deceptive trade

ftc-“click-to-cancel”-rule-seeks-to-end-free-trial-traps,-sneaky-auto-enrollments

FTC “click to cancel” rule seeks to end free trial traps, sneaky auto-enrollments


No more jumping through endless hoops to cancel subscriptions, FTC rule says.

It will soon be easy to “click to cancel” subscriptions after the US Federal Trade Commission (FTC) adopted a final rule on Wednesday that makes it challenging for businesses to opt out of easy cancellation methods.

“Too often, businesses make people jump through endless hoops just to cancel a subscription,” FTC chair Lina Khan said in a press release. “The FTC’s rule will end these tricks and traps, saving Americans time and money. Nobody should be stuck paying for a service they no longer want.”

The heart of the new rule requires businesses to provide simple ways to cancel subscriptions. Under the rule, any subscription that can be signed up for online must be able to be canceled online. And cancellation paths for in-person sign-ups must be just as easy, offered either by phone or online.

In guidance released Wednesday, the FTC recommended that businesses keep “three guardrails in mind” to ensure cancellation methods comply with the law. First, customers cannot be required to talk to a live agent or chatbot to cancel if that wasn’t required for sign-up. Next, any phone cancellation methods cannot include charges and must be offered during normal business hours. And finally, canceling services in person must always be optional.

To comply with the rule, businesses offering “negative option marketing” such as subscriptions, automatic renewals, and free trial offers—to both consumers and other businesses—are prohibited from misleading customers. They must clearly disclose all terms of the deal prior to accepting payment, including explaining how much and how often customers will be charged, when free trials or promotions end, any deadlines to avoid charges, and, importantly, how to cancel.

“All this information should be clear, conspicuous, and available to your customers before they enroll. And certain key information related to charges and cancellation must appear right when and where the customer agrees to the negative option, every time,” the FTC said.

Under the “click to cancel” rule, businesses must also get consumers’ informed consent before issuing charges and maintain records of consent for a minimum of three years. Those records could be in the form of a ticked checkbox or a signature, the FTC said, noting the agency offers “some flexibility on what that proof looks like.”

“Don’t try to distract people with other information,” the FTC said. “Get proof of consent and maintain it for at least three years.”

That provision is designed to end unfair and deceptive practices that the FTC found, such as inadequate disclosures about free trials or sneaky auto-enrollments. Those “practices have been a persistent source of consumer harm for decades,” the FTC’s notice on the final rule said, “saddling shoppers with recurring payments for products and services they never intended to purchase nor wanted to continue buying.”

The FTC confirmed that some provisions of the final rule will go into effect within 60 days, but most will take effect after 180 days. Violators risk civil penalties and other forms of consumer redress that weren’t previously available under the FTC act, the notice in the federal register said.

Some frustrated individual commenters asked for stiff penalties, the FTC’s notice said.

“There needs to be a substantial penalty when a service is requested to be cancelled, but the charges continue,” one commenter urged the FTC. “I dropped my TV service from Comcast three months ago and they continue to charge me. Every time I need to re-contact them, I waste an hour.”

FTC made few concessions to critics

More than 16,000 comments were submitted during proposed rulemaking, including concerns raised by cable firms who worried that the FTC’s rule might make it so easy to cancel a subscription that customers miss out on benefits, including deals often offered to retain their business.

At that time, Michael Powell, CEO of The Internet & Television Association (NCTA), defended using live agents to process cancellation requests. He warned that “a consumer may easily misunderstand the consequences of canceling,” incurring unexpected costs in situations like “canceling part of a discounted bundle” that “may increase the price for remaining services.”

Powell further argued that the rule could raise costs for customers, alleging that the FTC had significantly underestimated compliance costs that “could easily exceed $100 million for initial implementation by” the cable industry alone.

