fortnite, a child-directed online service, without notifying their parents or obtaining their parents’ verifiable consent. Epic also violated the FTC Act’s prohibition against unfair practices by enabling real-time voice and text chat communications for children and teens by default. Specifically, the FTC alleged that Epic:

• Violated COPPA by Failing to Notify Parents, Obtain Consent: The FTC alleged that Epic was aware that many children were playing Fortnite—as shown through surveys of Fortnite users, the licensing and marketing of Fortnite toys and merchandise, player support and other company communications—and collected personal data from children without first obtaining parents’ verifiable consent. The company also required parents who requested that their children’s personal information be deleted to jump through unreasonable hoops, and sometimes failed to honor such requests.
• Default settings harm children and teens: Epic’s settings enable live on-by-default text and voice communications for users. The FTC alleges that these default settings, along with Epic’s role in matching children and teens with strangers to play Fortnite together, harmed children and teens. Children and teens have been bullied, threatened, harassed, and exposed to dangerous and psychologically traumatizing issues such as suicide while on Fortnite.

Epic employees expressed concern about its default settings. As early as 2017, Epic employees urged the company to change the default settings to require users to opt in for voice chat, citing concern about the impact on children in particular. Despite this and reports that children had been harassed, including sexually, while playing the game, the company resisted turning off the default settings. And while it eventually added a button allowing users to turn voice chat off, Epic made it difficult for users to find, according to the complaint.

In addition to paying the record civil penalty, which goes to the U.S. Treasury, for violating the COPPA Rule, the proposed federal court order will prohibit Epic from enabling voice and text communications for children and teens unless parents (of users under 13) or teenage users (or their parents) provide their affirmative consent through a privacy setting. Epic must delete personal information previously collected from Fortnite users in violation of the COPPA Rule’s parental notice and consent requirements unless the company obtains parental consent to retain such data or the user identifies as 13 or older through a neutral age gate. In addition, Epic must establish a comprehensive privacy program that addresses the problems identified in the FTC’s complaint, and obtain regular, independent audits.

The Commission voted 4-0 to refer the civil penalty complaint and proposed federal order to the Department of Justice. The DOJ filed the complaint and stipulated order in the U.S. District Court for the Eastern District of North Carolina. Commissioner Christine S. Wilson issued a separate statement.

NOTE: The Commission authorizes the filing of a complaint when it has “reason to believe” that the named defendant is violating or is about to violate the law and it appears to the Commission that a proceeding is in the public interest. Stipulated orders have the force of law when approved and signed by the District Court judge.

Illegal Dark Patterns

In a separate administrative complaint, the FTC alleged that Epic used dark patterns to trick players into making unwanted purchases and let children rack up unauthorized charges without any parental involvement. The complaint alleged that Epic:

• Used dark patterns to trick users into making purchases: The company has deployed a variety of dark patterns aimed at getting consumers of all ages to make unintended in-game purchases. Fortnite’s counterintuitive, inconsistent, and confusing button configuration led players to incur unwanted charges based on the press of a single button. For example, players could be charged while attempting to wake the game from sleep mode, while the game was in a loading screen, or by pressing an adjacent button while attempting simply to preview an item. These tactics led to hundreds of millions of dollars in unauthorized charges for consumers.
• Charged account holders without authorization: Children and other users who play Fortnite can purchase in-game content such as cosmetics and battle passes using Fortnite’s V-Bucks. Up until 2018, Epic allowed children to purchase V-Bucks by simply pressing buttons without requiring any parental or card holder action or consent. Some parents complained that their children had racked up hundreds of dollars in charges before they realized Epic had charged their credit card without their consent. The FTC has brought similar claims against companies such as Amazon, Apple, and Google for billing consumers millions of dollars for in-app purchases made by children while playing mobile app games without obtaining their parents’ consent.
• Blocked access to purchased content: The FTC alleged that Epic locked the accounts of customers who disputed unauthorized charges with their credit card companies. Consumers whose accounts have been locked lose access to all the content they have purchased, which can total thousands of dollars. Even when Epic agreed to unlock an account, consumers were warned that they could be banned for life if they disputed any future charges.

Epic ignored more than one million user complaints and repeated employee concerns that “huge” numbers of users were being wrongfully charged. In fact, Epic’s changes only made the problem worse, the FTC alleged. Using internal testing, Epic purposefully obscured cancel and refund features to make them more difficult to find.

As part of the proposed administrative order with the FTC over the company’s unlawful billing practices, Epic must pay $245 million, which will be used to provide refunds to consumers. In addition, the order prohibits Epic from charging consumers through the use of dark patterns or from otherwise charging consumers without obtaining their affirmative consent. The order also bars Epic from blocking consumers from accessing their accounts for disputing unauthorized charges.

