Toolkit · Consumer Protection

The Consumer Protection and Credit Toolkit

15 U.S.C. § 45

Type
Toolkit
Jurisdiction
National
Date
2026-06-02
Topic
Consumer Protection

Consumer protection law is not one statute but a dozen overlapping regimes, each with its own regulator, its own private right of action, and its own statutory-damages multiplier. This toolkit maps the field pillar by pillar: the general prohibitions (FTC Act Section 5, CFPB UDAAP authority, and the state UDAP statutes), debt collection under the FDCPA and Regulation F, credit reporting and background checks under the FCRA, calls and texts under the TCPA, commercial email under CAN-SPAM, advertising and endorsement rules, negative-option and dark-pattern enforcement, arbitration clauses and class waivers in consumer contracts, privacy and data breach, and the Article III standing and class-action landscape that determines what any of it is worth. Each pillar gives you the plain-English doctrine, the anchor authority, the recurring traps, and links into the UpLaw guides and checklists that go deep. A running hypothetical — Kestrel Point Lending, a consumer installment lender that collects its own paper, pulls credit reports, texts borrowers, and emails offers — carries the analysis across every pillar so you can see how one business touches all of them at once. Use it as a map, not a substitute for the statute.

The Consumer Protection and Credit Toolkit

Consumer Protection > Consumer Protection | Published 2 June 2026 - Updated 30 June 2026 | UpLaw - uplaw.us

Almost every consumer-protection statute does the same three things: it forbids deception, it forbids abuse, and it attaches a number to each violation. The danger is never one number. It is the number multiplied by the size of your list.

Keywords: consumer protection, UDAP, UDAAP, FTC Act Section 5, CFPB, FDCPA, Regulation F, FCRA, TCPA, CAN-SPAM, Truth in Lending, dark patterns, arbitration clause, class waiver, statutory damages

How to read this toolkit

This is a resource map, not a treatise. It exists to answer one question quickly: given what my client is about to do to a consumer, which regimes fire, and where do I go next?

Read it three ways.

As a triage tool. Skim the "at a glance" table below, find the pillars that touch your facts, and read only those. A company that never calls anyone can skip Pillar 4 entirely. A company that calls, texts, emails, pulls credit, and collects its own past-due accounts — like the lender in our running example — cannot skip anything.

As a scoping tool. Each pillar tells you who enforces it, whether there is a private right of action, and what the statutory damages look like. Those three facts, together, tell you the shape of the exposure before you have read a single case. A regime with no private right of action (CAN-SPAM, the FTC Act itself) is a regulator problem. A regime with per-violation statutory damages and a plaintiffs' bar (TCPA, FCRA, FDCPA) is a class-action problem, and the arithmetic gets ugly fast.

As an index. Every pillar links to the UpLaw guides and checklists that treat the topic properly. The deep doctrine lives in Consumer Protection Law: A Comprehensive Guide to the FDCPA, FCRA, TCPA, and State UDAP Statutes. The task-level how-to lives in the checklists. This document is the table of contents that sits above both.

A structural note before you start. Federal consumer law is genuinely federal — the FDCPA, FCRA, TCPA, CAN-SPAM, TILA, and ECOA are acts of Congress, enforced by federal agencies, and litigated in federal court. UDAP is not. Every state has its own unfair-and-deceptive-practices statute, and they differ on the questions that matter most: whether reliance is required, whether the conduct must be public, whether damages are trebled, and whether a class action is even available. This toolkit teaches the framework and uses representative states — California, Massachusetts, New York, Texas, Florida — as illustrations. Confirm your own state's rule before you rely on any of it.

The same discipline applies to the adjacent bodies of law this toolkit does not cover. Insurance regulation is state law, administered by state insurance departments; there is no general federal insurance code, and nothing here should be read as stating a national insurance rule. Corporate governance — the fiduciary duties of the board that signs off on a compliance program, the standard of review for its decisions — is likewise state law, and Delaware is the reference point used throughout the UpLaw library, not a national standard binding on entities organized elsewhere. Where this document says "the rule is," it is speaking about federal consumer statutes. Where it says "many states" or "representative states," it means exactly that.

Meet the running example

Kestrel Point Lending, Inc. is a mid-sized online consumer installment lender. It advertises on social media, buys leads from comparison sites, uses influencers to promote a referral program, emails a monthly offer to a 400,000-address list, texts borrowers about upcoming due dates, pulls consumer reports to underwrite, runs background checks on the people it hires, and — because it never sold its paper — collects its own delinquent accounts through an in-house team. It also has a subscription "credit health" add-on that renews automatically, and its loan agreement contains an arbitration clause with a class waiver.

Kestrel Point touches every pillar in this toolkit. That is the point. It is not an unusual company; it is an ordinary one. We will return to it in each section.

The consumer-protection landscape at a glance

Pillar Core authority Who enforces Private right of action? Damages headline
1. General prohibitions FTC Act § 5, 15 U.S.C. § 45; CFPA, 12 U.S.C. §§ 5531, 5536; state UDAP statutes FTC, CFPB, state AGs No under the FTC Act; yes under most state UDAP statutes Civil penalties; restitution; state UDAP treble damages and fees
2. Debt collection FDCPA, 15 U.S.C. §§ 1692–1692p; Regulation F, 12 C.F.R. pt. 1006 CFPB, FTC, state AGs Yes $1,000 statutory per action + actual + fees; class cap = lesser of $500,000 or 1% net worth
3. Credit reporting FCRA, 15 U.S.C. §§ 1681–1681x; Regulation V, 12 C.F.R. pt. 1022 CFPB, FTC, state AGs Yes Willful: $100–$1,000 statutory + punitive + fees; negligent: actual + fees
4. Calls and texts TCPA, 47 U.S.C. § 227; 47 C.F.R. § 64.1200; Telemarketing Sales Rule, 16 C.F.R. pt. 310 FCC, FTC, state AGs Yes $500 per call/text; up to $1,500 if willful or knowing
5. Commercial email CAN-SPAM, 15 U.S.C. §§ 7701–7713; 16 C.F.R. pt. 316 FTC, state AGs, ISPs No (except ISPs) Civil penalties per message; aggravated violations enhanced
6. Advertising and negative option FTC Act § 5; Endorsement Guides, 16 C.F.R. pt. 255; ROSCA, 15 U.S.C. §§ 8401–8405; Lanham Act § 43(a) FTC, state AGs; competitors under Lanham Act No under FTC Act; yes for competitors under Lanham Act and for consumers under state UDAP Civil penalties; restitution; Lanham Act profits and damages
7. Arbitration and class waivers FAA, 9 U.S.C. §§ 1–16 Courts N/A — a defense, not a claim Determines whether all of the above is a class case or 10,000 individual ones
8. Privacy and breach GLBA, 15 U.S.C. §§ 6801–6809; Safeguards Rule, 16 C.F.R. pt. 314; state breach statutes; CCPA/CPRA FTC, CFPB, state AGs Varies by state Statutory damages under CCPA and BIPA; negligence and contract elsewhere
9. Standing and class exposure Article III; Fed. R. Civ. P. 23; CAFA, 28 U.S.C. § 1332(d) Courts N/A — the gate on everything above TransUnion v. Ramirez determines who is even in the class

