Fortunately, the U.S. Supreme Court, in a series of recent decisions, has given marketers new armor with which to defend themselves preemptively against plaintiffs’ suits: mandatory arbitration of consumer disputes. Last month, in CompuCredit Corporation v. Greenwood, its latest pronouncement on the subject, the Supreme Court barred a class action for violation of the Credit Repair Organization Act (CROA) on the grounds that CompuCredit’s credit card agreement required arbitration, and that CROA did not prohibit arbitration as the sole method of dispute resolution.

The court, in a majority opinion by Justice Antonin Scalia, went out of its way – the dissent said too far – to read CROA to permit a credit repair provider to compel arbitration over litigation. CROA is a very pro-consumer statute, affording, among other protections, a three-day cooling off period with right to cancel, and forbidding collection of fees until the seller has performed. To ensure the means to enforce those protections, it explicitly granted the consumer the “right to sue” a credit repair organization that violates CROA, and prohibits the “waiver” of any consumer rights afforded under the statute.

Seems plain enough, doesn’t it? “Right to sue” means right to sue in court, right? That’s what the Ninth Circuit below and the dissent by Justice Ruth Bader Ginsburg said was the obvious, “plain English” understanding of the phrase. But the majority had something else in mind. It said “right to sue” doesn’t mean the right to sue in court, but only the right to enforce the credit repair organization’s “liability” for “failure to comply” with CROA, which right also could be enforced in binding arbitration. The parties remain “free” to specify arbitration, the court said, so long as the “guarantee of the legal power to impose liability . . . is preserved.” Since CompuCredit had contractually provided for binding arbitration that was subject to judicial enforcement, plaintiff’s right to “impose liability” was protected.

Whether or not the majority’s “sophisticated” interpretation of the meaning of “right to sue” constituted an act of “legal legerdemain” that failed to honor Congress’ intent in enacting CROA, it demonstrates an unmistakable bias in favor of allowing sellers to avoid class actions and other consumer lawsuits by mandating binding arbitration of disputes. CompuCredit, on top of the court’s earlier pro-arbitration decisions, is a potential godsend to DR marketers that could be the next shakedown target. Mandatory consumer arbitration clauses now have the full backing of the highest court in the land. If you don’t have an arbitration provision in your customer contracts or terms and conditions now, you should. It could save your business.

Under its statute, the CFPB cannot carry out its most important functions, including regulating “non-bank” financial businesses, such as payday lenders, mortgage companies and debt collection agencies, until it has a director. Exploiting this leverage, Republican senators recently filibustered the nomination of President Obama’s choice to head the agency, former Ohio Attorney General Richard Cordray, a highly qualified candidate whose credentials were not in dispute. These senators opposed the appointment of a director until the structure and powers of the CFPB were fundamentally altered by replacing a single head with a bipartisan commission, subject the agency’s budget to the congressional appropriation process (funding currently comes from the Federal Reserve), and making it easier for other banking regulators to veto the CFPB’s rules.

With Democrats unwilling to bow to these demands, the Cordray nomination seemingly died, leaving the CFPB leaderless and powerless. Without a director, it can do little more than take consumer complaints, promote consumer financial education and issue reports. Its most concrete action has been to propose simplified mortgage forms. These and other initiatives would remain unenforceable, however, and the ambitious reform agenda of its backers still stymied, until a director was appointed.

Defiantly, President Obama has now done just that, without Senate confirmation. On January 4, exercising his constitutional appointment power while Congress is in recess, he named Cordray to the CFPB post. The appointment is only short-term, however, and more problematically, Congress technically was not in “recess,” (thanks to GOP wrangling of Senate procedure), which places the appointment in uncharted legal territory and invites an almost certain court challenge. Thus, even with the President’s daring end run maneuver, the effectiveness and future of the CFPB are still very much in doubt.

Consequently, this could still leave the FTC as the primary cop on the consumer financial protection beat – a duty this hyper-aggressive FTC will be only too eager to discharge. Alone or with state authorities, the FTC has brought nearly 500 cases during the past three years aimed at protecting the “Great Recession” consumer from allegedly dubious schemes, including debt relief, foreclosure rescue, payday lending, grants and business opportunities. Most recently, it obtained multi-million dollar judgments in a mortgage modification and foreclosure relief action; a court order requiring a payday lender to pay nearly $300,000 for illegally trying to garnish borrowers’ wages; and a $29.8 million judgment in a government grants case.

