FTC Act, Section 5

Section 5 prohibits unfair or deceptive acts or practices in commerce, and it is the authority behind every federal privacy enforcement action against a company not covered by a sector statute. The FTC's tracking-technology cases follow one pattern: the privacy policy said one thing, and the pixels and SDKs did another. GoodRx and BetterHelp paid $1.5 million and $7.8 million in 2023 for sharing health information with advertising platforms, and the agency's data-broker and location-data orders against X-Mode, InMarket, and others turned on what SDKs were observed sending at runtime. Consent orders run twenty years and carry civil penalties of up to $53,088 per violation for breach. A deception claim needs only a gap between the stated practice and the observed one, which is why the observed practice has to be documented first.