Read the table honestly and you see the real risk map. Pillars 2, 3, and 4 are where the money is — they combine per-violation statutory damages with automated conduct that repeats across a whole customer list. Pillars 1, 5, and 6 are regulator-driven. Pillar 7 decides the forum. Pillar 9 decides who counts.

Pillar 1 — The general prohibitions: FTC Section 5, CFPB UDAAP, and state UDAP

The doctrine

Section 5 of the FTC Act, 15 U.S.C. § 45, declares "unfair or deceptive acts or practices in or affecting commerce" unlawful. It is the constitutional-scale provision of consumer law: intentionally open-textured, applicable to nearly every industry, and the ancestor of everything else in this toolkit.

  • Deception is a representation, omission, or practice that is likely to mislead a consumer acting reasonably under the circumstances, and that is material — i.e., likely to affect the consumer's conduct. Intent is not an element. Neither is reliance, nor actual harm.
  • Unfairness is codified at 15 U.S.C. § 45(n): an act is unfair if it causes or is likely to cause substantial injury to consumers that is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or competition. The Third Circuit confirmed in FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015), that unfairness reaches inadequate data security — which is why Pillar 8 is in this toolkit at all.

There is no private right of action under the FTC Act. Consumers cannot sue on Section 5. That is the single most important structural fact in Pillar 1, and it is why state UDAP statutes exist.

The CFPB's UDAAP authority adds a third adjective. Under the Consumer Financial Protection Act, 12 U.S.C. § 5531 and § 5536, the Bureau may act against unfair, deceptive, or abusive acts or practices by covered persons in consumer financial markets. "Abusive" is defined by statute: conduct that materially interferes with a consumer's ability to understand a term or condition, or that takes unreasonable advantage of a consumer's lack of understanding, inability to protect their interests, or reasonable reliance on the covered person to act in their interests. Abusiveness is the newest and least-settled of the three; it does not require deception, and it does not require that the consumer be misled at all. Note also 12 U.S.C. § 5552, which lets state attorneys general enforce the CFPA — federal standards, state enforcers.

State UDAP statutes are where private consumers actually sue. There are roughly fifty of them and they are not uniform. Representative examples:

  • California: the Unfair Competition Law, Cal. Bus. & Prof. Code § 17200 (unlawful, unfair, or fraudulent business acts — restitution and injunction only, no damages), the False Advertising Law, § 17500, and the Consumers Legal Remedies Act, Cal. Civ. Code § 1750 et seq. (actual damages, punitive damages, fees, and an enumerated list of prohibited practices).
  • Massachusetts: G.L. c. 93A — the muscular one. A written demand letter is a prerequisite; a willful or knowing violation, or an unreasonable refusal to settle in response to the demand, supports double or treble damages plus fees.
  • New York: Gen. Bus. Law §§ 349 and 350 — requires consumer-oriented conduct (not a purely private dispute), a materially misleading act, and injury; modest statutory minimums plus discretionary treble damages up to a cap.
  • Texas: the DTPA, Tex. Bus. & Com. Code § 17.41 et seq. — a "laundry list" of prohibited acts, a pre-suit notice requirement, and additional damages for knowing or intentional conduct.
  • Florida: FDUTPA, Fla. Stat. § 501.201 et seq. — tracks FTC standards by statutory command, actual damages plus fees, but no punitive damages.

The variation matters enormously: some states require reliance, some do not; some allow class actions, some (like Georgia and Alabama, in significant respects) restrict them; some cap or bar attorney's fees. Do not assume a nationwide rule. Identify the consumer's state, read that statute, and check whether the private remedy actually reaches your facts.

Kestrel Point at Pillar 1

Kestrel Point's homepage advertises "Rates from 5.9% APR." In practice, fewer than 2% of approved borrowers qualify for that rate. Nothing on the page is false. Under Section 5 and its state analogues, that does not save it: the net impression of the advertisement is what matters, and a rate that is functionally unavailable, presented as the headline, is likely to mislead a reasonable consumer on a material point. Fine print disclosing the qualifying criteria three scrolls down does not cure a misleading headline — the FTC's long-standing position, echoed in state UDAP case law, is that a disclosure must be clear and conspicuous and cannot contradict the main claim.

Where to go deeper

The trap

Remedies, not liability, is where the FTC fight is now. In AMG Capital Management, LLC v. FTC, 593 U.S. 67 (2021), the Supreme Court held that Section 13(b) does not authorize equitable monetary relief — no restitution, no disgorgement under that provision. The FTC's response has been to lean harder on Section 19 (15 U.S.C. § 57b), on rule violations that carry civil penalties, and on penalty-offense notices under § 5(m)(1)(B). If you are advising on FTC exposure, ask which vehicle the Commission would use, because the answer determines whether money is on the table at all.

Pillar 2 — Debt collection (FDCPA and Regulation F)

The doctrine

The Fair Debt Collection Practices Act, 15 U.S.C. §§ 1692–1692p, regulates the collection of consumer debts (personal, family, or household purpose) by debt collectors. Both limits are jurisdictional and both are constantly litigated.

Who is a "debt collector"? Section 1692a(6): one whose principal business is collecting debts, or who regularly collects debts owed to another. A creditor collecting its own debts in its own name is generally not a debt collector. In Henson v. Santander Consumer USA Inc., 582 U.S. 79 (2017), the Court held that a company that buys defaulted debt and collects for its own account is likewise not a debt collector merely by virtue of the debt's default status. Lawyers who regularly collect through litigation are covered: Heintz v. Jenkins, 514 U.S. 291 (1995).