With 13 million Americans still unemployed, and millions more still struggling to get by, the FTC has said that consumer financial protection will continue to be a top priority. DR financial marketers should remain on high alert. While the CFPB may be handcuffed for now, the fiercely energized FTC remains on the enforcement prowl.

The year 2011 will be remembered as the Year of Privacy at the FTC – the time in which it tackled the “Four Horsemen of the Internet” to make the loudest statement possible about privacy standards it expects online firms and social media networks to uphold. First came Twitter, which agreed in March to settle charges of data security breaches and to put in place a comprehensive information security program that will be subject to independent audits over 10 years.

That same month, Google agreed to settle charges it made misrepresentations that led consumers to join its Buzz social media network without their consent, and did not adequately disclose that certain personal information (E-mail contacts) would be made public by default. Like Twitter, Google agreed to implement a comprehensive privacy program, but to submit to independent audits not for 10 years, but 20.

Now, at the end of November, comes Facebook, which just agreed to settle FTC claims it deceived consumers by telling them they could keep their information private, and then allowed it to be shared and made public. Under the settlement, Facebook is barred from making misrepresentations about the privacy of consumers’ personal information; must let consumers expressly opt in (rather than only opt out) to changes that override their privacy preferences (i.e., on sharing of their “Friends List,” or sharing of personal information with advertisers); and, like Google, must establish a comprehensive privacy program that will have to undergo independent audits for 20 years.

Sandwiched between these high-profile actions against the Internet’s behemoths, the FTC found time last month to issue a consent order against ScanScout, an advertising network that places video ads on websites for advertisers, settling charges it deceptively claimed consumers could opt out of receiving targeted ads by changing their browser settings to block cookies. The order requires a prominent notice on ScanScout’s home page that it collects information about consumers’ activities to send them targeted ads, together with a hyperlink to an opt-out mechanism; protects an opt-out choice for at least five years, unless the consumer changes it; and directs ScanScout to embed a hyperlink in its targeted ads that also leads to the opt-out mechanism.

Whether or not an FTC case against the fourth Internet Horseman – Amazon – is in the works, the actions it has taken against companies big and small in 2011 certainly back up its chairman’s pronouncement that privacy is, and will continue to be, a leading priority. To avoid mandatory audits yourself, you may wish to review your practices for compliance with FTC online privacy requirements.

Usually, the FTC would challenge them in the more “gentlemanly” forum of an administrative proceeding, rather than resorting to the ex parte temporary restraining order (TRO)/asset freeze ambush route in federal court they’ve perfected against smaller, weaker DR firms. It then would let them off with a slap on the wrist consent agreement and no monetary penalty whatsoever.

In short, for years the FTC has been applying a double standard in advertising enforcement, severely punishing the little guys in the DR industry, who lacked the financial firepower to defend themselves, and treating the big boys with kid gloves.

To its credit, the current FTC administration has begun to level the enforcement playing field a bit between powerful national advertisers and DR marketers. Cracks in the long-entrenched double standard have begun to appear during the past two years, with actions targeted against large drug makers and retailers like Bayer, Rite Aid, and CVS (as well as Nivea skin care maker Beiersdorf) that actually made them pay six-figure or low seven-figure civil penalties or consumer redress for advertising infractions. Now, finally, it may have been split wide open with the action taken in September against Reebok for allegedly falsely advertising “toning shoes,” which were claimed to provide extra tone and strength to leg and buttock muscles.

In a settlement of the charges brought against Reebok (in federal rather than administrative court, notably, but without a TRO/asset freeze), the FTC not only imposed the normal injunctive prohibitions against future false or unsubstantiated advertising claims, but forced Reebok to pay $25 million, which will be refunded to consumers directly from the FTC or through a court-approved class action lawsuit. Now, $25 million isn’t going to break the back of a company the size of Reebok, in the way that a hefty redress judgment can destroy a smaller DR marketer – especially in an industry that saw toning shoes sales reach $1 billion in 2010. But it is still real money to consumers, who shelled out $60-100 for a pair of the shoes, and represents one of the largest, if not the largest, consumer redress settlements the FTC has ever garnered from a national advertiser.

Whatever the impact of the settlement on Reebok’s bottom line, it is encouraging, and long past due, to see the FTC finally start to take a stern tone with big advertisers, too, and make them – as well as their counterparts in the direct response arena – pay when they cross the line. Hopefully the FTC double standard is dead once and for all.