The Commission voted 4-0 to issue the proposed administrative complaint and to accept the consent agreement with Epic related to its deceptive billing practices.

The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $46,517.

As a result of a Federal Trade Commission lawsuit, the operators of “The Credit Game,” a credit repair scheme that cost consumers millions of dollars, face a lifetime ban from the credit repair industry in proposed court orders filed today.

Michael and Valerie Rando and their companies, first sued by the FTC in May 2022, would also be required to turn over a wide array of property that would be liquidated and used to provide refunds to consumers harmed by the scam.

“These defendants falsely promised consumers improved credit based on tactics that were both illegal and ineffective,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “Our proposed orders will permanently ban these fraudsters from peddling deceptive credit repair tactics to struggling consumers.”

In its complaint against the Randos and their companies, the FTC alleged that the scheme’s operators provided false information to credit reporting agencies regarding consumers’ credit reports. Additionally, the Randos perpetuated the harm to consumers by pitching their customers a supposed business opportunity to create their own bogus credit repair scheme. The complaint also alleged that the scammers encouraged consumers to pay for the bogus services using COVID-19 tax relief funds, which the FTC alleged was a violation of the COVID-19 Consumer Protection Act.

The proposed court orders, which were agreed to by the defendants in the case, include a number of requirements:

• Permanent ban on credit repair: The Randos and their companies are permanently banned from operating or assisting any credit repair service of any kind.
• Prohibition against unsubstantiated claims: The orders would also prohibit the defendants from making claims about the benefits, performance, or efficacy of any good or service without sufficient supporting evidence. 
• Turn over possessions: The orders would require the defendants to turn over numerous properties, including: their interest in numerous real estate investments; a Lamborghini, Maserati, Land Rover, and a golf cart; and the contents of numerous bank, investment, and life insurance accounts. These assets will be liquidated by a court-appointed receiver and the funds used by the FTC to provide refunds to consumers harmed by the scam.

The orders contain a total monetary judgment of $18,875,613, which is partially suspended based on the defendants’ inability to pay the full amount. If the defendants are found to have lied to the FTC about the financial status, the full judgment would be immediately payable.

The Commission vote approving the stipulated final orders was 4-0. The FTC filed the proposed order in the U.S. District Court for the Middle District of Florida.

NOTE: Stipulated final orders or injunctions have the force of law when approved and signed by the District Court judge.

The Federal Trade Commission today announced that it is seeking public comment on potential updates and changes to the Green Guides for the Use of Environmental Claims. The Commission’s Green Guides help marketers avoid making environmental marketing claims that are unfair or deceptive under Section 5 of the FTC Act. The Commission seeks to update the guides based on increasing consumer interest in buying environmentally friendly products.

“Consumers are increasingly conscious of how the products they buy affect the environment, and depend on marketers’ environmental claims to be truthful,” said Bureau of Consumer Protection Director Samuel Levine. “We look forward to this review process, and will make any updates necessary to ensure the Green Guides provide current, accurate information about consumer perception of environmental benefit claims. This will both help marketers make truthful claims and consumers find the products they seek.”

The Green Guides were first issued in 1992 and were revised in 1996, 1998, and 2012. They provide guidance on environmental marketing claims, including how consumers are likely to interpret particular claims and how marketers can substantiate these claims to avoid deceiving consumers.

The FTC is requesting general comments on the continuing need for the guides, their economic impact, their effect on the accuracy of various environmental claims, and their interaction with other environmental marketing regulations. The Commission also seeks information on consumer perception evidence of environmental claims, including those not in the guides currently.

Specific issues on which the FTC expects to get many public comments include:

• Carbon Offsets and Climate Change: The current Guides provide guidance on carbon offset and renewable energy claims. The Commission invites comments on whether the revised Guides should provide additional information on related claims and issues.

• The Term “Recyclable:” Among other things, the FTC seeks comments on whether it should change the current threshold that guides marketers on when they can make unqualified recyclable claims, as well as whether the Guides should address in more detail claims for products that are collected (picked up curbside) by recycling programs but not ultimately recycled.

• The Term “Recycled Content:” Comments are requested on whether unqualified claims about recycled content – particularly claims related to “pre-consumer” and “post industrial” content – are widely understood by consumers, as well as whether alternative methods of substantiating recycled content claims may be appropriate; and

• The Need for Additional Guidance: The Commission also seeks comment on the need for additional guidance regarding claims such as “compostable,” “degradable,” ozone-friendly,” “organic,” and “sustainable, as well as those regarding energy use and energy efficiency.