The substantive prohibitions:

  • § 1692c — communications. No contact at an unusual or inconvenient time or place; before 8:00 a.m. or after 9:00 p.m. local time is presumed inconvenient. No contact at work if the collector knows the employer prohibits it. No contact once the consumer is represented by counsel. No third-party disclosure of the debt (§ 1692c(b)) beyond location information under § 1692b. And a written cease-communication request stops contact, full stop.
  • § 1692d — harassment or abuse. Threats of violence, obscenity, publishing a "deadbeat list," repeated calls intended to annoy.
  • § 1692e — false or misleading representations. The workhorse. Misstating the amount or character of the debt, falsely implying attorney involvement, threatening action that cannot legally be taken or is not intended.
  • § 1692f — unfair practices. Collecting amounts not authorized by contract or law; postcards; deceptive envelope markings.
  • § 1692g — validation. Within five days of the initial communication, the collector must send a validation notice; the consumer then has 30 days to dispute, and a timely dispute suspends collection until the debt is verified in writing.

Regulation F, 12 C.F.R. part 1006, effective November 30, 2021, put hard edges on the old standards. The greatest hits:

  • The 7-in-7 rule, § 1006.14(b)(2): a rebuttable presumption of harassment if a collector places more than seven calls in seven days about a particular debt, or calls within seven days of a telephone conversation about it.
  • The model validation notice, § 1006.34 — with an itemization date and an itemized breakdown. Using the model form is a safe harbor.
  • Limited-content messages, § 1006.6(d) — a defined voicemail script that is not a "communication," so it does not trigger the third-party-disclosure problem of a message overheard by a spouse.
  • Electronic communications, § 1006.6 — email and text are permitted, but require a reasonable opt-out mechanism in every message and procedures to address the risk of third-party disclosure.
  • Time-barred debt, § 1006.26 — a collector may not sue or threaten to sue on a debt it knows or should know is beyond the statute of limitations.

The standard of review is the "least sophisticated consumer" — an objective standard, protecting the naive but not the bizarre. The Seventh Circuit and a few others phrase it as the "unsophisticated consumer," which is slightly more demanding; the difference occasionally matters.

Remedies (§ 1692k): actual damages, statutory damages up to $1,000 per action (not per violation), and attorney's fees and costs to a prevailing consumer. Class recovery is capped at the lesser of $500,000 or 1% of the collector's net worth — which is precisely why FDCPA class actions so often settle for a number that looks small relative to the class size. There is a narrow bona fide error defense, § 1692k(c), but Jerman v. Carlisle, McNellie, Rini, Kramer & Ulrich LPA, 559 U.S. 573 (2010), holds it does not cover a mistake of law. The limitations period is one year, running from the violation rather than from discovery: Rotkiske v. Klemm, 589 U.S. 8 (2019) (declining to read a general discovery rule into § 1692k(d)).

Kestrel Point at Pillar 2

Kestrel Point collects its own loans, in its own name. On the federal statute, that likely means it is not a "debt collector" and the FDCPA does not directly apply. Counsel who stops there has made the classic mistake. Three things still bite:

  1. State mini-FDCPAs. Many states — California's Rosenthal Fair Debt Collection Practices Act (Cal. Civ. Code § 1788 et seq.) is the leading example — extend collection rules to original creditors. Kestrel Point is squarely covered in those states.
  2. UDAP and UDAAP. Abusive collection by a first-party creditor is still unfair or deceptive under Pillar 1, and Kestrel Point, as a consumer-finance company, is a CFPB "covered person" subject to § 5531.
  3. The vendor. The moment Kestrel Point places accounts with an outside agency, the agency is a debt collector, and Kestrel Point's exposure runs through its service-provider oversight obligations and through the representations the agency makes on its behalf.

Where to go deeper

Pillar 3 — Credit reporting and background checks (FCRA)

The doctrine

The Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x, governs consumer reports. It creates duties for three distinct actors, and the most common analytical error is applying the wrong actor's rules.

Consumer reporting agencies (CRAs) must follow reasonable procedures to assure maximum possible accuracy (§ 1681e(b)); must furnish reports only for a permissible purpose (§ 1681b) — credit, employment, insurance, a legitimate business need in connection with a transaction initiated by the consumer, and a short closed list of others; must reinvestigate disputes, generally within 30 days (§ 1681i); and must observe the obsolescence limits of § 1681c (most adverse items drop off at seven years; bankruptcies at ten).

Furnishers — anyone who reports data to a CRA — may not report information they know or have reasonable cause to believe is inaccurate, and, critically, must investigate disputes routed through the CRA (§ 1681s-2(b)). That subsection is the one with a private right of action. A furnisher's duty to a consumer who complains directly to the furnisher (§ 1681s-2(a)) is enforceable only by regulators. The practical consequence: a consumer who wants to sue a furnisher must first dispute through the credit bureau. Furnishers that ignore the resulting ACDV are writing the plaintiff's complaint for them.

Users of consumer reports must have a permissible purpose and must give adverse action notices (§ 1681m) when a report contributes to a denial or less-favorable terms — including the CRA's identity, a statement that the CRA did not make the decision, and the consumer's right to a free file disclosure and to dispute.

Employment background checks are a separate regime within the FCRA, and it is unforgiving:

  • A stand-alone written disclosure — a document consisting solely of the disclosure — plus the applicant's written authorization, before the report is pulled (§ 1681b(b)(2)). Burying the disclosure in an application, or adding a liability release to it, is the single most litigated FCRA employment defect.
  • A pre-adverse action notice with a copy of the report and the CFPB's Summary of Rights, then a reasonable waiting period, then the adverse action notice (§ 1681b(b)(3)).
  • And a parallel, independent obligation under Title VII and EEOC guidance not to use criminal-history screens in a way that produces unjustified disparate impact — plus a thick layer of state and municipal "ban the box" and fair-chance ordinances.

Remedies: for a willful violation, § 1681n gives actual or statutory damages of $100 to $1,000, punitive damages, and fees. Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), holds that willfulness includes reckless disregard — an objectively unreasonable reading of the statute — which is why an FCRA opinion letter is worth what it costs. For negligent violations, § 1681o gives actual damages plus fees.