While a flurry of bills have been introduced, “The Commercial Privacy Bill of Rights Act of 2011,” co-sponsored by Senators John Kerry (D-Mass.) and John McCain (R-Az.), seems poised to be the prime legislative vehicle. It could be blended with a House bill, the “Consumer Privacy Protection Act of 2011,” introduced by Reps. Cliff Stearns (R-Fla.) and Jim Matheson (D-Utah). Neither includes DNT, but should Congress decide to give consumers that option, there is no shortage of DNT measures, including ones introduced by Sen. Jay Rockefeller (D-W.Va.), Rep. Jackie Speier (D-Calif.), and jointly by Reps. Ed Markey (D-Mass.) and Joe Barton (R-Texas).

Both Kerry-McCain and Stearns-Matheson adopt the FTC’s “Fair Information Practice Principles” (notice, choice, consent, data access/security), create “safe harbors” for FTC-blessed privacy programs, would largely preempt state privacy laws, and would not allow a private right of action. Their chief differences are that Kerry-McCain is more prescriptive and would delegate substantial rulemaking powers to the FTC, while Stearns-Matheson relies more on disclosure and self-regulation.

Kerry-McCain not only would require privacy policy disclosure, it would set baseline legal standards. These would include not only clear notice of privacy practices, including usage of personally identifiable information (PII), but the right of individuals to opt-out of unauthorized uses of PII, including third-party datasharing for behavioral advertising, and to opt-in for use of sensitive PII (such as financial, health, etc.) and any transfers or uses that were materially different from those specified in the privacy policy and that created a risk of harm. Consumers also would be entitled to access and correct their PII. The FTC would be given broad rulemaking authority to implement the law and both the FTC and state attorneys general would have the power to enforce it.

Stearns-Matheson, by contrast, would require companies to publish privacy policies describing their collection, use and transfer of PII (which many, of course, already do), but stops short of mandating standards or empowering the FTC to establish standards.

Thus far, Kerry-McCain has garnered the most support, including backing from the White House and major technology companies, though consumer group sentiment is mixed. However, a national online privacy law seems assured. The stakes are high for marketers, consumers, and the future of behavioral advertising.

Irreparable damage that is unjustified could have been avoided if only the FTC had taken care to look at the facts first, and distinguished these marketers from the true frauds that do prey on financially vulnerable consumers. But the FTC has decided to condemn the direct response payday industry as a whole.

As usual, the FTC sued on the basis merely of some consumer complaints, without careful examination of the upsell disclosures themselves. The reported complaints were from 0.0004 percent of all customers. That’s one of every 2,300 consumers! The disclosures themselves were clear, prominent and unavoidable, in full compliance with FTC online disclosure guidelines – a fact not contested by the FTC.

Defendants retained FTC compliance counsel early on, followed their advice, and obtained strong compliance opinion letters from three advertising lawyers, including two FTC veterans, who concluded the disclosures were “more than adequate” to meet FTC requirements.

None of this mattered to the FTC. It barreled ahead anyway, shutting down a legitimate marketer that was offering valuable and appreciated services to thousands of financially distressed Americans, and wreaking financial havoc upon its owners and their families.

The point here is not to lament that the FTC made a bad mistake and unfairly wronged compliant marketers. The point is to send a warning out to DR marketers selling financial services to the “Great Recession Consumer” that the FTC presumptively views you as a law violator and will not hesitate to hammer you should it have the chance.

Last month, I wrote that the best way not to be ruined by the FTC is to “give it no excuse to ruin you at all.” It turns out the FTC doesn’t need an excuse. In this hostile regulatory climate, beware.

While it has used that leverage to secure many tough accords that help promote its enforcement goal of deterrence, historically it has been willing to compromise, especially on monetary relief. This is no longer the case. The FTC approach now, especially in cases involving financial offers to economically strapped (in FTC parlance, “last dollar”/”bottom dollar”) consumers, is all or nothing – “unconditionally surrender,” or we’ll see you in court.

This shift is most evident in its application of an “ability to pay” standard to consumer redress, and in a new insistence on lifetime marketing bans (rather than just restrictions) against first-time defendants. Regardless of the claimed amount of consumer injury, the FTC long has used a financial means test to reach monetary agreements. If you’ve been an FTC defendant (hopefully not!), you’ll know it requires financial disclosure statements as a condition of settlement detailing income, assets, expenses and liabilities.

