Unfair or Deceptive Acts or Practices (UDAP) Enforcement Authority Under the Federal Trade Commission Act
November 4, 2022
Unfair or Deceptive Acts or Practices (UDAP) Enforcement
Authority Under the Federal Trade Commission Act
The Federal Trade Commission (FTC) is the principal
statement on unfairness. See CRS Report R44468,
agency responsible for enforcing federal consumer
General Policy Statements: Legal Overview, by Jared P.
protection laws. In addition to enforcing several specific
Cole and Todd Garvey for more information on policy
laws, the agency enforces Section 5 of the Federal Trade
statements.
Commission Act (15 U.S.C. § 45) against all U.S. persons,
partnerships, and corporations, subject to a few exceptions.
The agency may issue rules defining practices as
Section 5 identifies two categories of acts under the FTC’s
UDAPs. These rules are sometimes referred to as Trade
enforcement authority: “unfair or deceptive acts or practices
Regulation Rules (or TRRs). Unlike policy statements
in or affecting commerce” and “unfair methods of
or enforcement actions (see below), TRRs may create
competition.” The first of these provisions, frequently
legally binding obligations for all entities under the
referred to as the “UDAP” provision, provides the basis for
FTC’s jurisdiction. Section 18 of the FTC Act, as added
many of the FTC’s consumer protection actions when the
by the Magnusson-Moss Warranty Act, sets forth the
agency lacks more specific statutory authority.
agency’s required rulemaking process for designating a
practice a UDAP by TRR. This process differs from the
The FTC has used its UDAP authority to pursue objectives
rulemaking process set forth in the Administrative
not explicitly granted to the agency by statute, including
Procedure Act (APA) (5 U.S.C. § 553) in several ways,
policing commercial entities’ data privacy and
such as requiring that the agency publish an advance
cybersecurity practices. Although the FTC has express
notice of proposed rulemaking and permitting interested
statutory authority relating to privacy and cybersecurity in
persons an opportunity for an informal hearing. See
certain situations, its UDAP authority underpins many of
CRS Report R45631, Data Protection Law: An
the agency’s enforcement actions, including a complaint
Overview, by Stephen P. Mulligan and Chris D.
against Facebook that resulted in a $5 billion civil penalty.
Linebaugh for more information on the use of TRR
This In Focus provides an overview of the FTC’s consumer
authority generally; see CRS Legal Sidebar LSB10839,
protection authority and the remedies available to the
FTC Considers Adopting Commercial Surveillance and
agency to enforce the UDAP provision.
Data Security Rules, by Chris D. Linebaugh, for a
discussion of how the FTC is considering using this
What is an Unfair or Deceptive Act or
authority to protect electronic consumer data.
Practice?
Section 5 does not define “unfair or deceptive acts or
The agency may pursue enforcement actions against
practices,” though it does set a limit on the FTC’s authority
entities it believes have behaved unfairly or deceptively.
to declare a practice unfair. Section 5(n) provides that a
Although these enforcement actions do not legally bind
practice is not “unfair” unless it “causes or is likely to cause
anyone other than the parties to the action, the FTC may
substantial injury to consumers which is not reasonably
pursue remedies against non-parties in certain situations
avoidable by consumers themselves and not outweighed by
discussed below. The FTC has statutory authority to
countervailing benefits to consumers or to competition.”
litigate its own enforcement actions, rather than being
Apart from this provision, the FTC has broad latitude to
represented by the U.S. Attorney General. In certain
declare acts or practices unlawful.
proceedings, the FTC shares enforcement authority with
the Attorney General and may litigate only if the agency
The FTC has a number of tools to declare particular acts or
gives written notification to the Attorney General and
practices UDAPs:
the Attorney General fails to act within 45 days.
The agency may issue policy statements or guidance.
Relief Available
Policy statements and guidance reflect the agency’s
The FTC may take several actions to address a potential
position and interpretation of particular legal terms but
UDAP. The agency has more enforcement options when the
are not legally binding. The FTC has issued policy
alleged UDAP violates a TRR or specific federal statute.
statements on both deception and unfairness. In its
policy statement on deception, the agency defines a
Conduct That Does Not Violate A TRR or Statute
deceptive act or practice as an act or practice that, when
The FTC may initiate an administrative proceeding
considered from the perspective of a reasonable
pursuant to Section 5(b) of the FTC Act. Section 5(b)
consumer, is both likely to mislead and “material” (i.e.,
the act or practice is likely to influence a consumer’s
proceedings allow the FTC to seek a cease-and-desist
order against a person or entity that has committed a
choice regarding a product). Section 5(n) of the FTC
UDAP. Proceedings under Section 5(b) are adjudicated
Act discussed above partially codified the FTC’s policy
https://crsreports.congress.gov
Unfair or Deceptive Acts or Practices (UDAP) Enforcement Authority Under the Federal Trade Commission Act
before an Administrative Law Judge (ALJ), and the
“actual knowledge or knowledge fairly implied on the
person or entity charged with committing a UDAP has
basis of objective circumstances” that its conduct is
an opportunity to respond to the FTC’s allegations
prohibited by a TRR.
before the ALJ. A cease-and-desist order issued under
Section 5(b) may be challenged in a federal appeals
Under Section 19(a)(1), the FTC may bring a civil
court. When issuing a cease-and-desist order, the FTC
action against any entity that violates a TRR. The same
may require corrective action beyond simply refraining
relief is available in these actions as in those brought
from the unlawful conduct. Cease-and-desist orders
under Section 19(a)(2), discussed above. In contrast to
may, for example, require violators to engage in
actions for civil penalties, the agency may bring a civil
corrective advertising.
action for monetary relief under Section 19(a)(1)
regardless of the offending party’s knowledge.
