CafePress Owners Nabbed for Failing to Protect Consumer Data
Company left Social Security numbers out and unencrypted, then hid the data breach
Nothing to See Here, Move Along
CafePress has a surprisingly durable Internet presence. Unlike with the hefty giants of e-commerce, its brand doesn’t command immediate recognition.
Instead, CafePress has spent 23 years helping consumers pump out endless variations of self-designed T-shirts, mugs, totes and what have you alongside pre-branded items of the same ilk. It’s the sort of business that never makes the news but that everyone wishes they had founded, in part because it never makes the news—being instead a quiet, no-drama moneymaker.
But is anything on the Internet drama-free for long?
Hack-O-Lantern
Residual Pumpkin Entity LLC and PlanetArt LLC—the former and current owners of CafePress, respectively, with names that indicate they were both former ’90s Bay Area trip-house collectives—recently got hit with a complaint from the Federal Trade Commission (FTC or Commission). And if you’ve ever used CafePress to turn out a few promotional baby onesies for your pet grooming business, you’d better read on.
The Commission alleges that Residual Pumpkin failed “to provide reasonable security for the Personal Information stored on its network.” According to the complaint, personal information, such as Social Security numbers and answers to security questions, was stored unencrypted in clear, readable text. The company also allegedly failed to implement reasonable measures to protect passwords, relied on outmoded algorithms, created unnecessary risks to personal information by storing it indefinitely on its network without a business need, and failed to implement reasonable procedures to prevent, detect or investigate an intrusion, among other allegations.
Unfortunately, the unsecured data—which included millions of encrypted passwords; unencrypted email addresses, names and physical addresses; and more than 180,000 unencrypted Social Security numbers—was compromised in a February 2019 hack, which resulted in at least some of the consumer records being sold on the dark web. The Commission acknowledged that Residual Pumpkin patched the initial vulnerability but alleged the company failed to properly investigate the breach for several months despite warnings from multiple entities, including an April 2019 missive from a foreign government notifying the company of the hack and urging it to alert its customers.
The Commission claims that Residual Pumpkin improperly withheld information about the breach from its customers.
The Takeaway
The grave mistakes allegedly made by Residual Pumpkin here are generally understood to be no-nos among data security professionals. We won’t speculate on why the company failed to address the various security risks and breaches. However, it is important to note that PlanetArt, the company that subsequently acquired CafePress in 2020, did so after these incidents occurred. If there’s a key takeaway here, it’s a reminder of how important it is for acquiring companies to perform a deep-dive on the security profiles of their intended acquisition targets as part of their due diligence. That’s just good business strategy at this point.
According to the FTC press release, as part of the proposed settlement agreement, both Residual Pumpkin and PlanetArt will be required to (i) implement comprehensive security programs that address the issues that led to the data breaches, (ii) replace their outdated and inadequate authentication measures with more-secure multifactor authentication methods, (iii) minimize the amount of data they collect and retain, and (iv) encrypt Social Security numbers. In addition, Residual Pumpkin will be forced to pay $500,000 to the victims, and PlanetArt will be required to notify all customers affected by the breaches.
Defecating Reptile Toy Contains…Choking Hazard?!
CARU tells manufacturer to edit its labeling, get parents ‘involved’
Kids These Days
We were kids once. Really, we were. Filled with joy, the wonder of discovery, yadda yadda. Even had a sense of humor on occasion.
But after a certain age—let’s say, 2 years old—well…we lost interest in certain childish things. Like poop. Our own poop, someone else’s poop, the cat’s poop…we just weren’t interested in it, except maybe as part of a prank involving a doorbell, a lit match and a paper bag.
So check this out.
For those of you without access to the YouTube, or who are now justifiably nervous at the prospect of clicking the link, it’s a perfectly safe-for-work video review of a toy. A toy named Shelbert the Turtle. A toy that’s been packaged as “Gotta Go Turdle.”
Yes, the name is spelled correctly. Shelbert “eats” purple sand called “magic turtle food,” sings about needing to poop and then evacuates into his own toilet. “Turdle,” you see. Then—and this is the best part—the lucky tyke who’s playing with this toy gets to strain the purple poop out of the toilet bowl and feed it to the turtle again.
Someone thought of that name and then designed and executed the product. Someone thought it would sell. For $23.99.
What is happening to this country?
Did Hemingway Have This Problem?