Kestrel Point at Pillar 3

Kestrel Point is a user (it pulls reports to underwrite), a furnisher (it reports payment history to the bureaus), and an employer running background checks. Three hats, three rule sets.

Its exposure concentrates in the furnisher role. When a borrower pays off a loan and Kestrel Point's servicing system does not update the tradeline for 90 days, the borrower disputes through Equifax, the ACDV lands in a queue that Kestrel Point's vendor handles by "verifying as reported" without opening the account file — and that is a § 1681s-2(b) claim with a straight path to willfulness under Safeco, because a rubber-stamp reinvestigation is not a reasonable one. Multiply by every borrower whose payoff was mishandled, and you have a class.

Where to go deeper

Pillar 4 — Telemarketing, calls, and texts (TCPA and the DNC rules)

The doctrine

The Telephone Consumer Protection Act, 47 U.S.C. § 227, is the highest-yield consumer statute in the United States, for one reason: $500 per call or text, trebled to $1,500 for willful or knowing violations, with no cap and no requirement of actual damages. A campaign to 100,000 numbers is a $50 million pleading before you have said anything about intent.

Two distinct prohibitions, with two distinct consent standards:

§ 227(b) — the technology prohibition. No calls to a cell phone using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice without the required consent; no prerecorded telemarketing calls to residential lines without prior express written consent; and separate rules for junk faxes. Texts count as calls — the FCC and the courts have treated SMS as within § 227(b) for two decades.

  • For non-marketing calls (a fraud alert, a due-date reminder), prior express consent suffices, and giving the number in connection with the transaction generally supplies it.
  • For marketing calls, the FCC requires prior express written consent: a signed agreement, clearly and conspicuously disclosing that the consumer will receive autodialed or prerecorded marketing calls and that consent is not a condition of purchase.

Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), narrowed ATDS dramatically: to qualify, equipment must use a random or sequential number generator to store or produce the numbers it dials. Most modern list-based dialers are therefore not ATDS. That narrowed § 227(b) but did not empty the statute — prerecorded and artificial-voice calls remain covered regardless of the dialer, AI-generated voices have been declared "artificial" by the FCC, and the plaintiffs' bar simply migrated to § 227(c).

§ 227(c) — the Do-Not-Call prohibition. Implemented at 47 C.F.R. § 64.1200(c)–(d): no telemarketing calls to numbers on the National Do Not Call Registry; an internal DNC list and written policy are mandatory; calls only between 8:00 a.m. and 9:00 p.m. at the called party's local time; identification requirements. A consumer has a private right of action after receiving more than one call in a 12-month period in violation. Section 227(c) does not care what technology you used — it cares who you called.

The FTC's Telemarketing Sales Rule, 16 C.F.R. part 310, is the parallel regime: abandoned-call limits, disclosure requirements, an express-verifiable-authorization rule for certain payments, and the ban on advance fees for recovery services. It is enforced by the FTC and state AGs, not by consumers.

Two further points of live law: Barr v. American Association of Political Consultants, Inc., 591 U.S. 610 (2020), severed the government-debt-collection exception as an unconstitutional content-based restriction, leaving the rest of § 227(b) intact; and the FCC's 2023 "one-to-one consent" rule — which would have required separately signed consent for each seller in a lead-generation chain — was vacated by the Eleventh Circuit in early 2025 in Insurance Marketing Coalition Ltd. v. FCC (11th Cir. 2025), on the ground that the FCC had exceeded its authority to define "prior express consent" beyond its common-law meaning. (Because that decision and the Eighth Circuit's 2025 vacatur of the FTC's Negative Option Rule discussed in Pillar 6 are recent and still settling, confirm their current posture and any agency response before relying on either.) The lesson is not that lead-gen consent is safe. It is that the consent you rely on must actually name your client, because a checkbox consenting to calls from "our marketing partners" has never persuaded a court that consent was express.

Kestrel Point at Pillar 4

Kestrel Point's due-date reminder texts are transactional — sent to a number the borrower gave for account servicing, for a non-marketing purpose. Low risk under § 227(b), and § 227(c) does not reach non-telemarketing calls.

The problem is the message that says: "Payment due Friday. You may qualify for a rate reduction — reply YES to learn more." That single sentence converts a transactional text into a marketing text, which requires prior express written consent that Kestrel Point never obtained. Every borrower who got that message is a $500 claim. Every borrower who received it after texting STOP is a $1,500 claim.

The second problem is the purchased leads. Kestrel Point buys them from comparison sites and dials them. The consent is the lead vendor's, the disclosure named "partners," and Kestrel Point has never audited a single consent record. In litigation, Kestrel Point bears the burden of proving consent — and it cannot prove what it does not hold.

Where to go deeper

The rule to write on the wall: keep marketing and servicing on separate channels, separate consent records, and separate suppression lists. One promotional sentence in a transactional text is the most expensive sentence in consumer law.

Pillar 5 — Email marketing (CAN-SPAM)

The doctrine

CAN-SPAM, 15 U.S.C. §§ 7701–7713, and the FTC's implementing rule, 16 C.F.R. part 316, govern commercial electronic mail — messages whose primary purpose is commercial advertisement or promotion. Transactional or relationship messages (a receipt, a statement, a warranty notice) are largely exempt, but the primary-purpose test is a content test, not a labeling test: a "statement" whose real body is a cross-sell is a commercial message.

The obligations are few, mechanical, and violated constantly:

  • Accurate header information and originating domain — no spoofed From, no false routing.
  • A non-deceptive subject line that reflects the content of the message.
  • Identification as an advertisement, clearly and conspicuously (satisfiable in various ways, but it must be there).
  • A valid physical postal address for the sender.
  • A functioning opt-out mechanism, operative for at least 30 days after sending, and the opt-out must be honored within 10 business days. You may not charge for it, condition it on providing information beyond an email address, or require a login.
  • No transfer or sale of an opted-out address.
  • Aggravated violations — address harvesting, dictionary attacks, automated account creation, open-relay hijacking — carry enhanced exposure.

There is no consumer private right of action. Enforcement runs to the FTC, state attorneys general, and internet access services adversely affected (§ 7706(g)). CAN-SPAM preempts state email statutes except as to falsity or deception (§ 7707(b)) — which is exactly the carve-out that lets state UDAP claims and California's email statute survive against deceptive senders.