But the FTC strongly disagreed with some estimates of compliance costs. For example, in the notice in the federal register, the FTC noted that “because NCTA members who enroll consumers online already, clearly, have websites, the Commission rejects the notion that adding ‘click to cancel’ functionality to websites that already include an order path for enrolling, and likely also include functionality for registering a payment mechanism for automated billing, would cost $12–$25 million.”

Ultimately, the FTC disputed the NCTA’s data and rejected the notion that the rule would “require building online cancellation systems virtually from the ground up and expensive ongoing recordkeeping requirements across all services,” pointing any concerned commenters to “the detailed cost-benefit analysis” of the rule provided in the federal register notice.

There were only a few major changes to the final rule following the public commenting period. Notably, the FTC dropped a provision that would have required businesses to send annual reminders about recurring charges, as well as another prohibiting promotions or deals offered during the cancellation process in efforts to retain customers without customers opting in to seeing those offers.

The FTC said that it’s only dropped these provisions for now, noting that the Commission plans to keep the record “open on these issues” and may seek additional comments.

Exemptions available but seem unlikely

Perhaps of greatest interest to businesses, the FTC also added “a provision allowing requests for exemptions.” But those will likely be reserved for businesses already complying with the rule, the FTC said, while explaining that each request for exemptions will be weighed individually.

“Because such decisions are highly fact dependent, the Commission must consider exemptions, even of larger groups, on an individualized basis pursuant to the FTC’s Rules of Practice,” the FTC’s notice said.

Some businesses may qualify for recordkeeping exemptions, the FTC said, but only if “it is technologically feasible to make it impossible for customers to enroll without providing unambiguously affirmative consent.”

“Sellers must either maintain records of each consumer’s unambiguously affirmative consent or demonstrate they satisfy the technological exemption provision,” the FTC’s notice said.

The Commission specifically confirmed that it will not be granting “blanket exemptions to sellers who contract with third parties while offering subscription services.” While some businesses claimed this leaves them on the hook for cancellations they cannot process, the FTC found that “an exemption for all sellers who contract with third parties to manage aspects of their negative option programs would effectively nullify the Rule by incentivizing less than legitimate sellers to contract with actors engaged in deceptive practices to maximize negative option enrollments and frustrate cancellation with impunity.”

“A seller cannot evade its responsibility to deal honestly with consumers by contracting with a third party who does not,” the FTC’s notice said.

Official: FTC rule “may not survive legal challenge”

The final rule narrowly passed by a vote of 3–2, with commissioner Melissa Holyoak providing a dissenting statement accusing the agency of rushing the rule to score political points for the Biden administration ahead of the presidential election.

Vice President Kamala Harris will likely continue Biden’s war on “junk fees” if elected, Reuters reported, and Holyoak claimed that Khan pushed for the rule’s adoption to help follow “through on a campaign pledge made by the Chair’s favored presidential candidate.”

According to Holyoak, the final rule is deeply flawed, “improperly generalizing” unfair and deceptive practices “from narrow industry-specific complaints and evidence to the entire American economy.” She argued that the FTC only based the rule on 35 cases, which is allegedly not enough to establish that harmful practices are “prevalent.”

“Whatever the merits of the past cases, the Majority does not remotely come close to explaining how the evidence in those limited cases are similar to the myriad contexts an economy-wide rule would inevitably apply to,” Holyoak suggested.

She also claimed that “if similarity among complaints and cases only at the highest level of generality constitutes the ‘prevalence’ sufficient to ground an economy-wide rulemaking, then a ‘prevalence’ determination is in fact no meaningful guardrail on the Commission’s conduct at all.”

In the press release, the FTC discussed the wide reach of harms, noting that it “receives thousands of complaints about negative option and recurring subscription practices each year,” with the number “steadily increasing over the past five years.”

But Holyoak insisted that the final rule is such an overreach that it “may not survive legal challenge.”

“The Chair has put political expediency over getting things right,” Holyoak said, raising “the possibility that foreordained outcomes and political goals curtailed considering the rulemaking record with an open mind and without prejudgment, as law requires.”