Someone thought it would sell; we don’t know if it did. Or does. But it was enough of a bright prospect that Moose Toys, the “turdle’s” manufacturer, laid out dough for an ad campaign including YouTube videos and TV advertising.
That’s where the Children’s Advertising Review Unit (CARU) enters the picture. The ads raised CARU’s hackles. It believed young children would conclude that the purple-sand-magic-turtle-poop included with Shelbert could, or should, be eaten. And this conclusion, in turn, inspired what must be the greatest sentence ever produced by CARU:
“Watching the ad, children also may want to experiment with the Turdle food to make purple poops of their own.”
Furthermore, given the risk of purple-sand-magic-turtle-poop consumption—a phrase we never thought we’d write—Moose Toys went astray when it didn’t include an adult in the advertisements.
Because eating purple-sand-magic-turtle-poop, it turns out, is problematic.
The Takeaway
According to CARU, “[a] safety data sheet produced by Moose Toys, which is not distributed within the toy packaging, indicates that the main ingredient of the Turdle food is silicon dioxide (vitreous silica). If ingested, there is a risk of nausea and abdominal discomfort. If a large quantity is ingested, this aqua-sand can pose a risk of choking or gastrointestinal obstruction.”
Despite all these issues, CARU ruled that “[t]he toy’s packaging does not adequately disclose that children should not eat the Turdle food. Instead, it contains only a small warning that the toy is not intended for children under three years old because of a ‘choking hazard due to small parts.’” Small parts, meaning, of course, individual grains of purple sand in the magic-turtle-poop.
CARU recommended that Moose Toys modify the ads, as well as the toy’s packaging, to include the disclosure that kids shouldn’t eat the…well, you know. Also, the ads needed to depict adult supervision whenever a child is shown playing with the toy.
The takeaway? There are so many. On so many different levels. But for now, we’ll just say this: Always consider the implied messages your ads may be conveying from the standpoint of the children to whom they are directed, and consider all potential hazards, not just the obvious ones. And of course, always add adults to the advertising of your kid-oriented product if there’s any chance parental oversight is needed.
And don’t play with poop.
Godiva Origin Claims Ride Again?
Hold your horses, say state AGs
Chocolate-Coated Inference
Here’s an update to a story we covered back in October of last year—a false origin and deceptive practices class action aimed at Godiva Chocolatier over its ubiquitous “Belgium 1926” packaging tag.
Two consumers sued Godiva in 2019 over the tag, claiming that they paid a premium to purchase fancy European chocolate from the company—when, in fact, Godiva produces its chocolates in Pennsylvania.
Godiva moved to dismiss but lost on the origin claims. The court concluded that Godiva’s argument that the “1926 Belgium” tag was a “factually accurate phrase that imparts an unambiguous and historically accurate message” was a bridge too far. “An equally, if not more, plausible inference is that the phrase represents both the provenance of the company—Belgium, in 1926—and a representation that its chocolates continue to be manufactured there.”
Faced with the prospect of further action, Godiva agreed in October to a settlement whereby it would fork over $15 million to affected consumers.
Unsettling Developments
Godiva might have thought it was all over. But a group of pesky state attorneys general are trying to revamp the settlement, which they claim is unfair to affected consumers.
The state AGs of Florida, Idaho, Maryland, New Jersey, Ohio and Utah wrote a letter of concern to the Honorable Judge Alison Nathan of the Southern District of New York, “to address several issues that have come to our attention regarding the proposed settlement.” First on their list: a $15 cap on settlement benefits for consumers without receipts and a $25 cap on benefits for those who can supply proof of purchase.
Noting that while more than 80 percent of class members received notice of the plan and that the maximum amount paid out had yet to reach the $15 million mark, they asserted that “the arbitrary $25 cap…serves no purpose except to depress the claims rate…[because] choosing an arbitrarily small maximum claim that is only marginally more money than the maximum claim without proof of purchase” only discourages class members from digging up receipts.
Additionally, the AGs objected to the settlement’s lack of injunctive relief for the consumers. The letter argues that due to Godiva’s retention of the contentious tag, “[t]he contours of this settlement allow Godiva to continue extracting a price premium from class members and other consumers who make additional purchases and temporarily insulates Godiva’s labeling and marketing practices from future private law suits.”
The Takeaway
If you’re ever so unfortunate as to be mired in a class action suit, remember these state AGs’ objections. While this state intervention is somewhat unusual, it may be a signal that regulators will be watching these cases more carefully and using their authority to ensure that the settlements provide meaningful relief to consumers. A continuation of this trend could be a game changer in the class action arena.
