Consumer protection, competition and privacy

Contract law assumes two parties bargaining on roughly equal terms. Consumer transactions rarely look like that: a business drafts standard terms, controls information and deals with thousands of customers who cannot negotiate. Legislatures have therefore added three bodies of regulation that apply to almost every business: consumer protection law, which limits unfair practices and gives consumers special rights; competition law, which protects markets from price-fixing, abuse of market power and deceptive marketing; and privacy and anti-spam law, which governs how businesses collect, use and protect personal information. Penalties in all three areas have risen sharply in recent years, and private class actions follow many enforcement actions.

Consumer protection statutes

Consumer protection comes from both federal and state law. At the federal level, Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practices in or affecting commerce, and the FTC enforces it through investigations, consent orders, civil penalties for rule violations and court actions for consumer refunds. Federal statutes and rules also govern specific areas, such as consumer credit (the Truth in Lending Act and the Consumer Financial Protection Bureau's rules), credit reports (the Fair Credit Reporting Act), debt collection (the Fair Debt Collection Practices Act), warranties (Magnuson-Moss, lesson 5) and door-to-door sales (the FTC's Cooling-Off Rule, which gives buyers three business days to cancel many sales made at their home or at temporary locations). Every state also has an unfair and deceptive acts and practices (UDAP) statute, often called a little FTC Act, and most give consumers a private right of action, sometimes with double or treble damages and attorney's fees, which makes them a frequent basis for class actions.

The FTC's deception standard asks whether a representation, omission or practice is likely to mislead consumers acting reasonably in the circumstances, and whether it is material, meaning likely to affect their decisions. Advertisers must have a reasonable basis for objective claims before making them (the substantiation doctrine), and health and safety claims usually require competent and reliable scientific evidence. Fine print and disclaimers cannot cure a misleading net impression. A practice is unfair if it causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits to consumers or competition.

Competition law

American antitrust law rests on three main statutes. Section 1 of the Sherman Act prohibits contracts, combinations and conspiracies in restraint of trade. Agreements between competitors to fix prices, rig bids or allocate markets are per se illegal, meaning they are condemned without any inquiry into their effects, and are prosecuted criminally by the Department of Justice, with corporate fines of up to $100 million (or twice the gain or loss) and prison terms of up to ten years for individuals. Other agreements are judged under the rule of reason, which weighs anticompetitive harm against procompetitive benefits. Section 2 prohibits monopolization and attempted monopolization: acquiring or maintaining monopoly power through exclusionary conduct rather than a better product or business acumen. The Clayton Act prohibits mergers that may substantially lessen competition and, through the Hart-Scott-Rodino Act, requires premerger notification of transactions above thresholds adjusted each year. Private parties injured by antitrust violations can sue for treble damages and attorney's fees, which drives extensive class action litigation. The DOJ and FTC also treat wage-fixing and no-poach agreements between employers as potential criminal or civil violations.

Competition law affects ordinary managers, not just executives negotiating mergers. Sales staff who exchange pricing plans with competitors at a trade show, purchasing managers who agree with other buyers to cap what they will pay suppliers, and HR managers who agree with nearby employers not to hire each other's staff can all expose their companies and themselves to criminal liability. Trade association meetings are a classic risk: legitimate discussion of industry standards or lobbying can drift into competitively sensitive topics. Companies manage the risk with compliance programs, training, agendas and minutes for association meetings, and clear instructions to leave any conversation about prices, bids, customers or wages and report it to counsel.

Misleading advertising and environmental claims

The FTC Act and the Lanham Act (lesson 7) prohibit false advertising. The FTC's Green Guides set out how the FTC applies its deception standard to environmental claims such as recyclable, compostable, carbon neutral and eco-friendly; broad unqualified claims such as "eco-friendly" are almost impossible to substantiate, and qualified claims must be clear and specific. The FTC's Endorsement Guides, updated in 2023, require disclosure of material connections between advertisers and endorsers, including influencers, and its Rule on the Use of Consumer Reviews and Testimonials, in force since October 2024, prohibits fake reviews, buying positive or negative reviews and suppressing negative reviews, with civil penalties per violation. Competitors can sue under the Lanham Act for false advertising, and class actions under state UDAP laws challenge labels such as "natural" and "made in USA". The FTC's 2024 click-to-cancel rule for subscriptions was vacated by a federal appeals court in July 2025, but the Restore Online Shoppers' Confidence Act and several state automatic-renewal laws, notably California's, still require clear disclosure, consent and simple cancellation for online subscriptions.

Privacy and data protection

The United States has no comprehensive federal privacy law. Instead, sector-specific statutes govern health information (HIPAA), financial information (the Gramm-Leach-Bliley Act), credit reports (FCRA), children's online information (COPPA, which requires verifiable parental consent for collecting data from children under 13) and video rental records, among others. The FTC uses Section 5 to bring actions against companies that break their privacy promises or fail to use reasonable security, and its consent orders can require 20-year compliance programs. States fill the gap. California's Consumer Privacy Act, as amended by the California Privacy Rights Act and enforced by the California Privacy Protection Agency and the attorney general, gives consumers rights to know, delete, correct and opt out of the sale or sharing of personal information, and about two dozen states had enacted comprehensive consumer privacy laws by mid-2026, with different thresholds and requirements. Every state has a data breach notification law requiring notice to affected residents, and often to regulators, when certain personal information is compromised. Illinois's Biometric Information Privacy Act, with its private right of action, has produced some of the largest privacy settlements.

Commercial electronic messages

The CAN-SPAM Act regulates commercial email using an opt-out model: businesses may send marketing email without prior consent, but every message must not use false or misleading header information or deceptive subject lines, must identify itself as an advertisement, must include a valid physical postal address and must provide a clear way to opt out, honored within 10 business days. Penalties can reach $53,088 per non-compliant email at 2026 inflation-adjusted levels, and both the advertiser and the sender can be liable. Text messages and automated calls are governed by the stricter Telephone Consumer Protection Act (TCPA), which generally requires prior express written consent for marketing texts and robocalls to mobile phones and allows consumers to sue for $500 to $1,500 per message, which makes TCPA class actions common.