A key legal flaw, Holyoak claimed, is that the rule prohibits any misrepresentations of a negative option, not just those relating to “deceptive terms.” That means businesses risk civil penalties for any material fact deemed misleading, which she alleged “fails to meet” the level of “specificity” required for FTC rulemaking. That seeming textual oversight “will no doubt invite serious legal challenge on this basis,” Holyoak predicted.

Should any portion of the rule be struck down through a legal challenge, the FTC included a provision on severability, allowing the remainder of the rule to remain in force.

Too soon to guess impact on subscription prices

According to Holyoak, the broad final rule “tilts the playing field in ways that are likely to pervert business incentives,” perhaps leading businesses to stop offering negative option billing models, “even when businesses and consumers could derive significant value from them.”

“Even honest businesses will have reason to reconsider the use of negative option billing now that it means subjecting themselves to potential civil penalties for misreading Commission tea leaves,” Holyoak said.

Further, she alleged that consumers could be harmed if the rule preempts state laws or potentially increases transaction costs for businesses that potentially stop offering cheaper negative option billing. Businesses could also pass on to customers the costs of legal fees incurred in efforts to obtain an exemption, Holyoak suggested.

“Raising the transaction costs will reduce a business’ sales and the utility consumers derive from these services. In other words, in our good intentions, we may harm the consumers and competition we are supposed to protect,” Holyoak warned.

But while Holyoak seems sure that consumers could be harmed by the rule potentially limiting negative option billing and spiking subscription costs, the FTC argued that “consumers cannot realize these benefits when sellers make material misrepresentations to induce consumers to enroll in such programs, fail to provide important information, bill consumers without their consent, or make cancellation difficult or impossible.”

At least one individual customer the FTC notice cited insisted that the rule was necessary to end a wide range of abusive charges draining the wallets of many Americans.

“Implementing this consumer-protection rule has the potential to save American consumers millions of dollars and prevent unscrupulous companies from using byzantine cancellation procedures to squeeze unwarranted funds out of their customers,” the commenter said.

Photo of Ashley Belanger

Ashley is a senior policy reporter for Ars Technica, dedicated to tracking social impacts of emerging policies and new technologies. She is a Chicago-based journalist with 20 years of experience.

FTC “click to cancel” rule seeks to end free trial traps, sneaky auto-enrollments Read More »

shopping-app-temu-is-“dangerous-malware,”-spying-on-your-texts,-lawsuit-claims

Shopping app Temu is “dangerous malware,” spying on your texts, lawsuit claims

“Cleverly hidden spyware” —

Temu “surprised” by the lawsuit, plans to “vigorously defend” itself.

A person is holding a package from Temu.

Enlarge / A person is holding a package from Temu.

Temu—the Chinese shopping app that has rapidly grown so popular in the US that even Amazon is reportedly trying to copy it—is “dangerous malware” that’s secretly monetizing a broad swath of unauthorized user data, Arkansas Attorney General Tim Griffin alleged in a lawsuit filed Tuesday.

Griffin cited research and media reports exposing Temu’s allegedly nefarious design, which “purposely” allows Temu to “gain unrestricted access to a user’s phone operating system, including, but not limited to, a user’s camera, specific location, contacts, text messages, documents, and other applications.”

“Temu is designed to make this expansive access undetected, even by sophisticated users,” Griffin’s complaint said. “Once installed, Temu can recompile itself and change properties, including overriding the data privacy settings users believe they have in place.”

Griffin fears that Temu is capable of accessing virtually all data on a person’s phone, exposing both users and non-users to extreme privacy and security risks. It appears that anyone texting or emailing someone with the shopping app installed risks Temu accessing private data, Griffin’s suit claimed, which Temu then allegedly monetizes by selling it to third parties, “profiting at the direct expense” of users’ privacy rights.

“Compounding” risks is the possibility that Temu’s Chinese owners, PDD Holdings, are legally obligated to share data with the Chinese government, the lawsuit said, due to Chinese “laws that mandate secret cooperation with China’s intelligence apparatus regardless of any data protection guarantees existing in the United States.”

