Back your FTC Act privacy and security claims with evidence

The FTC Act is the Federal Trade Commission Act of 1914, the US federal law that created the Federal Trade Commission. Section 5 declares unfair methods of competition and unfair or deceptive acts or practices in or affecting commerce unlawful. The FTC uses this consumer protection power to act against misleading marketing, false privacy promises and unreasonable data security, making it the main federal privacy and security enforcement tool in the US.

Section 5 does not list specific security controls. Instead, the FTC treats two things as violations: deceptive practices, such as claiming to encrypt data when you do not, and unfair practices, such as failing to take reasonable security measures where that causes or is likely to cause substantial injury consumers cannot reasonably avoid. Section 5(n) sets out this unfairness test, which the FTC applies case by case.

Most businesses engaged in commerce in the United States must comply with the FTC Act, regardless of size. Some sectors are exempt from FTC jurisdiction under Section 5, including banks, savings and loan institutions, federal credit unions, common carriers and air carriers, and certain insurance activity. Foreign companies, including UK businesses, can also be covered when their practices affect US consumers or commerce.

For a first Section 5 violation the FTC usually seeks a consent order rather than a fine, requiring changes such as a security programme and independent assessments. Civil penalties apply when a company breaches a final FTC order or knowingly violates an FTC rule, currently up to $53,088 per violation after inflation adjustment. Each day of a continuing violation can count separately, so totals can be very large.

Comply by making sure every privacy and security claim you publish is accurate, and by running a reasonable, documented security programme proportionate to the data you hold. In practice that means risk assessment, access control, encryption, vendor oversight, staff training, incident response and regular testing. Keeping evidence of these controls helps show reasonableness if the FTC ever asks.

The FTC Act does not reference SOC 2 or ISO 27001, and having either does not guarantee compliance. However, their controls are a strong, recognised way to demonstrate the reasonable security the FTC expects. GDPR is an EU law with its own rules, but the same privacy and security controls often support both. Mapping controls once across these frameworks avoids duplicate work.

No, there is no FTC Act certification or official audit. Compliance is judged by the FTC through investigations and enforcement actions. Companies under a consent order are often required to obtain independent assessments of their security programme for many years, but these are order obligations, not a certification scheme that any business can apply for.

Yes, on request. The FTC Act is mapped in OneClickComply's control library and is available on request rather than as a standard live framework. We map its expectations to controls shared with SOC 2, ISO 27001 and GDPR, collect evidence automatically, monitor for drift and offer expert guidance through Ask an Auditor. OneClickComply does not guarantee compliance or act for the FTC.