United States. Comprehensive data protection. Act
FTC Act s5Federal Trade Commission Act, Section 5 (15 U.S.C. § 45) – unfair or deceptive acts or practices
§1Summary
- Synopsis
Prohibits unfair or deceptive acts or practices in commerce and is the FTC's main tool for privacy and data security enforcement. The FTC brings cases over misleading privacy statements, inadequate security and harmful data practices, usually resolved by long-term consent orders.
- Key themes
- Unique features
Functions as the de facto US federal privacy regime through case law and consent orders rather than prescriptive rules; the FTC has ordered deletion of models trained on improperly obtained data.
- SaaS relevance
Applies to almost any for-profit SaaS business: privacy policies, security claims and DPF self-certifications are enforceable promises.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None (but failure to disclose may be deceptive)
- DPO
- No
- Cross-border transfers
- EU-US DPF / UK Extension / Swiss-US DPF self-certification enforced by FTC
- Maximum penalty
- Civil penalties for violating orders or rules: $53,088 per violation (2025 inflation adjustment)
§3Dates
- Key dates
- Adopted
- In force
- Wheeler-Lea Act 1938 added 'unfair or deceptive acts or practices'; AMG Capital (2021) removed s13(b) monetary relief; civil penalties available for order/rule violations (inflation-adjusted annually).
§4Text and authority
- Text
- Authoritative text uscode.house.gov
- Authority
- Federal Trade Commission (FTC)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Penalty figure cross-checked via TAKE IT DOWN Act guidance citing $53,088 per violation; EU adequacy applies only to DPF-certified organisations.