Griffin’s suit cited an extensive forensic investigation into Temu by Grizzly Research—which analyzes publicly traded companies to inform investors—last September. In their report, Grizzly Research alleged that PDD Holdings is a “fraudulent company” and that “Temu is cleverly hidden spyware that poses an urgent security threat to United States national interests.”

As Griffin sees it, Temu baits users with misleading promises of discounted, quality goods, angling to get access to as much user data as possible by adding addictive features that keep users logged in, like spinning a wheel for deals. Meanwhile hundreds of complaints to the Better Business Bureau showed that Temu’s goods are actually low-quality, Griffin alleged, apparently supporting his claim that Temu’s end goal isn’t to be the world’s biggest shopping platform but to steal data.

Investigators agreed, the lawsuit said, concluding “we strongly suspect that Temu is already, or intends to, illegally sell stolen data from Western country customers to sustain a business model that is otherwise doomed for failure.”

Seeking an injunction to stop Temu from allegedly spying on users, Griffin is hoping a jury will find that Temu’s alleged practices violated the Arkansas Deceptive Trade Practices Act (ADTPA) and the Arkansas Personal Information Protection Act. If Temu loses, it could be on the hook for $10,000 per violation of the ADTPA and ordered to disgorge profits from data sales and deceptive sales on the app.

Temu “surprised” by lawsuit

The company that owns Temu, PDD Holdings, was founded in 2015 by a former Google employee, Colin Huang. It was originally based in China, but after security concerns were raised, the company relocated its “principal executive offices” to Ireland, Griffin’s complaint said. This, Griffin suggested, was intended to distance the company from debate over national security risks posed by China, but because the majority of its business operations remain in China, risks allegedly remain.

PDD Holdings’ relocation came amid heightened scrutiny of Pinduoduo, the Chinese app on which Temu’s shopping platform is based. Last year, Pinduoduo came under fire for privacy and security risks that got the app suspended from Google Play as suspected malware. Experts said Pinduoduo took security and privacy risks “to the next level,” the lawsuit said. And “around the same time,” Apple’s App Store also flagged Temu’s data privacy terms as misleading, further heightening scrutiny of two of PDD Holdings’ biggest apps, the complaint noted.

Researchers found that Pinduoduo “was programmed to bypass users’ cell phone security in order to monitor activities on other apps, check notifications, read private messages, and change settings,” the lawsuit said. “It also could spy on competitors by tracking activity on other shopping apps and getting information from them,” as well as “run in the background and prevent itself from being uninstalled.” The motivation behind the malicious design was apparently “to boost sales.”

According to Griffin, the same concerns that got Pinduoduo suspended last year remain today for Temu users, but the App Store and Google Play have allegedly failed to take action to prevent unauthorized access to user data. Within a year of Temu’s launch, the “same software engineers and product managers who developed Pinduoduo” allegedly “were transitioned to working on the Temu app.”

Google and Apple did not immediately respond to Ars’ request for comment.

A Temu spokesperson provided a statement to Ars, discrediting Grizzly Research’s investigation and confirming that the company was “surprised and disappointed by the Arkansas Attorney General’s Office for filing the lawsuit without any independent fact-finding.”

“The allegations in the lawsuit are based on misinformation circulated online, primarily from a short-seller, and are totally unfounded,” Temu’s spokesperson said. “We categorically deny the allegations and will vigorously defend ourselves.”

While Temu plans to defend against claims, the company also seems to potentially be open to making changes based on criticism lobbed in Griffin’s complaint.

“We understand that as a new company with an innovative supply chain model, some may misunderstand us at first glance and not welcome us,” Temu’s spokesperson said. “We are committed to the long-term and believe that scrutiny will ultimately benefit our development. We are confident that our actions and contributions to the community will speak for themselves over time.”

Shopping app Temu is “dangerous malware,” spying on your texts, lawsuit claims Read More »