If the agency has previously issued an order against the
party, the agency may seek civil penalties in federal
The FTC has rarely used its TRR authority to define
district court for violations of the order under Section
UDAPs. The agency does, however, enforce s everal federal
5(l) of the FTC Act. Many of the FTC’s cybersecurity
statutes that treat statutory violations as violations of a
enforcement actions, such as its $5 billion penalty
TRR. Some statutes, such as the Children’s Online Privacy
assessed against Facebook, seek penalties for violations
Protection Act (COPPA), also permit the FTC to issue
of FTC orders. Pursuant to Section 5(m), the FTC may
regulations using the APA’s procedures rather than the
also recover civil penalties for violations of cease-and-
distinct procedures for TRRs. The rulemaking authority
desist orders by non-parties if the offending party has
granted by these statutes is typically limited.
actual knowledge that their conduct was unfair or
deceptive and was unlawful under Section 5 of the FTC
Considerations for Congress
Act. The FTC and the Department of Justice (DOJ)
The tools available to the FTC may be important if
share authority over these proceedings, so the FTC must
Congress wishes the agency to enforce new consumer
notify the DOJ before pursuing civil penalties. Once
protection laws. Many legislative proposals to protect
notified, the Attorney General has 45 days to initiate a
consumer data privacy vest enforcement authority in the
proceeding. Consequently, civil penalty proceedings are
FTC, such as the American Data Privacy and Protection
frequently initiated by the Department of Justice.
Act, H.R. 8152, 117th Cong. (2022). Rather than provide a
specific enforcement scheme, enacted and proposed
Under Section 19(a)(2) of the FTC Act, the agency may
legislation may instead provide that violations of the
bring a civil action against an entity that is subject to an
legislation shall be enforced as violations of Section 5.
FTC cease-and-desist order if a “reasonable man would
have known” that the conduct described in the order was
The FTC has limited authority to seek monetary relief
dishonest or fraudulent. Courts may provide a broad
against entities who are not subject to existing FTC cease-
range of relief in these actions: Section 19(b) permits
and-desist orders. If the FTC believes an entity has engaged
courts to “grant such relief as the court finds necessary
in a UDAP, but the entity’s conduct does not violate a TRR
to redress injury to consumers.” By contrast, actions for
or an existing FTC order, the agency must determine in an
civil penalties under Section 5(l) or 5(m) limit recovery
administrative proceeding that the conduct is a UDAP and
to a specified inflation-adjusted amount per violation
must issue a cease-and-desist order before it may seek any
($46,517 as of 2022).
monetary relief. When granting new enforcement authority
to the FTC, one question may be whether Congress wishes
Under Section 13 of the FTC Act, the FTC may bring an to permit the agency to seek penalties or other monetary
action for an injunction in federal district court when
relief against first-time violators.
the agency has “reason to believe” that an entity is
“violating, or is about to violate,” any law enforced by
Some proposals would provide that a violation of the law be
the FTC. For many years, the FTC relied on its authority
treated as a violation of a TRR—doing so would allow the
under Section 13 to seek monetary relief against first-
agency to seek civil penalties without first obtaining a
time violators. The Supreme Court disallowed this
cease-and-desist order. Another approach may be to modify
practice in AMG Capital Management, LLC v. FTC, 141
the agency’s authority. For example, the Consumer
S. Ct. 1341 (2021). This case is discussed in more detail
Protection and Recovery Act, H.R. 2668, 117th Cong.
in CRS Legal Sidebar LSB10596, AMG Capital
(2021), would expressly authorize the agency to seek
Management v. FTC: Supreme Court Holds FTC
permanent injunctions and pursue equitable relief in areas
Cannot Obtain Monetary Relief in Section 13(b) Suits,
within its jurisdiction in addition to the temporary
by Chris D. Linebaugh.
injunctions the agency may currently pursue under Section
13.
Conduct That Violates a TRR or Federal Statute
Section 5(m) permits the FTC to recover civil penalties Eric N. Holmes, Legislative Attorney
from any entity that violates a TRR if the entity has
IF12244
https://crsreports.congress.gov
Unfair or Deceptive Acts or Practices (UDAP) Enforcement Authority Under the Federal Trade Commission Act
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permissio n of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF12244 · VERSION 1 · NEW