Do not mistake "no private right of action" for "low risk." FTC civil penalties accrue per message, and a per-message penalty against a 400,000-address list is not a rounding error. And critically: CAN-SPAM is an opt-out regime, but the rest of the world is not. If Kestrel Point emails anyone in the EU or the UK, GDPR/PECR consent rules apply; Canada's CASL is a strict opt-in regime with real penalties. CAN-SPAM compliance is a floor, not a passport.

Kestrel Point at Pillar 5

Kestrel Point's monthly offer email is plainly commercial. Its unsubscribe link routes to a preference center that requires the user to log in before opting out. That is a violation on its face: the opt-out must be usable by a recipient who has forgotten their password, lost their account, or never had one. Its second defect is timing — unsubscribes are processed in a weekly batch that, for someone who opts out on day one of the cycle, lands outside the 10-business-day window during a holiday week.

Neither defect requires a single misleading word. Both are enforceable.

Where to go deeper

Pillar 6 — Advertising, endorsements, dark patterns, and negative option

The doctrine

Everything a consumer-facing company says is governed by Pillar 1's deception standard. Four sub-regimes give that standard teeth.

Substantiation. Under long-settled FTC doctrine, an advertiser must possess a reasonable basis for an objective claim before it is disseminated. For health, safety, and efficacy claims, that means competent and reliable scientific evidence; and where the ad says "clinically proven," the advertiser must have exactly what it claimed to have. Lack of substantiation is itself a deceptive practice — the FTC need not prove the claim false.

Endorsements and influencers. The FTC's Endorsement Guides, 16 C.F.R. part 255, revised in 2023, require clear and conspicuous disclosure of material connections between an endorser and the advertiser — payment, free product, employment, family ties. The 2023 revisions broadened liability to reach advertisers, intermediaries, and endorsers, addressed fake and incentivized reviews, and made clear that a disclosure buried behind a "more" link or floating in a hashtag stack is not conspicuous. The companion Rule on the Use of Consumer Reviews and Testimonials targets fake reviews, review suppression, and undisclosed insider reviews with civil penalty exposure — a meaningful escalation, because rule violations produce penalties where bare § 5 violations, after AMG, may not.

Dark patterns and negative option. ROSCA — the Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401–8405 — requires, for any negative-option feature sold online: clear and conspicuous disclosure of all material terms before obtaining billing information, express informed consent, and a simple mechanism to cancel. The FTC's 2024 Negative Option ("click to cancel") Rule was vacated by the Eighth Circuit in 2025 on procedural grounds, but that vacatur did nothing to ROSCA, nothing to § 5, and nothing to the state auto-renewal statutes — California's Automatic Renewal Law, Cal. Bus. & Prof. Code § 17600 et seq., is the strict one, and several other states have followed. Design a cancellation flow with more friction than the sign-up flow and you will be explaining it to someone.

Competitor claims. Lanham Act § 43(a), 15 U.S.C. § 1125(a), gives a competitor — not a consumer — a false-advertising claim, with injunctions, damages, and disgorgement of the defendant's profits. POM Wonderful LLC v. Coca-Cola Co., 573 U.S. 102 (2014), confirms that FDA compliance does not immunize a label from a Lanham Act challenge. The competitor is often a faster and angrier enforcer than any agency.

Kestrel Point at Pillar 6

Kestrel Point pays micro-influencers in gift cards to post about its referral program. The posts say "#partner" at the end of a nine-hashtag block. That is not a clear and conspicuous disclosure, and under the 2023 Guides Kestrel Point is exposed for its influencers' posts — it recruited them, it paid them, and it never gave them disclosure instructions or monitored compliance.

Its "credit health" add-on auto-renews at $14.99/month after a free trial, disclosed in gray 10-point type below the fold. Cancellation requires a phone call during business hours. That is a ROSCA case and a California ARL case, and it is the kind of fact pattern that turns a regulatory inquiry into a class action.

Where to go deeper

Pillar 7 — Consumer contracts: arbitration clauses and class waivers

The doctrine

Pillars 2 through 6 all produce class actions. Pillar 7 is the defendant's answer.

Under the Federal Arbitration Act, 9 U.S.C. §§ 1–16, arbitration agreements are enforceable "save upon such grounds as exist at law or in equity for the revocation of any contract." The modern law is a string of Supreme Court decisions that, taken together, make a well-drafted consumer arbitration clause with a class waiver extremely likely to be enforced:

Where it still fails. Three places, reliably. Unconscionability remains a general contract defense and therefore survives preemption: a clause with a punitive fee-shifting provision, a distant forum, a shortened limitations period, or an exemption from arbitration for the drafter's likely claims (collections) but not the consumer's is a genuine target. Formation is the quiet killer — a "browsewrap" clause buried behind a footer link that no reasonable user would see was never agreed to, and no amount of FAA preference cures the absence of assent. And public injunctive relief: California's McGill v. Citibank, N.A., 2 Cal. 5th 945 (2017), holds that a contractual waiver of the right to seek public injunctive relief in any forum is unenforceable — a rule the Ninth Circuit has held is not FAA-preempted.

And the tactical reversal: mass arbitration. The plaintiffs' bar has learned to file thousands of individual demands at once, triggering per-case administrative fees that the drafting company agreed to pay. A clause designed to make claims disappear can instead produce an eight-figure filing-fee invoice before the merits are reached. The current drafting response — batching, bellwether procedures, mandatory pre-dispute mediation, fee-allocation terms — is itself now being tested for unconscionability. Note also: the CFPB's 2017 rule that would have barred class waivers in consumer financial contracts was nullified by Congress under the Congressional Review Act later that year. There is no federal ban.

Kestrel Point at Pillar 7

Kestrel Point's loan agreement has an arbitration clause with a class waiver. It has three defects. It carves out "collection actions brought by Lender" from arbitration while binding the borrower to arbitrate everything — a one-sided carve-out that is Exhibit A in an unconscionability argument. It requires arbitration in Kestrel Point's home county, 2,000 miles from most borrowers. And it purports to waive "all injunctive relief," which, as to California borrowers, runs straight into McGill and may take the entire clause down if the agreement has a non-severability clause.

