Commercial Litigation Update

On August 14, 2024, the Federal Trade Commission (“FTC”) announced a new final rule aimed at regulating fake consumer reviews, testimonials, insider reviews, company-controlled websites, and fake indicators of social media influence (e.g., “likes”) (the “Final Rule”).  The Final Rule was promulgated pursuant to Section 18 of the FTC Act, which authorizes the FTC to issue rules that define acts or practices that are unfair or deceptive within the meaning of Section 5(a)(1) of the FTC Act, and it enables the FTC to seek civil monetary penalties for violations.

While it covers ground similar to the FTC’s recently updated endorsement guides (the “Guides”), which we wrote about last year, the Guides regulate the conduct of individuals who are paid or incentivized to endorse products, whereas the Final Rule applies directly to companies advertising through consumer reviews, testimonials, and social media.

The Final Rule has six primary subsections: (1) Fake or False Consumer Reviews, Consumer Testimonials, or Celebrity Testimonials (§ 465.2); (2) Buying Positive or Negative Consumer Reviews (§465.4); (3) Insider Consumer Reviews and Consumer Testimonials (§465.5); (4) Company-Controlled Review Websites or Entities (§465.6); (5) Review Suppression (§465.7); and (6) Misuse of Fake Indicators of Social Media Influence (§465.8). 

On July 26, 2023, the Securities and Exchange Commission (“SEC”) adopted its long-anticipated cybersecurity reporting rule (the “Final Rule”). The Final Rule applies to public companies subject to the reporting requirements of the Securities Exchange Act of 1934 and, in some cases, to foreign private issuers. As quoted in the SEC’s press release, SEC Commissioner Gary Gensler noted that many public companies already make cybersecurity disclosures to investors, and the Final Rule provides uniformity and structure for these future disclosures. The Final Rule also imposes a tight timeline for cybersecurity incident reporting and may include disclosure of an ongoing cybersecurity incident, as well as requiring periodic disclosures concerning organizational cybersecurity risk management processes and governance.