Everyone’s Favorite Plaintiff’s Counsel Stops By for Tea
Subjective taste suit is return to form for Snack Dragon, but the product is new
Aftertaste…
As readers of our recent posts will remember, Snack Dragon is the nickname we’ve developed for an incredibly hyperactive plaintiff’s counsel, which will remain nameless.
The nickname is inspired by the firm’s class actions against Mars Wrigley Confectionary, which dealt with chocolate-covered ice cream bars and berries. The firm has always had an interest in consumer products—yogurt, for instance, and even charcoal briquettes. Now they’re taking a sip from a different cup—tea.
But aside from a recent slack-fill lawsuit, Snack Dragon sticks to a limited repertoire. One favored tactic is to claim that consumers paid a premium to purchase a product with the expectation of experiencing a taste that only natural ingredients could produce, and that the consumer was then disappointed to learn that the product’s taste deficiencies were the result of artificial ingredients.
The Slight Stuff
This latest case, which was tossed out by the Southern District of New York in early March, has a familiar taste. In Brown v. Kerry Inc., plaintiff Jaclynn Brown asserted claims of misrepresentation under New York law, fraud, unjust enrichment and breach of warranty against Kerry Inc. for its Oregon Chai tea. She argued that because Kerry Inc.’s Oregon Chai brand black tea was labeled “Slightly Sweet” (among other similar tags), she was deceived into believing that the product was low in sugar.
What follows is a litany of studies demonstrating that consumers are desperate to find low-sugar products, that they often place trust in product packaging to determine the sugar levels in a product, and that sugar is awful for you on a variety of fronts.
It’s a flurry of information, but it doesn’t cover up the central issue—and flaw—in the case: Does the tag “Slightly Sweet” lead a reasonable consumer to believe that the product is low in sugar?
The Takeaway
In an order adopting a magistrate judge’s report and recommendation, the Southern District agreed that “Slightly Sweet” was mere puffery. Quoting the magistrate, the court noted that “Slightly Sweet…provides no objective measurement or indication of the amount of sugar in the product, and refers instead to a subjective claim about the Product’s level of sweetness that cannot be proven either true or false.”
Moreover, nutrition information on the product label “explicitly states the amount of sugar and number of calories” in the tea, dispelling “any ambiguity or confusion regarding the Product’s sugar content.”
We’re not sure what to recommend based on this result, except for dogged diligence. In a world where Snack Dragon files multitudes of class actions, all with similar allegations, it seems as if any tag, no matter how reasonable, may be an occasion for a suit.
The diligence? Advertising tags built around clear and honest ingredient and nutrition information is your best defense, although no approach offers guaranteed protection. After all, the court “somewhat reluctantly” granted Brown leave to amend the complaint. And a while ago, Blue Diamond Growers settled a similar case, also brought by Snack Dragon, to the tune of $2 million.
Heads up!
Court Tosses ‘Natural’ Ad Suit Over Ingredient the Plaintiff Didn’t Even Mention
Selsun Blue Naturals is a fine name, even if it includes synthetic ingredients
It’s Tingling, Damnit!
This case is an odd one.
New Yorker Jimmy Mustakis purchased bottles of “Selsun Blue Naturals,” a flavor of the well-known anti-dandruff shampoo, for about $7 in 2020. He claims that he was drawn into the purchase by the “naturals” tag line on the shampoo’s bottle. In his initial complaint, he asserts that “[r]easonable consumers…value natural products for important reasons, including the belief that they are safer and healthier than alternative products that are not represented as natural.” But imagine Jimmy’s surprise when, after several purchases of the product, he noticed a laundry list of synthetic ingredients on the product packaging, including panthenol, disodium EDTA, propylene glycol and citric acid.
(Yes, citric acid. Mustakis explains the last entry by noting that “[w]hile the chemical’s name has the word ‘citric’ in it, citric acid is no longer extracted from the citrus fruit but industrially manufactured by fermenting certain genetically mutant strains of the black mold fungus, Aspergillus niger.” Thanks for the heads-up, Jimmy.)