Fix the clause and Kestrel Point's TCPA exposure collapses from a $50 million class case into a manageable stream of individual demands. Leave it broken and it defends the class.

Where to go deeper

Pillar 8 — Consumer privacy and data breach

The doctrine

Consumer data is regulated from four directions at once.

Sector-specific federal law. A consumer lender like Kestrel Point is a financial institution under the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809. That means an annual privacy notice, opt-out rights for certain sharing with nonaffiliated third parties, and — most importantly since the 2021 amendments — the FTC Safeguards Rule, 16 C.F.R. part 314, which mandates a written information security program, a qualified individual accountable for it, risk assessments, access controls, encryption of customer information in transit and at rest, multi-factor authentication, vendor oversight, and a written incident response plan. The Safeguards Rule also requires notice to the FTC of certain security events affecting 500 or more consumers.

General FTC unfairness. Wyndham established that unreasonable data security is an unfair practice under § 5 even absent any specific rule. That authority has not gone anywhere.

State comprehensive privacy law. The CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq., plus a growing roster of state analogues, confer rights of access, deletion, correction, and opt-out of sale/sharing and of targeted advertising. Note the GLBA carve-out: data subject to GLBA is generally exempt from the CCPA, but a lender's marketing-prospect and website-visitor data usually is not — which is why "we're GLBA-covered" is a dangerously incomplete answer.

State breach notification. All fifty states, plus D.C. and the territories, require notice to affected residents after unauthorized acquisition of defined categories of personal information. The triggers, timelines, content requirements, regulator-notice thresholds, and credit-monitoring mandates differ by state, and a national breach means running the same facts through fifty statutes on a clock. There is no federal general breach-notification statute.

And the growth area: private statutory-damages claims — Illinois's BIPA (740 ILCS 14) for biometric data, the Video Privacy Protection Act, 18 U.S.C. § 2710, for pixel-based video tracking, and state wiretap statutes (California's Invasion of Privacy Act, Cal. Penal Code § 631) repurposed against session-replay and chat-analytics tools. These claims share a signature: statutory damages without proof of harm, which is what makes them class fuel.

Kestrel Point at Pillar 8

Kestrel Point's marketing site runs a third-party advertising pixel that transmits the URL of the loan-product page along with a hashed email. In several states that is a plausible wiretap or session-replay claim; under the CCPA it is very likely a "sharing" for cross-context behavioral advertising that requires an opt-out link. And under the Safeguards Rule, the vendor that receives the data is a service provider whose security Kestrel Point is obligated to oversee — and never has.

Where to go deeper

A note on credit itself: TILA, ECOA, and the lending overlay

Before leaving the credit side, one more layer that a consumer-finance client cannot ignore, even though it is not a UDAP regime.

The Truth in Lending Act, 15 U.S.C. § 1601 et seq., and Regulation Z, 12 C.F.R. part 1026, require standardized disclosure of the finance charge and the annual percentage rate so that credit can be compared. TILA's core insight is that competition, not price control, disciplines credit — but only if the price is stated the same way by everyone. Regulation Z governs advertising of credit terms too: state a "trigger term" (a monthly payment amount, a down payment, a rate) and you must state the rest of the required terms with it. Section 1635 gives a right of rescission for certain loans secured by a principal dwelling — three business days, extending to three years if the required disclosures were never properly given. Section 1640 provides actual damages, statutory damages within statutory floors and ceilings, and fees, with class recovery capped at the lesser of $1,000,000 or 1% of the creditor's net worth.

Around TILA sit the rest of the consumer-credit regimes: the Equal Credit Opportunity Act, 15 U.S.C. § 1691, and Regulation B (no discrimination in any aspect of a credit transaction; an adverse action notice with specific reasons, generally within 30 days — and note that ECOA's notice and FCRA's § 1681m notice are different obligations that a well-built form satisfies together); the Electronic Fund Transfer Act and Regulation E (error resolution, unauthorized-transfer liability limits, and the rules on preauthorized transfers that ACH-debit lenders routinely violate); the Military Lending Act, 10 U.S.C. § 987 (36% MAPR cap, mandatory database check, and a ban on mandatory arbitration for covered borrowers — which is how Pillar 7 and the credit rules collide); the Servicemembers Civil Relief Act, 50 U.S.C. § 3901 et seq.; and the FTC's Holder Rule, 16 C.F.R. § 433.2, which preserves the consumer's claims and defenses against any assignee of consumer credit paper.

Kestrel Point's exposure here is quiet and structural. Its ad says "$199/month" — a trigger term — without the APR, the term, or the amount financed. Its ACH authorizations do not comply with Regulation E's preauthorized-transfer rules. And it has never run a single applicant through the MLA database, which means every servicemember loan in its book may be void and its arbitration clause unenforceable as to those borrowers. None of this is glamorous. All of it is examinable.

Pillar 9 — Standing, statutory damages, and class-action exposure

The doctrine

Everything above produces statutory damages without proof of harm. Article III asks whether that is enough. Since 2021, the answer is: often not.

Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) held that a bare procedural violation of the FCRA, divorced from any concrete harm, does not automatically confer standing — Congress can elevate intangible harms, but it cannot manufacture injury where none exists.

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) made that operational, and it is the most consequential consumer-class decision of the era. TransUnion's product falsely flagged consumers as potential terrorist-watchlist matches. The Court held:

  • "No concrete harm, no standing." A risk of future harm does not support damages (as opposed to injunctive relief) in a suit for money.
  • Class members whose misleading reports were actually disseminated to third parties had standing — the harm bore a close relationship to defamation. Class members whose reports sat in a database undisseminated did not.
  • And decisively: "Every class member must have Article III standing in order to recover individual damages." Standing is not established once for the named plaintiff and inherited by the class.

The consequences are everywhere in this toolkit. An FCRA class of consumers whose files were never pulled shrinks to those whose files were. A TCPA class survives easily — an unwanted call or text is an intrusion, closely related to the common-law tort of intrusion upon seclusion, and courts have consistently found it concrete. An FDCPA class turns on which provision was violated: a misleading letter the consumer read and acted on is concrete; a technical formatting defect the consumer never noticed increasingly is not, and several circuits have dismissed such claims post-Ramirez.