A list of recent cases brought relating to topics covered by the guides can be found on the FTC’s website.

The Commission vote approving the publication of a Federal Register notice announcing the opening of the public comment period was 4-0, with Chair Lina M. Khan issuing a separate statement. The notice will be published in the Register in mid-January, 2023, after which the FTC will accept comments for 60 days. Information about how to submit comments can be found in the Federal Register notice.

On October 17, 2022, the Federal Trade Commission announced it is seeking public comments on whether it should propose updates to its Energy Labeling Rule to modernize and expand the rule’s coverage to reduce energy costs for consumers and require manufacturers to provide consumers with repair instructions. The notice announcing this initiative was published in the Federal Register on October 25.

At the request of several commenters, the commission has extended the public comment period until January 31, 2023. Information about how to submit comments can be found in the Federal Register notice.

The Commission vote approving the public comment period extension was 4-0.

After considering more than 800 public comments, the Federal Trade Commission has proposed updating its Ophthalmic Practice Rules, known as the Eyeglass Rule, to ensure ophthalmologists and optometrists provide patients with a copy of their prescription immediately after the completion of a refractive eye exam, get a signed statement from the patient confirming that they have received their prescription, and keep a record of that confirmation for at least three years.

“This rule is made to protect consumer choice by empowering them to decide where they fill their eyeglass prescriptions, yet too many prescribers are failing to give patients their prescriptions automatically,” said Samuel Levine, Director of the Bureau of Consumer Protection. “To remedy that and enforce the law we are proposing that prescribers now get a signed confirmation when they release prescriptions to their patients.”

Issued in 1978, the FTC’s Eyeglass Rule helps facilitate consumer choice and promote competition in the eyeglass market by requiring prescribers to provide patients with a copy of their eyeglass prescription immediately after an eye exam that includes a refraction, even if the patient does not request it.

Under the rule, prescribers also cannot require that patients buy eyeglasses as a condition of providing them with a copy of their prescription, place a liability waiver on the prescription, require patients to sign a waiver, or require patients to pay an additional fee in exchange for a copy of their prescription. Prescribers further cannot refuse to perform an eye exam unless the patient buys eyeglasses, contact lenses, or other ophthalmic goods from them.

In response to consumer complaints over the past several years, the FTC has sent warning letters to prescribers reminding them that they must provide patients with prescriptions at the end of an exam; cannot charge a fee or require eyeglass purchase for prescription release.

In the notice of proposed rulemaking announced today, the Commission is seeking comment on proposed measures that would:

• Require prescribers to request that each patient sign an acknowledgement confirming they have received their eyeglass prescription, and to retain such confirmation for three years;
• Allow prescribers, with a patient’s verifiable affirmative consent, to provide the patient with a digital copy of a prescription in lieu of a paper copy;
• Clarify that a patient’s proof of insurance coverage will be deemed to be a payment for the purpose of determining when a prescription must be provided; and
• Change the term “eye examination” to “refractive eye examination” throughout the rule.

The notice includes a preliminary regulatory analysis concluding that despite some increased costs from the confirmation retention requirement, the overall burden of the rule on prescribers would remain relatively small in the context of the total market for eyeglasses and refractive examinations.

The Commission also made a preliminary finding that the potential benefits of increasing the number of patients in possession of their eyeglass prescriptions are substantial. After the Commission reviews the comments received, it will decide whether to issue a final rule.

The Commission vote approving publication of the notice in the Federal Register was 4-0. It will be published in the Register in early January 2023, after which consumers can submit comments electronically or in writing for 60 days for Commission consideration.

Information for Consumers and Businesses

The FTC has information to help consumers understand their rights under federal law. See: Buying Prescription Glasses or Contact Lenses: Your Rights. Information to help businesses comply with the rule also is available.

As families from all generations spend time shopping online this holiday season, a new FTC data analysis shows that there’s at least one thing that will unite Gen Xers, millennials, and Gen Zers as they gather to exchange gifts.

The FTC’s latest Consumer Protection Data spotlight shows that consumers under the age of 60 are significantly more likely—86 percent—to report losing money to online shopping scams than older adults. According to the spotlight, based on data reported to the FTC for all of last year, consumers under 60 most often said those scams originated from posts on social media.

Unfortunately, online shopping is not the only scam where the post-Boomer generations found common ground. The spotlight also shows that adults under 60 are more than four times more likely than older adults to report losing money to an investment scam, and the majority of those losses happened in scams involving some form of cryptocurrency investments.

The full data spotlight is available at ftc.gov/dataspotlight. More information on how scams affect people older than 60 can be found in the FTC’s annual report to Congress on older adults.