In its traditional “ability to pay” formula, it usually would consider the “negative” side of the ledger and weigh liabilities against assets in determining redress. Today, while it still requires disclosure of liabilities, the only thing it really looks at are assets. If you have cash, securities, equity in a home or other property, or even a claim to “future payments” (such as a pending inheritance), the FTC will demand all or most of it as a condition of settlement, even if it effectively bankrupts you. If you don’t agree to pay, then it will seek a court judgment for the full amount of consumer injury (often millions) that you could be paying off for the rest of your life.

This is the sobering “choice” now presented to many DR marketers when sitting across the table from the FTC.

The other “option” they’re given is a lifetime conduct ban. Traditionally, the FTC has sought bans only against “recidivists” (“two-time losers” in FTC-speak). Kevin Trudeau is perhaps the most notorious poster boy for that policy. Now, it is employing a “one-strike-and-you’re-out” approach, demanding bans against DR marketers with no prior FTC record. These include bans on certain marketing methods (i.e., negative option) and sale of certain types of products (i.e., grants, employment services).

As harsh and unfair as these changes in settlement policy seem, from the FTC’s perspective, they are a necessary response to present conditions: desperate times require extreme measures. In its view, financially vulnerable consumers require maximum protection from and deterrence against unscrupulous conduct. Nevertheless, if the FTC feels it is justified to “wipe out” and ban misbehaving marketers in order to “send a message,” then it has a heightened responsibility to get its facts straight before it strikes and be sure it slams the right targets. Similarly, DR marketers have a heightened responsibility and self-interest to be sure their practices are compliant. The best way not to be ruined by the FTC is to give it no excuse to ruin you at all.

Until now, the Federal Trade Commission (FTC) has been the principal consumer financial regulator, both under its own statute and other financial laws and regulations. The FTC has exercised that authority with a vengeance, bringing hundreds of cases in tandem with state authorities against foreclosure relief, debt relief, “quick cash” (i.e., free grants, business opportunities), and other financial schemes perceived to be exploiting the economic anxieties of jobless Americans. The FTC will retain this authority under its own statute, but the CFPB is slated to be the nation’s chief consumer financial “protector,” with immense power to regulate any financial product offered “primarily for personal, family or household purposes.”

The CFPB and FTC will be required to coordinate rules, but the CFPB will sit atop the consumer financial regulatory totem pole. It will have exclusive consumer protection jurisdiction over 17 “enumerated” laws (i.e., Truth in Lending, Fair Credit Reporting, Fair Debt Collection) previously administered by the FTC and financial agencies. It will have broad regulatory and enforcement authority over the consumer financial offerings of “non-banks” as well as banks.

In addition, it will have supervisory authority (i.e., reporting, examinations, registration) over big banks (more than $10 billion in assets), mortgage, payday and student lenders regardless of size, and other “larger” non-banks, based on size, assessment of consumer risk, and other factors. (It already has announced plans to extend its supervisory powers to debt collection, debt relief, consumer reporting, consumer credit, money transmitting, check cashing and prepaid cards.) Its freedom to act will be considerable, subject only to a supermajority veto of a new Financial Oversight Council. It will be largely independent of Congress (funded principally from the Fed’s budget) and bigger than the FTC. It will be a regulatory behemoth – an “FTC on steroids.”

In addition to enforcing the enumerated laws, the CFPB will have wide authority to prohibit “unfair and deceptive” practices, similar to the FTC’s. Unlike the FTC, though, it also will have power to prohibit “abusive” practices. The FTC primarily enforces “truth in advertising,” rarely using its “unfairness” authority because of inherent difficulties in defining the term (What is unfair?). The CFPB can be expected to act much more as a quasi-legislative policymaker, making full use of its powers not only to enforce truth (i.e., clear, timely disclosures) but to impose what it thinks is “right” and “fair” (i.e., banning unaffordable loans, prepayment penalties, “excessive” fees and the like).

Warren, who is setting up the CFPB and is a potential candidate to head it, has made clear its first priority will be the mortgage industry that contributed to the housing crisis. Undoubtedly, though, its reach will extend into all corners of consumer financial services. If you’re offering mortgage, credit card, credit reporting, credit counseling, foreclosure/debt relief, payday or other financial products to consumers, it isn’t too early to say hello to your “new regulator.” To get more acquainted, visit www.consumerfinance.gov.