And note the strategic inversion. A defendant that removes a state-court consumer case to federal court under CAFA, 28 U.S.C. § 1332(d), and then wins on standing, does not win — the case is remanded to a state court that may have no standing requirement at all. Standing is a shield with a sharp edge on the handle. Think about the forum before you reach for it.

The arithmetic that drives settlement. Rule 23(b)(3) predominance is usually the real battlefield: if consent under the TCPA, or the content of the disclosure under the FCRA, varied across the class, individual issues swamp common ones. Where they did not vary — because the conduct was automated and identical — predominance is easy and the case is worth the statutory number times the class size. This is why the most valuable compliance dollar in consumer law is spent on the systems that behave identically toward everyone. Uniformity is efficient and it is also the thing that certifies the class.

Where to go deeper

The worked example, end to end: pricing Kestrel Point's exposure

A toolkit earns its keep when it turns a scattered set of regimes into a single number a general counsel can take to a board. Here is that exercise, run on the facts we have been carrying.

Step 1 — Inventory the conduct, not the statutes. Do not start from a list of acts of Congress. Start from what the business actually does to consumers, then map each act of conduct onto the pillars it triggers. Kestrel Point's inventory:

Conduct Volume Pillars triggered
"Rates from 5.9% APR" headline; "$199/month" ad Site-wide 1 (deception), 6 (substantiation), credit overlay (Reg Z trigger terms)
Marketing sentence inside due-date texts 62,000 borrowers 4 (TCPA — prior express written consent required)
Purchased leads dialed and texted 180,000 numbers 4 (consent Kestrel Point does not hold and cannot produce)
Monthly offer email; login-gated unsubscribe 400,000 addresses 5 (CAN-SPAM opt-out mechanism and 10-business-day rule)
Furnishing payoff data; rubber-stamped ACDVs ~3,000 mishandled payoffs 3 (FCRA § 1681s-2(b), willfulness under Safeco)
In-house collections Delinquent book 2 (state mini-FDCPAs; UDAAP), not the federal FDCPA
Influencer posts with buried "#partner" ~200 posts 6 (Endorsement Guides, 16 C.F.R. pt. 255)
"Credit health" auto-renewal, phone-only cancel Subscriber base 6 (ROSCA; California ARL)
Ad pixel transmitting page URL + hashed email Site-wide 8 (CCPA "sharing"; state wiretap/session-replay theories)
No MLA database checks Entire book Credit overlay (10 U.S.C. § 987)

Step 2 — Do the arithmetic, pillar by pillar. This is the step lawyers skip, and it is the only one the board understands.

  • TCPA (Pillar 4). 62,000 borrowers × $500 = $31 million floor on the marketing-text theory alone; treble to $1,500 for the subset who had already texted STOP. Add the 180,000 purchased leads and the pleaded number crosses $100 million. Kestrel Point bears the burden of proving consent and holds no consent records for the leads. This is the largest single exposure in the company, and it was created by one sentence a marketing manager added to a servicing template.
  • FCRA (Pillar 3). ~3,000 mishandled payoffs × $100–$1,000 willful statutory damages, plus punitive damages and fees. Call it $300,000 to $3 million before punitives — but the Safeco recklessness standard and a documented rubber-stamp process make punitives a live threat, and fee awards in FCRA cases routinely exceed the class recovery.
  • FDCPA (Pillar 2). Federally, near zero — Kestrel Point collects its own paper in its own name and is not a "debt collector" under § 1692a(6) after Henson. But the Rosenthal Act reaches original creditors in California, and UDAAP reaches the conduct everywhere. The federal number is small; the state and regulatory number is not.
  • CAN-SPAM (Pillar 5). No private right of action, so the class-action number is zero. The FTC civil-penalty number, assessed per message against a 400,000-address list, is not zero at all — and it is the kind of exposure that appears in a consent order rather than a verdict.
  • ROSCA and the ARL (Pillar 6). Restitution of subscription fees, plus civil penalties for rule violations, plus a state-law class where the ARL supplies statutory remedies.

Step 3 — Apply Pillar 9, and watch the number move. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), does real work here, and it cuts both ways.

  • The TCPA class survives. An unwanted text is an intrusion closely analogous to intrusion upon seclusion — concrete under Ramirez, and courts have said so repeatedly. The $31 million does not shrink on standing grounds.
  • The FCRA class shrinks. Every class member must have Article III standing to recover individual damages. Borrowers whose inaccurate tradeline was disseminated to a third party that pulled it have standing; borrowers whose file sat inaccurate but unpulled do not. If only 40% of the 3,000 were actually pulled, the recoverable class is 1,200, not 3,000.
  • And the strategic inversion matters: if Kestrel Point removes under CAFA and then wins on standing, it does not win — it gets a remand to a state court that may impose no standing requirement at all.

Step 4 — Apply Pillar 7, and watch it move again. A clean, mutual, assented-to arbitration clause with an express class waiver is enforceable under AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011), and converts the TCPA class from a single $31 million case into individual demands. Kestrel Point's clause is not clean: it carves out the lender's own collection actions, sits 2,000 miles from its borrowers, and purports to waive all injunctive relief in the teeth of McGill. As drafted, it is a liability, not a shield — and if the agreement lacks a workable severability provision, the McGill defect may take the entire clause down. Note too that the clause is unenforceable by statute as to covered borrowers under the Military Lending Act, which Kestrel Point has never screened for.

Step 5 — Rank the fixes by dollars-per-hour of legal work. The output of the exercise is a priority list, and it is rarely the list the compliance team expected:

  1. Delete the marketing sentence from the servicing text template. One afternoon. Removes the largest exposure in the company.
  2. Rewrite the arbitration clause — mutual, reasonable forum, express class waiver, deliberate severability, MLA carve-out, mass-arbitration protocol. One week. Changes the shape of every other item on this list.
  3. Fix the unsubscribe flow so it works without a login and processes within 10 business days. One sprint.
  4. Stop rubber-stamping ACDVs — require the file to be opened. Process change, not a legal one, and it is what converts a willful violation into a negligent one, or into none.
  5. Screen for MLA status at origination. A database call.
  6. Stop buying leads you cannot audit, or contract for consent records you can actually produce, with indemnity that means something.

Note what is not at the top: the influencer disclosures, the fine-print APR, the pixel. Those are real problems and they should be fixed. They are simply not where the money is. The point of a toolkit is to tell you which fire to put out first.