Mustakis filed suit against Chattem Inc., the maker of Selsun Blue, in late 2020, seeking injunctive relief and alleging deceptive practices and false advertising under New York state law, breach of warranty, violations of the Magnuson-Moss Warranty Act and unjust enrichment. His argument is a familiar one to anyone acquainted with consumer product advertising disputes: People like Mustakis pay a premium for “natural” products and suffer when they pay higher prices for products that claim to be natural but are not.
Acid Trip
Chattem moved to dismiss, and that’s where things take a weird turn.
Of all the synthetic materials Mustakis listed in his complaint, one Selsun Blue ingredient did not appear—salicylic acid. It’s on the label, and not just in the ingredient list; it’s mentioned right on the front of the bottle, directly under the word “Naturals.”
The court used the presence of salicylic acid in the product and its explicit mention on the front of the bottle as one of the main reasons to nix the case. “No reasonable consumer would believe that a product containing three percent salicylic acid is entirely free from synthetic ingredients,” the court wrote in its order.
Later in the order, the court stated, “Plaintiff asserts that he and other class members were defrauded because they ‘value natural products for important reasons, including the belief that they are safer and healthier than alternative products.’ Yet such protestations seem misplaced where the principal ingredient prominently featured on the front of the Product has long been known to be anything but safe and healthy. As the front label of the Product prominently identifies this chemical on the same line as the text which identifies the product in the bottle, it seems implausible that a reasonable consumer could be misled.”
Really? We’ve taken an informal poll, and it would seem strange to us if any non-chemist even knew what salicylic acid was, let alone that it posed health risks. There are plenty of acids that are necessary for human health—most people are bullish on citric acid, after all—and the ingredient’s proximity to “Naturals” on the label might suggest as much in this case.
But we’re not representing Mustakis. We’re just noting this important fact for potential future litigants of related issues.
The Takeaway
Seriously – the order begins with a pull quote from 1907’s Adulteration of Food: Report, Returns and Statistics of the Inland Revenues of the Dominion of Canada calling salicylic acid a “very harmful substance.”
That’s a deep cut.
A far more persuasive reason to toss the case—to our ears, anyway—is the use of the word “Naturals” itself, which the court addresses. The product label “does not claim ‘Selsun Blue Naturals’ is ‘all natural’ or ‘100% natural.’ Rather, the term ‘Naturals’ appears only in the brand name,” the court maintains. Or, on another front, “the inactive ingredients on the back label disclose the synthetic ingredients plaintiff complains of as well as a number of natural ingredients such as lavender and rosemary extract, which supports the defendant’s use of the term ‘Naturals.’”
And so, the case was doomed on multiple fronts. The Eastern District tossed the case in its entirety in early March.
As we’ve said before, again and again: context is king. The word “natural,” like other “green” marketing tags, will always be interpreted in conjunction with the entire product package. Mustakis’ complaint fell to three separate defenses. Strong packaging.
And at the end of the day, we are talking about anti-dandruff shampoo, right?
It’s supposed to make your scalp tingle. Who would ever think this stuff is all natural “natural”?
Check Out Our Latest Blog Posts
Taking a Lesson from the FTC – Reviews and Gag Clauses Emerge as CFPB Issues
We have talked a lot this year about the Federal Trade Commission’s (FTC) focus on reviews, and so far we have seen cases involving review suppression and incentivized reviews, as well as new guidance about how platforms and marketers should handle reviews. And the Consumer Financial Protection Bureau (CFPB) has now staked its claim to this issue, asserting that there is yet another review sheriff in town – this time, one focused on financial products and services.
Daniel Kaufman Discusses COPPA and Safe Harbors
On March 23, Daniel Kaufman joined an episode of The Accountability Studio, a BBB National Programs podcast.
The 9th Public FTC Meeting – Reporting on Vaping and E-Cigarettes
The Federal Trade Commission (FTC) has a long history of addressing issues involving cigarettes and tobacco, often in the advertising context. Indeed, one of us bloggers started at the FTC in 1998, and the first case he worked on was the agency’s litigation against R.J. Reynolds. That case alleged that the company’s use of the Joe Camel mascot in an advertising campaign was an unfair practice because it allegedly induced children and adolescents under 18 to start smoking. The Joe Camel case ended a bit unceremoniously in 1999 after the FTC moved to dismiss the matter because “the relief sought in this proceeding has now been achieved through a recent settlement between the major tobacco companies.” Among other things, the settlement marked the end of the use of “all cartoon characters, including Joe Camel, in the advertising, promotion, packaging, and labeling of any tobacco product.”
[View source.]
