On September 18, 2023, the Federal Trade Commission (FTC) published a Notice of Penalty Offenses Concerning Misuse of Information Collected in Confidential Contexts. In particular, the FTC highlighted that the Notice summarises particular acts or practices that are penalty offenses, considered deceptive or unfair under Section 5 of the Federal Trade Commission Act (FTC Act). Specifically, the Notice provides that such acts and practices include, with the exception of the individual providing affirmative express consent:

• using information collected in a context where an individual reasonably expects that such information will remain confidential for purposes not explicitly requested by the individual;
• using provided information to obtain a financial benefit that is separate from the benefit generated from providing the product or service requested by the individual; and
• using provided information to advertise, sell, or promote products or services.

In addition, the Notice stipulates that acts or practices considered in violation of the FTC Act include making false, misleading, or deceptive representations concerning the use or confidentiality of such information. Further, the Notice clarifies that the above practices are unlawful regardless of whether the information is disclosed to a third party or used internally to carry out the prescribed practices.

Practically, the Notice details that the FTC considers tracking technologies such as pixels, cookies, applied programming interfaces (APIs), or software development kits (SDKs) to amass, analyze, infer, and transfer information collected in a confidential context for the above-stated purposes. Similarly, the Notice establishes that the FTC considers it unfair or deceptive to misrepresent or omit material facts regarding the use of confidentiality of information collected in a confidential context through tracking technologies such as pixels, cookies, APIs, or SDKs.

The Notice reminds that affirmative express consent means a freely given, specific, informed, and unambiguous indication of an individual's wishes via a separate agreement.

Finally, the Notice provides that recipients of the Notice may incur penalties of $50,120 per violation if they misuse personal information counter to the original purpose for which the personal information was collected, as outlined above.

You can read the press release here and the Notice here.