The landscape as a working checklist

Run this gate-by-gate. If any box is unchecked, that pillar is an open exposure.

Gate 1 — General prohibitions

  • [ ] Every objective claim, in every channel, has a reasonable basis documented before dissemination.
  • [ ] The net impression of each ad has been reviewed — not just the literal truth of each sentence.
  • [ ] Disclosures are clear and conspicuous and do not contradict the main claim.
  • [ ] You have identified which state UDAP statutes apply to your customer base and whether they permit class actions, require reliance, and award fees.

Gate 2 — Debt collection

  • [ ] You have determined whether you are a "debt collector" under § 1692a(6) — and, separately, whether your state's mini-FDCPA reaches original creditors.
  • [ ] Validation notices use the Regulation F model form with a correct itemization date.
  • [ ] Call frequency is governed against the 7-in-7 presumption; the dialer enforces it.
  • [ ] Time-barred debt is flagged and never sued on or threatened with suit.
  • [ ] Attorney representation, cease-communication requests, and electronic opt-outs are enforced system-wide, not agent-by-agent.
  • [ ] Your collection vendors are contractually bound to the same rules and audited against them.

Gate 3 — Credit reporting

  • [ ] Every report pull has a documented permissible purpose under § 1681b.
  • [ ] Adverse action notices issue for every declination and every less-favorable term — and satisfy both FCRA § 1681m and ECOA/Reg B.
  • [ ] As a furnisher, you have a real § 1681s-2(b) dispute-investigation process that opens the account file. No rubber stamps.
  • [ ] Employment background checks use a stand-alone disclosure with no liability release, and a genuine pre-adverse action waiting period.

Gate 4 — Calls and texts

  • [ ] Marketing and transactional messaging run on separate consent records and separate suppression lists.
  • [ ] Marketing calls and texts rest on prior express written consent that names your company, discloses autodialed/prerecorded marketing, and states that consent is not a condition of purchase.
  • [ ] You can produce the consent record for any number on demand — including for purchased leads.
  • [ ] The National DNC Registry is scrubbed, the internal DNC list exists in writing, and calling hours are enforced in the recipient's time zone.
  • [ ] STOP, opt-out, and revocation are honored immediately and across all channels.

Gate 5 — Email

  • [ ] Headers and subject lines are accurate; the message identifies itself as an ad; a valid physical postal address appears.
  • [ ] The opt-out works without a login, is honored within 10 business days, and propagates to every list.
  • [ ] Non-U.S. recipients are handled under opt-in rules (GDPR/PECR, CASL), not CAN-SPAM.

Gate 6 — Advertising and negative option

  • [ ] Influencers receive written disclosure instructions and are monitored; material connections are disclosed clearly and conspicuously.
  • [ ] Reviews are genuine; there is no suppression of negative reviews and no undisclosed insider reviews.
  • [ ] Every negative-option offer discloses all material terms before billing information is taken, obtains express informed consent, and offers a simple cancellation mechanism — with state auto-renewal laws (California's ARL especially) checked.

Gate 7 — Contracts

  • [ ] The arbitration clause was assented to (real notice, real manifestation) — not buried in a footer.
  • [ ] It is mutual: no carve-out for the drafter's own claims.
  • [ ] The class waiver is express; the forum is reasonable; fee-shifting is not punitive; severability is drafted deliberately.
  • [ ] The clause is checked against MLA (no mandatory arbitration for covered borrowers) and against public-injunctive-relief rules in California.
  • [ ] There is a mass-arbitration plan — batching, fee allocation, bellwethers — before you need one.
  • [ ] You will move to compel early. Morgan v. Sundance means litigating first forfeits the clause.

Gate 8 — Privacy and breach

  • [ ] A written information security program exists and satisfies the Safeguards Rule (if GLBA applies) or the applicable state standard.
  • [ ] The incident response plan is written, tested, and names the decision-makers.
  • [ ] Website tracking technologies have been inventoried against wiretap, VPPA, and state privacy-law exposure.

Gate 9 — Exposure

  • [ ] For each pillar, you have written down: statutory damages × class size = worst case. If you have not done that arithmetic, you do not know what you are defending.

Primary Authority

Federal statutes

Regulations

  • Regulation F (debt collection), 12 C.F.R. pt. 1006
  • Regulation V (FCRA), 12 C.F.R. pt. 1022
  • Regulation Z (TILA), 12 C.F.R. pt. 1026; Regulation B (ECOA), 12 C.F.R. pt. 1002; Regulation E (EFTA), 12 C.F.R. pt. 1005
  • TCPA rules, 47 C.F.R. § 64.1200; Telemarketing Sales Rule, 16 C.F.R. pt. 310
  • CAN-SPAM Rule, 16 C.F.R. pt. 316
  • Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 C.F.R. pt. 255
  • Standards for Safeguarding Customer Information (Safeguards Rule), 16 C.F.R. pt. 314
  • Preservation of Consumers' Claims and Defenses (Holder Rule), 16 C.F.R. § 433.2

Cases

Representative state statutes (illustrative only — confirm your own state's rule)

  • California: Bus. & Prof. Code §§ 17200, 17500, 17600 et seq.; Civ. Code § 1750 et seq. (CLRA), § 1788 et seq. (Rosenthal Act), § 1798.100 et seq. (CCPA/CPRA)
  • Massachusetts: G.L. c. 93A
  • New York: Gen. Bus. Law §§ 349, 350
  • Texas: Bus. & Com. Code § 17.41 et seq. (DTPA)
  • Florida: Fla. Stat. § 501.201 et seq. (FDUTPA)
  • Illinois: 740 ILCS 14 (BIPA)

Secondary Sources

  • Wright & Miller, Federal Practice and Procedure (class certification and Article III standing)
  • McCarthy on Trademarks and Unfair Competition (Lanham Act § 43(a) false advertising)
  • Restatement (Second) of Contracts §§ 208, 211 (unconscionability; standardized agreements)
  • CFPB Supervision and Examination Manual; CFPB Consumer Financial Protection Circulars
  • FTC Policy Statement on Deception (1983) and Policy Statement on Unfairness (1980), appended to FTC decisions and treated as the operative standards

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This toolkit is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Laws vary by state and change over time; verify current requirements and consult qualified counsel before acting.