Legacy Learning Systems sold a home guitar instruction program through “Review Ad” affiliates it recruited and paid to promote its courses through endorsements in articles, blog posts and other online editorial material. The FTC claimed the reviews violated the Endorsement Guides because they falsely posed as the opinions of ordinary consumers or “independent” reviewers and did not disclose at all, or clearly enough, that affiliates made money on sales.

As an example, one review said: “Read my Independent Review and Discover the Truth of Learn & Master Guitar Now.” Another said it was “The Independent Reviews Site…Learn and Master Guitar emerged from our test as the King of ‘learn guitar at home’ courses.” The FTC also alleged that Legacy Learning Systems failed to enforce affiliate contracts that required them to comply with FTC disclosure guidelines.

To settle, Legacy Learning Systems agreed to pay $250,000 and implement a rigorous affiliate compliance monitoring and zero-tolerance disciplinary system requiring it to:

• Monitor and submit monthly reports to the FTC about its top 50 money-making affiliates and ensure they are disclosing they’re paid for sales and are not misrepresenting themselves as independent users or ordinary consumers
• Monitor and submit monthly reports on a random sampling of another 50 affiliates to ensure they also disclose the financial connection and don’t misrepresent who they are
• Immediately terminate and stop payment to any non-complying affiliate

The mechanism of a regular FTC reporting requirement should be plenty of stick to make sure the company meets its settlement obligations to monitor affiliates and swiftly can those who don’t tow the line. If it doesn’t, it could find itself in contempt and facing even greater sanctions.

Other online sellers who sponsor product reviews won’t be under such a microscope, but should still heed Legacy Learning Systems as a signal the FTC is conducting its own “affiliate monitoring” program to enforce the Endorsement Guides against phony reviews – and will make marketers who pay for them without consumers’ knowledge pay the FTC as well.

However long it’s been, zip codes have been on the minds of California’s highest judges. In a unanimous decision, the California Supreme Court recently ruled they are “personally identifiable information” (“PII”) within the meaning of California’s Credit Card Act (Cal. Civil Code Sec.1747.08) that cannot be collected in credit card sales, except in limited cases. Pineda v. Williams Sonoma Stores, Inc., 2011 LEXIS 1355 (Feb. 10, 2011). The statute defines PII as “information concerning the cardholder…including, but not limited to, the cardholder’s address and telephone number,” and bars its collection to protect consumers from unsolicited marketing.

Liberally construing the consumer protection purpose of the statute, the Court rejected Williams Sonoma’s defense that a zip code is not PII because it is only a “part” of an address and alone cannot identify a person. Noting the company had used software to match the plaintiff’s name and zip code to locate her previously undisclosed address, the Court held its interpretation would permit retailers to “obtain indirectly what they are clearly prohibited from obtaining directly, ‘end-running’ the statute’s clear purpose.” California retailers may still gather zip codes for an “incidental” purpose, such as shipping.

What does this decision mean for DR marketers? First, the law appears to cover only credit cards, not debit cards or other forms of payment. Second, if you’re delivering a physical product, you can still collect the information. Third, application of the law to the Internet is unclear. To date it has been applied only to retail stores and makes no reference to online transactions. The only court to address it in that context held it did not apply, citing distinctions from the brick and mortar world, including fraud concerns that require online merchants to be able to collect PII for “verification.” Saulic v. Symantec Corp., 596 F. Supp. 2d 1323 (C.D. Cal. 2009).

This lone decision may not be enough to deter class action lawyers from seeking to extend Williams-Sonoma to bar collection of PII in online commerce (maybe even IP or email addresses, though their required use for customer communication should qualify as an “incidental purpose”). Dozens of suits already have been brought under the Credit Card Act. Now, with this judicial green light, and lure of large recoveries (up to $1000 per violation), there could be many more.

If you’re selling goods online that need to be shipped, or by some quirk you don’t accept credit cards, then Williams Sonoma shouldn’t affect you. If you’re selling digital goods to credit card customers, though, you may want to reconsider just how important each type of PII you’ve been collecting (including phone and postal address) is to your business. The rationale of fraud protection could prove to be a winning defense against class action assault. But if not, then the legal risk (and cost) of PII collection could go up, at least in California.