Much like an artist looking for a muse, I keep up with consumer protection developments and ponder – is this blog-worthy? Well, the other day, the Federal Trade Commission (FTC) announced the annual updates to its civil penalty numbers. I yawned and returned to the task at hand. My colleague Amy, however, wisely thought that it might be helpful for me to shed some light on FTC civil penalty actions and how penalties are assessed. Thanks for the inspiration, muse! To simplify matters, I will focus on rule violations (as opposed to administrative order violations, which can be handled somewhat differently). There isn’t a great deal of FTC case law on this issue, so we will concentrate on the statutory language. But spoiler alert – it’s complicated, and there is no simple penalty formula.

Let’s start with some background that might explain the general dearth of case law. Although the FTC has had some civil penalty authority for many decades, in most cases, the FTC would defer seeking penalties and instead use Section 13(b) of the FTC Act to obtain consumer redress when appropriate. There was a general preference to get money to consumers rather than seeking penalties that go to the U.S. Treasury. The Supreme Court’s decision in AMG has changed that calculus, and the FTC going forward is more likely to seek penalties when it can. As an aside, it is worth noting that when the FTC is alleging certain rule violations, penalties are an option. But Section 19 of the FTC Act does allow the agency to also seek “the refund of money or return of property” as is “necessary to redress injury to consumers.” The law on this Section 19 provision is still developing, but a recent blog discussed a district court decision that was not particularly helpful for the agency in this regard.

Now procedurally, the FTC generally cannot just run into federal court to seek penalties. Before doing that, the statute requires the agency to send the penalty complaint (and settlement, if one exists) to the Department of Justice, and the DOJ then has 45 days to either file the case itself or return it to the FTC for prosecution. Theoretically, the DOJ can send it back to the FTC on day one to expedite the process, but that is not a common occurrence, and usually there is a time lag while the complaint is pending with the DOJ.

With that background out of the way, lets return to the task at hand – calculating penalties. Since 2016, a statute requires the FTC to update yearly its maximum civil penalty pursuant to a specific formula. And it’s not just one number – there are different statutes under the FTC’s authority that are each adjusted. But the number we really care about, which covers violations of Sections 5(l), 5(m)(1)(A) and 5(m)(1)(B) of the FTC Act, increased from $43,792 to $46,517. This doesn’t mean that you will be paying an additional $2,725 per violation if the FTC alleges that you engaged in a rule violation. The maximum penalty amount is precisely that – if the FTC (or the DOJ) is litigating against you in federal court, that’s the maximum they can seek per violation. And since we are talking “per violation,” you can be pretty certain that number will ratchet up to “billions and billions” of dollars very quickly. There is not a great deal of clarity about what “per violation” really means, and it may vary based on the rule at issue. But it will be an enormous number. For example, in a telemarketing case, each call may be considered a violation; if a million violative calls were made, we are talking a maximum penalty of $46 billion and some change. And a million isn’t a particularly huge number of calls in a telemarketing case.

So what factors go into the analysis of an appropriate civil penalty beyond the huge number we discussed above? Well, as my contracts professor used to say, “Always read to the end of the statute.” For rule violations, Section 5(m)(1)(C) provides that “[i]n determining the amount of such a civil penalty, the court shall take into account the degree of culpability, any history of prior such conduct, ability to pay, effect on ability to continue to do business, and such other matters as justice may require.” That’s a lot of factors, and it certainly provides a great deal of room for advocacy – particularly that last catchall provision of “other matters as justice may require.”

The statute gives parties a great deal of latitude to develop arguments to justify lower numbers, so come prepared with your best arguments and a detailed analysis of how those factors relate to the allegations at issue. But there are certainly some key touchstones that are always relevant to the analysis. How much revenue was obtained through the violative conduct? How about profits? How long was the conduct ongoing? What remediation steps were taken? How have prior similar violations been addressed by the agency? On that last question, it is certainly relevant, in my humble opinion, and is worth analyzing – but you shouldn’t be surprised if the response you get back from some commissioners is “that was a different Commission.”

Another thing to flag on the penalty front is the knowledge standard. The statute requires that to obtain penalties in a rule violation matter, the agency must show the defendant had “actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule.” There isn’t much case law describing the contours of this provision. However, that standard might not be difficult to demonstrate with respect to well-known rules that have been on the books for a long time or narrow industry-specific rules. But meeting that standard can be a real challenge for the agency if we are looking at a broad new rule or a novel or an unusual interpretation of an existing rule. And we are certainly seeing some indication that the agency will likely be heading in that direction in a few areas.

And finally, let’s talk about some of the commissioners for a bit, who have, not surprisingly, had some different views on appropriate penalty amounts. A few relatively recent statements are worth flagging. In early 2021, the Commission announced its first cases under the Better Online Tickets (BOTS) Act, which allows the FTC to obtain penalties against entities that use bots or other means to circumvent limits on online ticket purchases. The three parties settled for more than $31 million in penalties, which were partially suspended. Commissioner Slaughter issued a concurring statement and noted favorably that “[t]he civil penalty amounts in these settlements are much higher than the revenues that the defendants raked in through the conduct charged in the complaints.” And contrast that with a 2019 COPPA matter that alleged a company unlawfully collected persistent identifiers for the purpose of serving behavioral advertising. The agency imposed a $4 million penalty that was largely suspended based on inability to pay. Commissioner Phillips dissented because the penalty was too high, noting that although a violation did occur, the harm that was alleged was notably less than the harm alleged in other COPPA cases. And in a more recent COPPA matter, he reiterated his concern that penalties should be tied to harm and noted that “the Commission should work toward greater transparency and consistency of how it assesses penalties for privacy violations.”

As I indicated in my spoiler, much like life, the penalty analysis is complicated and there is no simple formula to apply. The threat of a civil penalty action is a serious thing and should be treated as such – $46 billion is a pretty big number.